Orange Bright Box: Hidden config pages! [NEW!]

Hi guys. Okay, I have found four *hidden* config pages, whilst trawling the firmware

http://192.168.1.1/u132xzp32aai.htm

http://192.168.1.1/xc324m12sdlo.htm

http://192.168.1.1/yds32u872vld.htm

http://192.168.1.1/z983erv3210ba.htm

Here are some screenshots, minus my personal data:

http://www.flickr.com/photos/22008695@N03/sets/72157...

NOTE: Login *first*, then visit these URLs. If you are logged out and click one, it will just ask you to login, but won't re-direct you to these URLs.

Have fun!

Edited by glossywhite (Thu 09-Feb-12 17:49:15)

Nice work.

In reply to a post by Zadeks:

Nice work.

Why thank you!

Good work!

The Parameters one with the choice of Operation Mode could be useful to some users.

In reply to a post by XRaySpeX:

Good work!

The Parameters one with the choice of Operation Mode could be useful to some users.

I just can't work out how I missed these before! I've had the /www/ folder backed up for well over a week now!

Thanks for the compliment.

Here's just an idea; dunno whether it'll be applicable to BrightBox.

This URL: http://192.168.0.1/setup.cgi?PATH=/bin:/sbin:/usr/bi... for the Netgear DG834GT can be presented to a Browser w/out using any TELNET Client. As you may see it is mini-program of BusyBox & Shell commands.

Can something similar be done for the BrightBox? Or does it require a running TELNET daemon?

I understand the other pages, but what is a TR69 module?

It's something connected to auto-config for customer equipment.

Man, I hate being the resident "Wikipedia quoter"... but it's all I have time for:

http://en.wikipedia.org/wiki/TR-069

Edited by glossywhite (Fri 10-Feb-12 13:54:37)

In reply to a post by glossywhite:

It's something connected to auto-config for customer equipment.

Man, I hate being the resident "Wikipedia quoter"... but it's all I have time for:

http://en.wikipedia.org/wiki/TR-069

Sounds like a "spy in the cab" to me

With the latest deployment of the new EE firmware, all but the 1st of these hidden pages is protected by a password.

So now I cannot play with forcing the ADSL Mode (2nd hidden page) and it has left mine fixed at ADSL2+.

Hi XRay - the ADSL mode config is now found under Advanced Setup > Broadband Settings submenu.

Edited by techlad (Tue 06-Nov-12 21:51:46)

Ah! Well done!

I looked for it within Broadband Settings but overlooked the sub-menu.

I have the latest firmware... I really need remote access. These hidden pages don't load correctly, when accessing remotely. When accessing locally it says protected page, then a password box? I have no idea what the password is. I've tried Broadband password, admin password and also mac addresses from LAN and WLAN and also serial number. I've even rung orange/ee who didn't have a clue what I was on about. I have DDNS enabled. I've tried so many combinations,but nothing has worked so far. Please help! I've also tried enabling "Manufacturing Default" which is the only page that works out of the 4.

Joel

Since the new EE firmware those hidden pages are no longer user accessible, as discussed here, other than the Factory Reset. ADSL Mode can be got off the normal GUI. There is nothing you can do about it; they were not officially released to you.

But why do you need Remote Access to the router? That is Orange's job.

Or do you mean access from the Net to services on your local network? That is handled by the Firewall, NAT and port forwarding in the usual way.

Hi mate, cheers for the fast reply! I sometimes need access to the router remotely as I dont live at mu registered address, it's my parents house. We have a rubbish connection so it's nice to be able to diagnose remotely. Also i like to rdp to different pc's in my parent's household, by changing the portforwarding addresses.

So is it definately not possible... There's a password request I just thought it may be known.

Cheers!

Can't you do a Remote Desktop Connection to your parents' PC and mess about with the router from there?

In reply to a post by blink182_joel:

I sometimes need access to the router remotely as I dont live at mu registered address, it's my parents house. We have a rubbish connection so it's nice to be able to diagnose remotely. Also i like to rdp to different pc's in my parent's household, by changing the portforwarding addresses.

