[dennislow]

hi all,

Thought I'll just do a post to help other folks with a similar setup as mine.
This post may benefit you if your setup looks something like:
1. Using M1 fibre broadband, with voice service bundled
2. Setup consists of the ONT (using Huawei HG8240), and RG (using Huawei HG256)

Non-M1 users, kindly refrain from clogging up the thread.
I hope to keep the thread useful and informative for everyone.



Will attempt to keep the info up-to-date within first 5 posts.

Cheers!

Share|

[dennislow]

Logging in to your HG256 (normal admin)

1. You first need to know the ip address of your HG256 (think the default is 192.168.1.1)
I'll be using 192.168.2.1 (since that's my address and its easier for me)
2. Login to your HG256 from your browser. Type this in the url bar of your browser

http://192.168.2.1

3. Type in your userid and password (should be admin / admin)
4. You can browse around and see some of the screens
5. Although this says its the "admin" account, there is actually a "superadmin" account.

Logging in to your HG256 (super admin)
1. Do a telnet login to your HG256 (instead of browser access)

$ telnet 192.168.2.1
Trying 192.168.2.1...
Connected to 192.168.2.1.
Escape character is '^]'.
-------------------------------
-----Welcome to ATP Cli------
-------------------------------

Login: admin
Password: admin

2. Now you have logged in to the ATP interface. Start up a bash (sh) shell.

ATP>sh
BusyBox vv1.9.1 (2010-10-28 23:45:20 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
#

3. Now you have access to the "internals" of the system. The file we are interested in is the default configuration file. All the settings and goodies can be found in there!
Among the things stored in there:
a) router settings
b) RG login accounts
c) SIP settings
d) TR069 settings
e) others

4. Look for "superadmin" account.
EDIT: (Ok, checked that "grep" is not available)

# cat /etc/defaultcfg.xml
...
<UserInfoInstance InstanceID="1" Username="superadmin" Userpassword="######">
...

5. The "Userpassword" field is escaped, so you'll need to un-escape the sequence.
(ie. replace &amp; with &)

6. Use the above "superadmin" id and the password to relogin to the web interface.
7. The web interface now shows alot more info as compared to the original "admin" account.

... Will stop here for the time being, hope the info is useful for you!

[dennislow]

Hi all,

I've received a few PMs for info to access the HG8240. Apologies for taking so long to do this writeup!

For those who are patiently waiting, your patience has paid off! Here's the next portion of the "secret manual".. kekek...
-----

First steps to your HG8240
1. Your HG8240 connects to your fibre termination socket in your home.
2. Only the first port of the HG8240 is configured and this port connects to the HG256.
3. The HG8240 is normally inaccessible from your internal LAN.
4. How to access it then...?

Accessing the HG8240 admin pages (normal admin)
1. Plug in a cable any of the ports 2-4 of the HG8240
2. You need to set your computer ip to a static ip.
3. I usually use 192.168.100.99, and so far it works without issue.
4. Login to your HG8240 from your browser. The address is 192.168.100.1.
5. Type this in the url bar of your browser

http://192.168.100.1

6. Type in the userid and password (should be root / admin)
7. You can browse around and see some of the screens
8. You can use the above userid/password to access the telnet console.
9. There's some interesting commands in there, though its not as useful for this case.

Although this says its the "root" account, there is actually a "telecomadmin" account.
.. Looks like there's some hidden account in there again!
The password is embedded in text displayed in a completely different colour.

Have fun deciphering the password!
Hint: There is no spaces in the password and it has 12 letters.

Just needed some way to obfuscate it somewhat without letting it out straightaway..

Interesting Item 1 (in the web interface)
1. Click on "System Tools", followed by "ONT Authentication"
2. Check that your device mac address should be listed there.

Interesting Item 2 (in the web interface)
1. Click on "System Tools", followed by "TR-069"
2. Check out the values there... (not good for me to describe too much here)..


That's it so far, hope you can make good use of it!
Would be keen to hear your findings and what you make of it.

