Difference between revisions of "Modem BBox-2"

From YobiWiki
Jump to navigation Jump to search
Line 10: Line 10:
 
Serial Num LK12345DP123456
 
Serial Num LK12345DP123456
 
VDSL Version Firmware-VTU-R:1.0.7r57bIK105012 Time Dec 27 2007, 18:50:21
  
VDSL Version Firmware-VTU-R:1.0.7r57bIK105012 Time Dec 27 2007, 18:50:21
  +
  +
VDSL sync:
  +
Downstream line rate 21648 kbps
  +
Upstream line rate 2848 kbps
  +
Downstream Training Margin 19.1 dB
  +
  +
test Speedtest.nl:
  +
Downstream line rate 11Mbps
  +
Upstream line rate 1Mbps
   
 
==Exploration==
  
==Exploration==

Revision as of 19:20, 9 September 2009

Description

This is the default modem coming with Belgacom internet solutions in Belgium.
It allows SIP and IPTV.

It's a Sagem F@st 3464 (even if the box looks different), running a customized version of Jungo Openrg.

Version information, as visible on the web interface: 

Runtime Code Version   6001GR-6000GR 
Hardware Version       1
Serial Num             LK12345DP123456 
VDSL Version           Firmware-VTU-R:1.0.7r57bIK105012 Time Dec 27 2007, 18:50:21

VDSL sync: 

Downstream line rate        21648 kbps
Upstream line rate          2848 kbps
Downstream Training Margin  19.1 dB

test Speedtest.nl: 

Downstream line rate        11Mbps
Upstream line rate           1Mbps

Exploration

A number of services & ports are available:

web interface

You can reach it via any of those addresses:

HTTPS offers a OpenRG SSL certificate, to be explicitly accepted by your browser to go further...

Admin settings menu:
If you're logging as admin rather than user as default, you'll get an extra menu:

This allows to save and restore the whole configuration and to upload new firmwares, if any.

Other pages might be accessible, cf this thread (french) or this page (french)

memory sharing

Apparently you may connect a USB harddrive to the BBox-2 and share its content as with a NAS.
-> /mnt/usb internally A webserver (lighttpd) would then expose the content via:

Or if via the admin menu, you enable memory sharing, we get the same via a WAN (accessible outside too!) https:

HTTPS offers a Sagem certificate

telnet

  • telnet on 192.168.1.1 port 23 and port 8023
  • telnet SSL on port 992
  • login admin password BGCVDSL2
  • (TODO: try user/user)

If you type the command "shell" you'll get a shell prompt and a busybox environment ;-) 

[admin @ home]$ shell


BusyBox v1.01 (2009.02.19-21:18+0100) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

# cat /proc/version 
Linux version 2.6.15 #24 Mon Mar 2 18:21:25 CET 2009
# 
# cat /proc/cpuinfo
system type		: ADI Fusiv Core
processor		: 0
cpu model		: Lexra LX4189 V0.0
BogoMIPS		: 199.47
wait instruction	: no
microsecond timers	: no
tlb_entries		: 64
extra interrupt vector	: no
hardware watchpoint	: no
ASEs implemented	:
VCED exceptions		: not available
VCEI exceptions		: not available

