In reply to a post by j0hn83:

To my eye that image doesn't have the noise filter.

Your AA page here states

It's believed that the VMG3925 has an extra common-mode noise filter on the telephone line. Kitz discussion

It then links to a discussion about 2 devices, that confirms a different device has the filter.

The VMG3926-B10B has the filter in but I'm not so sure the
VMG3925-B10B does unless they changed the shape/look of the filter.
kitz discussion

I think you mean the VMG3926-B10A. I don't think there is a B10B variant.

Paul

Indeed.
Zyxel like to mix things up with the lettering.
My mistake though.

In reply to a post by youngsyp:

In reply to a post by andrewhearn:

No, we don't.

Thanks for the confirmation. The OP must have the same device from another ISP. Or I simply interpreted his comment wrongly.

Paul

You interpreted his post incorrectly.
He's referring to obtaining the Supervisor password which is encrypted by default.

AAISP may also apply a Rom-D configuration file which applies automatic modifications to the firmware that may include things like TR-069.
The Rom-D would need cleared and the Supervisor pass would need cracked with hashcat to obtain full access to some relatively minor firmware settings.

That's very different from using their own firmware though and it leaves you free to update the firmware direct from Zyxel.

Are you saying you are achieving over 8 meg on FTTC at over 3 kilometres ?? That would seem quite remarkable good.

In reply to a post by j0hn83:

The Rom-D would need cleared and the Supervisor pass would need cracked with hashcat to obtain full access to some relatively minor firmware settings.

Thanks for the clarification.

Would the process you mentioned in the quote be that covered in this thread?

Paul

No that's for a completely locked down modem that needs opening up and connecting directly to the circuit board.

This is the thread you need

Specifically, do the following:

1. Flash v13 firmware.

2. login as admin to telnet and use the command "zycli save_default clean" to remove the Rom-D

3. do a pin reset

4. login as admin again and run the command "cat /etc/passwd" to get the hashed (encrypted) Supervisor password.
It looks something like this:
supervisor:$1$EGkNsL/s$lVaYwb0.BCvNnESBkTSpH1:12:12:supervisor:/home/supervisor:/bin/sh

5. crack it, or message someone on that thread to crack it. I'm happy to do this for anyone. I'm j0hn on kitz.

In reply to a post by j0hn83:

No that's for a completely locked down modem that needs opening up and connecting directly to the circuit board.

This is the thread you need

Specifically, do the following:

1. Flash v13 firmware.

2. login as admin to telnet and use the command "zycli save_default clean" to remove the Rom-D

3. do a pin reset

4. login as admin again and run the command "cat /etc/passwd" to get the hashed (encrypted) Supervisor password.
It looks something like this:
supervisor:$1$EGkNsL/s$lVaYwb0.BCvNnESBkTSpH1:12:12:supervisor:/home/supervisor:/bin/sh

5. crack it, or message someone on that thread to crack it. I'm happy to do this for anyone. I'm j0hn on kitz.

Thanks for this, appreciate it.


I've just read this thread. Does the release of the FW linked in post #248 mean just uploading the FW negates the need to extract and crack the supervisor password?

Paul

It does indeed.
Not a firmware I would install though.

I use the patched firmware to allow 1508 mtu and multiple telnet sessions but wouldn't install a firmware someone else made that overwrites the Supervisor password every minute till the end of time.
It does what it says on the tin but it's a very crass method imo.

It takes less than 15 minutes to crack the Supervisor password with a half decent GPU and then you can manually change it.

In reply to a post by j0hn83:

It does indeed.
Not a firmware I would install though.

I use the patched firmware to allow 1508 mtu and multiple telnet sessions but wouldn't install a firmware someone else made that overwrites the Supervisor password every minute till the end of time.
It does what it says on the tin but it's a very crass method imo.

It takes less than 15 minutes to crack the Supervisor password with a half decent GPU and then you can manually change it.

I'm certainly no expert on the subject but I agree with you. If I had the skills, it's certainly not how I'd do it.

To be honest, it's the ROM-D wiping that I'm interested in. I doubt I'd have any use for the configuration options requiring for the Supervisor password to access. It's a case of doing it because I can really.

Paul

Edited by deleted (Mon 24-Sep-18 13:54:28)

Can someone correct the page here.

It's believed that the VMG3925 has an extra common-mode noise filter on the telephone line. Kitz discussion

The 3925-B10B definitely does NOT have the extra common-mode noise filter found in other ZyXEL models.
The 3926-B10A being discussed on the kitz thread has it.

A number of members of kitz have purchased the 3925 assuming it has the extra filter. The AA page is the only place that mentions this.