Unlock FASTGate DGA4131

Unlock Fastweb FastGate DG4131, access Technicolor file system and edit configuration files via SMB, follow these steps:

Flash the downloaded firmware image to external USB disk (>128 Mb) using Win32DiskImager available inside ImageWriter folder

Enable Samba using this command (change IP if needed):

http://192.168.1.254/status.cgi?3g_pin=********&act=nvset&samba_enabled=1&samba_workgroup=WORKGROUP%5c%0a%09security%20%3d%20share%5c%0a%09guest%20account%20%3d%20root%5c%0a%09interfaces%20%3d%20lo%20br-lan%5c%0a%5c%0a%5bohnonotagain%5d&service=usb_status

Browser should return this JSON structure

 {
   "usb_status":{
     "samba_workgroup":"WORKGROUP\\\n\tsecurity = share\\\n\tguest account = root\\\n\tinterfaces = lo br-lan\\\n\\\n[ohnonotagain]",
     "disk_protected":"0",
     "3g_pin":"********",
     "samba_enabled":"1",
     "disk_username":"",
     "3g_fallback":"1",
     "3g_username":"",
     "3g_activation":"2",
     "samba_share_on":"lan",
     "dlna_enabled":"1",
     "3g_timeout":"60",
     "usb_status":"end",
     "disk_password":"",
     "samba_server":"FASTGATE",
     "3g_connection_status":0,
     "total_disks":0,
     "printserver_enabled":"1",
     "3g_apn":"",
     "3g_password":""
   }
 }

Use File Explorer to access \\192.168.1.254\usbdisk\USB-A1\rootlink and browse the router file system

Edit etc/config/button file and change option handler of config button ‘wps’ section with the following:

option handler 'uci set button.wps.handler='\''wps_button_pressed.sh'\'' && sed -i '\''s#root:/bin/false#root:/bin/ash#'\'' /etc/passwd && sed -i '\''s/#//'\'' /etc/inittab && echo -e '\''root\nroot'\'' | passwd && uci set dropbear.lan.Interface='\''lan'\'' && uci set dropbear.lan.Port='\''22'\'' && uci set dropbear.lan.IdleTimeout='\''600'\'' && uci set dropbear.lan.enable='\''1'\'' && uci set dropbear.lan.RootPasswordAuth='\''on'\'' && uci set dropbear.lan.RootLogin='\''1'\'' && uci set dropbear.lan.PasswordAuth='\''on'\'' && uci set system.@coredump[0].reboot='\''0'\'' && uci commit && /etc/init.d/dropbear restart'

This will enable SSH and set root/root as login.

Test SSH root@192.168.1.254 and login with “root” as psw

BusyBox v1.23.2 (2018-12-14 20:54:18 UTC) built-in shell (ash)
  _______              __           __              __
 |_     _|.-----.----.|  |--.-----.|__|.----.-----.|  |.-----.----.
   |   |  |  -__|  __||     |     ||  ||  __|  _  ||  ||  _  |   _|
   |___|  |_____|____||__|__|__|__||__||____|_____||__||_____|__|
--------------------------------------------------------------------
                  N E X T   G E N E R A T I O N   G A T E W A Y
 --------------------------------------------------------------------
 NG GATEWAY SIGNATURE DRINK
 --------------------------------------------------------------------
 1 oz Vodka          Pour all ingredients into mixing
 1 oz Triple Sec     tin with ice, strain into glass.
 1 oz Orange juice 
 --------------------------------------------------------------------
 Product: vbnt-o_fastweb
 Release: Mint (17.2)
 Version: 17.2.0412-2141001-20181215141731-d7f55d25ae48aa5b3ea0648c032fc93dc2628c32

Hash config:         d7f55d25ae48aa5b3ea0648c032fc93dc2628c32
Hash openwrt:        0f2e4683a1d1965c9e8807a706832f67d32ec126
Hash kernel:         11a88a3f5dcaefe38a923784dc3fc610d62d9eed
Hash lte:            2ad4afe45c39bd6d89050a167734dd040ddc9b01
Hash technicolor:    854ea20ee7b08645442ed6306b6c98e44a18705d
Hash mindspeed:      cd5df6841bf54c8c1d7e716ce22d0afa2fef66e5
Hash custo:          d605bb29b5645d6af0a1de4dd106367f65ee9625
Hash routing:        04c6697034fc47fdc757bc7897ffb76f8501d138
Hash packages:       39b0f8e84d0c2d5ce2d51a95f49fa130d62d8b15
Bootloader: 17.19.1058-0000000-20170508093010-b91cf4e98e3e4e8d3c46306855ce85449a59781f

Change root password with passwd cmd and type new password

Install original and optimized Technicolor GUI

Additional OpenWrt ipk packages per brcm63xx-tch ARM Linux 3.4.11-rt:

Sources: