search

latonita / tenda-reverse

Reverse engineering, getting root access to Tenda MW6 wifi mesh router
125 stars 18 forks source link

Access Tenda MW3 #7

Open xifi-kif opened 3 years ago

xifi-kif commented 3 years ago

Wow, great work, really! I understand just 1/3 of the things you wrote, my English is not very good and I'm very far from your skills, but what I understood should be enough for what I need :) that is get rid of that stupid dhcp in bridge mode, since my main openwrt router is far more complete and safe to manage than this mesh system. Oh btw I got 3 Tenda MW3, which is the older and cheaper version, i think, of yours. Hopefully they share same password and login systems.

So if I understood correctly, to check if your discovers work also with my Tenda: in order to have access, I just need to hold reset for 3 sec and telnet in using base 64 password for user root. Right?

Then when I'm in I just set 0 value to dhcps.listnum using cfm. And that's it?

latonita commented 3 years ago

You got it right! Mw3 I believe has almost same firmware. Please try and let us know. Thanks

totalretribution commented 3 years ago

@xifi-kif Did you manage to access your MW3, Do you have to be connected to the LAN port on the device or can you telnet in via wifi?

xifi-kif commented 3 years ago

I didn't had time to try till now. I'll tell you if I succeed

xifi-kif commented 3 years ago

All right, just tried. It works!! And pritty easily. Great Job @latonita ! I did telnet over LAN, did't tried over WiFi, you can try it @totalretribution.

xifi-kif commented 3 years ago

I've also experienced a x2 speed in up/download after making the main router do the dhcp effort. I'm almost able to reach maximum theorical speeds of 100/100 from MW3.

xifi-kif commented 3 years ago

update after some time: I'm experiencing high packet loss. Have to dig into the issue.

totalretribution commented 3 years ago

Thanks xifi-kif, I could not get it to work but since you succeeded I will try again when I get some time.

xifi-kif commented 3 years ago

Ok after 1 day of testing I have to say I was celebrating too early. changing dhcp.listnum to 0 doesn't seem to disable the dhcp server on the tenda :( nmap scan says dhcp port is filtered, so it's very strange.

crees commented 2 years ago

You need to reboot after setting dhcp.listnum=0.

xifi-kif commented 2 years ago

@crees did you manage to disable DHCP on tenda MW3? I did not tried further, and instead configured again all the services and port forwards on the tenda... Long work and I'm not happy wiht it. So if you managed to do it I can try again maybe!

tiagoclc commented 2 years ago

I dont know about the twibi giga but about twibi fast the password is the last 6 digits of mac address. The twibi fast cant upgrade from version 1.1.2 to 1.1.3 and subsequently to 1.1.10. The user have to open a teamviewer connection for intelbras technician. This way he can use a telnet client to prepare the twibi fast for receive the firmware upgrades.

So I thought: what if I install a keylogger on my computer? And I did! With that I captured the password that the technician typed. and it was the last 6 digits of the mac address.

To enable telnet service you must press the reset button 4s.

Twibi Fast telnet Port: 23 User: root Password: last 6 digits of mac address (printed on the bottom label)

IMG_20220426_102128 IMG_20220507_130520

latonita commented 2 years ago

@tiagoclc how does this Twibi relate to Tenda? Is it some kind of rebranded product?

tiagoclc commented 2 years ago

@latonita yes. Its rebranded by intelbras. But the twibi fast reaches only 100mb and the twibi giga reaches 1000mb.

crees commented 2 years ago

@crees did you manage to disable DHCP on tenda MW3? I did not tried further, and instead configured again all the services and port forwards on the tenda... Long work and I'm not happy wiht it. So if you managed to do it I can try again maybe!

@xifi-kif, I'm sorry, necro reply. I did disable DHCP on the MW5, so it should work the same for the MW3. Don't forget to use cfm set as above, and then make sure you reboot.

If it didn't work after a reboot I'd be pretty surprised.