# ps
  PID  Uid     VmSize Stat Command
    1 0           652 S   /bin/init 
    2 0               SWN [ksoftirqd/0]
    3 0               SW< [events/0]
    4 0               SW< [khelper]
    5 0               SW< [kthread]
    8 0               SW< [kblockd/0]
   11 0               SW< [khubd]
   35 0               SW  [pdflush]
   36 0               SW  [pdflush]
   38 0               SW< [aio/0]
   37 0               SW  [kswapd0]
  559 0               SW  [mtdblockd]
  574 0          4436 S   /bin/openrg 
  629 0               SWN [jffs2_gcd_mtd1]
  677 0           348 S   /bin/sh /etc/vdsl.sh 
  680 0          2208 S   vdsld 
  686 0           560 S   /bin/main_autom /etc/process_list.dat 2 9 
  687 0           560 S   /bin/main_autom /etc/process_list.dat 2 9 
  688 0           560 S   /bin/main_autom /etc/process_list.dat 2 9 
  689 0          2208 S   vdsld 
  690 0          2208 S   vdsld 
  691 0          2208 S   vdsld 
  692 0          2208 S   vdsld 
  693 0          2208 S   vdsld 
  694 0          2208 S   vdsld 
  695 0          2208 S   vdsld 
  696 0          2208 S   vdsld 
  697 0          2208 S   vdsld 
  753 0          4436 D   /bin/openrg 
  752 0               SW  [idmaThread]
  754 0           424 S   hostapd /etc/hostapd.conf.eth2 
  757 0           764 S   /bin/watchdog 
  758 0           560 S   /bin/main_autom /etc/process_list.dat 2 9 
  772 0           228 S   /usr/local/bin/syncloop 
  777 0           644 S   /usr/local/sbin/lighttpd -f /mnt/ffs/A/lighttpd.conf 
  781 0           388 S   /bin/igmpsnoop -i eth0 -l 30 -c 0x10080 -v -t 
  782 0           380 S   /bin/oam start 5 
  783 0           688 S   /bin/prod_autom /etc/process_list.dat 5 5 
  786 0           296 S   /bin/syslogd-sa -b 
  787 0           380 S   /bin/oam start 5 
  788 0           688 S   /bin/prod_autom /etc/process_list.dat 5 5 
  789 0           380 S   /bin/oam start 5 
  790 0           688 S   /bin/prod_autom /etc/process_list.dat 5 5 
  791 0           688 S   /bin/prod_autom /etc/process_list.dat 5 5 
  792 0           800 S   /bin/tr98 5 5 
  795 0          1804 S   /bin/tr69 --debug 5 
  797 0          1804 S   /bin/tr69 --debug 5 
  798 0          1804 S   /bin/tr69 --debug 5 
  799 0           800 S   /bin/tr98 5 5 
  800 0           800 S   /bin/tr98 5 5 
  801 0          1804 S   /bin/tr69 --debug 5 
  802 0          1804 S   /bin/tr69 --debug 5 
  803 0           800 R   /bin/tr98 5 5 
  806 0          2424 S   /bin/sipd /etc/process_list.dat 5 5 
  807 0          2424 S   /bin/sipd /etc/process_list.dat 5 5 
  808 0          2424 S   /bin/sipd /etc/process_list.dat 5 5 
  809 0          2424 S   /bin/sipd /etc/process_list.dat 5 5 
  810 0          2424 S   /bin/sipd /etc/process_list.dat 5 5 
  815 0          2424 S   /bin/sipd /etc/process_list.dat 5 5 
  816 0          2424 S   /bin/sipd /etc/process_list.dat 5 5 
  817 0          2424 S   /bin/sipd /etc/process_list.dat 5 5 
  818 0          1804 S   /bin/tr69 --debug 5 
  862 0           688 S   /bin/prod_autom /etc/process_list.dat 5 5 
 1318 0           444 S   /bin/sh 
 1327 0           320 R   ps ax 
# 
# df
Filesystem           1k-blocks      Used Available Use% Mounted on
cramfs                    2560      2560         0 100% /mnt/cramfs

# cat /etc/mtab
rootfs / rootfs rw 0 0
cramfs /mnt/cramfs cramfs_mainfs ro 0 0
/proc /proc proc rw,nodiratime 0 0
usbfs /proc/bus/usb usbfs rw 0 0
/sys /sys sysfs rw 0 0

# cat /proc/mounts 
rootfs / rootfs rw 0 0
cramfs /mnt/cramfs cramfs_mainfs ro 0 0
/proc /proc proc rw,nodiratime 0 0
usbfs /proc/bus/usb usbfs rw 0 0
/dev/mtdblock1 /mnt/ffs/A jffs2 rw,sync,noatime 0 0
/sys /sys sysfs rw 0 0

I got also /mnt/ffs mounted once, should check again...

Website files are in /mnt/cramfs/home/httpd/html

Trying to change the theme (this didn't bring extra menu, to the contrary) 

[admin @ home]$ rg_conf_print wbm/theme     
(theme(Sagem))
[admin @ home]$ rg_conf_set wbm/theme OpenRG
[admin @ home]$ rg_conf_print wbm/theme     
(theme(OpenRG))

To revert: 

[admin @ home]$ rg_conf_set wbm/theme Sagem

To learn the commands to manipulate the configuration, see here (french)

others

  • 2555/tcp open unknown UPnP???
  • 7020/tcp open unknown remote management rmt_mng???
  • 7021/tcp open ssl ???
  • 8085/tcp open unknown gSOAP_Web_Service???

accessible from WAN

  • pings seem to be blocked
  • 631 open?
  • 2555 open?
  • 7020 open?
  • 7021 open?
  • 8085 open?
Retrieved from "https://wiki.yobi.be/index.php?title=Modem_BBox-2&oldid=5920"