What I recommend (and use) is LogMeIn free, no firewall or port forwarding issues/hassle, it just works. All you need to do is set it up next time you are there. Just be carefull when installing to ensure that you chose the free option.

Yes but both these solutions require a pc to be switched on...

In reply to a post by blink182_joel:

Yes but both these solutions require a pc to be switched on...

Same as RDP then ...
BrightBox does not / did not support Wake On Lan (WOL) AFAIK

I just need access to te web interface on the brightbox remotely. It is possible as accessing the http://192.168.1.1/z983erv3210ba.htm page locally requires a password that is MD5 encrypted. It's not bb password/ admin password / mac address etc. if i could get on the page then i could enable remote access. It's not impossible just difficult
Joel

If you can save the router's configuration in a file, it may be possible to deduce the password from there. It sounds as if you've already done this and come up against an MD5 encrypted password. MD5 can be brute forced, especially if poorly salted, though this is not easy.

I'd file this in the 'too much trouble' bin, especially as this is not a function the ISP supports on this router. The ISP appears to reserve remote access for their own use and could push out another firmware update that changes the password or removes all http remote access, leaving only TR-069 or similar.

As others have said, I'd go with some way of establishing a VPN connection and accessing the router from the LAN. The other alternative, if it is within the ISP terms and conditions, is to replace the router with a privately purchased router that has the necessary functions.

In reply to a post by David_W:

if it is within the ISP terms and conditions, is to replace the router with a privately purchased router that has the necessary functions.

You may use any suitable router on Orange; just have the BrightBox available in case Supports wants it for diagnostics.

Think only Sky prohibits other routers, but some have bypassed that

In reply to a post by XRaySpeX:

You may use any suitable router on Orange; just have the BrightBox available in case Supports wants it for diagnostics.

In that case, if I was the original poster, I'd install my own router with remote management and VPN capabilities, so that I could connect to the local network remotely to provide support. The BrightBox can go in the drawer in case it is needed, and as an emergency replacement for a broken router.

I found the 32 hex hash and converted to #AK1234. That was actually in the global.js code anyway. Although I have tried it, it doesn't work. It does something strange with a "urn" number on the address bar. Every time you log into the router a random number is generated and added to the end of the url. I think it uses this number combined with the #AK1234. When you click "Go" a file called hiddenPage.exe runs from the router, but just redirects back to the password page. So annoying, I know it's trivial but I like the router a lot, apart from the lack of the feature that is being blocked.

Grrrrrrrr

The latest list of hidden pages on the latest EE Firmware are as follows
(PP) = Password Protected (See Here).

Factory Defaults
http://192.168.1.1/u132xzp32aai.htm

ADSL / Ethernet (PP)
http://192.168.1.1/wa223acc15ld.htm

Parameters (PP)
http://192.168.1.1/xc324m12sdlo.htm

TR69 module (PP)
http://192.168.1.1/yds32u872vld.htm

Remote Management (PP)
http://192.168.1.1/z983erv3210ba.htm

The new page at wa223acc15ld.htm seems to duplicate other settings page so I am not sure why it exists.

Clickable:

In reply to a post by Mike_Williams:

Factory Defaults
http://192.168.1.1/u132xzp32aai.htm

ADSL / Ethernet (PP)
http://192.168.1.1/wa223acc15ld.htm

Parameters (PP)
http://192.168.1.1/xc324m12sdlo.htm

TR69 module (PP)
http://192.168.1.1/yds32u872vld.htm

Remote Management (PP)
http://192.168.1.1/z983erv3210ba.htm

The new page at wa223acc15ld.htm seems to duplicate other settings page so I am not sure why it exists.

In reply to a post by Mike_Williams:

The new page at wa223acc15ld.htm seems to duplicate other settings page so I am not sure why it exists.

Ditto the one at xc324m12sdlo.htm, which duplicates standard GUI's Broadband Settings / ADSL Mode.