Cheers!

[dennislow]

[Reserved for future updates...]

[dennislow]

[Reserved for future updates....]

[dennislow]

[Reserved for future updates.....]

[allo]

With your revelation. do you think M1 will push a firmware to disable telnet access and change the superadmin password?

[AlbertLee]

I believed they can simply made the necessary changes from back-end and push it across.

[wenasong]

Originally Posted by AlbertLee

I believed they can simply made the necessary changes from back-end and push it across.

TR069

[dennislow]

@allo,

They could do that using TR069.
Well, there are probably ways to prevent them from doing so such as disabling the TR069 vlan, etc. Though I'm not sure if that will cripple your connection/functionality. Still testing the vlan network and the segregation of roles btw the diff vlan.

Another alternative.. to find some means to keep a "back-door" for our own tinkering?

Any thoughts?

[allo]

@dennislow

I'm a novice in Linux/Unix.
Asking that question because we all knew RSP's do monitor forums. Although they always ignore negative feedback about their services, they are very quick to 'fix' information that they think might pose a problem to their help desk.
Hence the info you posted might be obsoleted soon esp. when it's re-post by others and more people know..

Anyway, appreciated.your efforts ... can learn from it and possibly use it on other routers as well

[allo]

FYI.
Source: M1 FIBRE BROADBAND DISCUSSION / NETWORKING SETUP / INFO / PROMO

Originally Posted by AhWise

Hi Brothers & Sisters!

Good News People! M1 Fibre broadband is slowly trying to rollout the Fixed Voice Service without the need to rent the Residential Gateway @ $2/mth. However, some locations near the Northern side of Singapore may not be applicable for this yet but it will slowly & progressively rollout to these location. Those area that is affected would still be required to rent the residential gateway @ $2/mth if Fixed Voice is required.

For those eligible, you can now sign up for M1 Fibre Broadband with Free Fixed Voice Service without the need for the RG. The Black ONT Huawei EchoLife HG8240 will now be able to provision the fixed voice service through the Tel port behind. Only 1 Tel line can be used for now.

If you require a router or wireless, you can opt to purchase upfront our Cisco Linksys router or the newly launched installment plan:

Cisco Linksys E1200
Upfront payment of $52 Or 12mths installment plan of $5/mth (charged to bill)

Cisco Linksys E4200
Upfront payment of $199 Or 12mths installment plan of $18/mth (charged to bill)

* Router belongs to customer after the installment plan

I know there will be a lot questions going to bombard so I try my best to reply as I could. Existing customer with the White Nucleus Connect modem is not able to switch to the Black ONT modem yet.

Current Areas that may be Affected: Ang Mo Kio, Hougang, Yishun, Admiralty, Yio Chu Kang, Sembawang
(Will update the list if I encounter more)
* Required the unit number & postal code to check for confirmation

Misc Charges
Fixed Voice Activation Fee -> $37.45 (FREE waiver of activation fee upon Fibre plan sign up)
Fixed Voice Termination -> $37.45 (if you took up Fixed Voice service)

Source: M1 Website

Cheers!
Alvin

*** Those area highlighted in RED might not be able to have voice provision with the black ONT yet. ***

I think with this roll-out, M1 probably won't be bother to cook a firmware to disable telnet access and change the superadmin password just my 2c...

[dennislow]

@allo,

That's good news! Been trying to eliminate the silly RG HG256. Its only 4-ports of 100mbps for internal routing. The black HG8240 is a more capable device, 4 ports of gigabit ethernet and 2 RJ11 tel ports.

Hohoho... anyway, the HG8240 also has a super-admin account.
Anyone who wants to know can PM me.

[allo]

Yup, it's indeed a wise move given that the HG8240 support VoIP and the RG's wireless performance is sub-standard.

Please continue with your tutorial ...still good to know & learn....

BTW, PMed you

[lengzai]

this thread is very useful.
managed to get the voip server login password for +65********@ims.mobileone.net.sg