Hello everybody, and welcome to this tutorial.
Today I am going to show you,
or today I'm going to just continue the demonstration that I started previously.
I'm going to show you how you can extract credentials from this particular router.
Now, the same procedure applies elsewhere, but
you need to grab that model number, either by doing extensive nmap scanning,
or by just using a far simpler method, trying to authenticate.
Well, actually we don't need to type any credentials,
you can just go to the website.
Go to the login website, and see if any information is revealed there.
Apparently, for most of the home routers you're going to get a model number there,
or at the very least, you will get the manufacturer name.
Anyway, I've attempted to download rom-0 file from my browser.
But now I am going to use wget.
And wget is a piece of software that should be installed by default.
But just in case it is not, type in yum search wget.
Press Enter.
And there you go, the last one is wget.
Just type in yum install wget, and it will be installed.
Clear the screen.
So, wget http://192.168.1.1.
Keep in mind I'm using the local address here, but you can use a public IP address.
So this router, for all intents and purposes, could be in Japan,
on the other side of the globe from myself.
It would not matter, this attack would still go and fly.
/rom-0, that's O, -0.
Press Enter.
And there we, oh, it has saved it from the rom-0.2.
So I have already downloaded it twice.
I guess this is the second time around that I'm attempting to make this tutorial.
For some strange reason either the connection crashes, or
I have some problems.
But in any case, let's just go ahead and proceed with this.
Well, let me just clear the screen.
And now we need something to read that rom.
Let me just show you how that looks like.
I'm gonna use the original one that I've downloaded.
I don't know why, it just feels right.
Because I'm downloading it already for the second time.
Anyway, with is how a binary file looks like.
You can't really read through this, you might get here and there,
pieces of readable code.
There you go, at the bottom.
At the bottom, you have a little bit that's readable.
But none of this information is actually of any particular use to you.
Just go ahead and press quit to quit it.
And we need something to actually interpret this.
In order for us to interpret this,
I have a bunch of websites here that I have opened for this purpose.
And you can see here, you have ZTE,
TP-Link, ZynOS, Huawei rom-0 Configuration Decompressor.
So this will make the file readable in short.
You can just go ahead and copy this script into a file.
And now I want you to do this on your own.
If you fail to do it, feel free to post it in the question section.
I will be more than happy to explain it to you how.
Here's a bit of a hint.
You need to just copy this text into a text file.
That text file must have an extension of .py.
And you must make it executable.
So chmod +x, and the name of the file then follows.
This is the format of the file, so ls.
This is how your file should look like.
It should have a .py and it should have a +x.
So type in chmod +x and
then name of the file.
Just let's clear the screen.
ZteRomReader.py rom-0.
Press Enter, and there we go.
It actually just reads right through it, and
it converts it to a human-readable form, you can put it so.
But it doesn't actually bother to go through the whole file,
to give us the contents of the whole file.
Its main concern is with the password for the router.
So there you have it here.
Usually these things are the password.
And there you go, here, and then you have the password alone.
So router password is 263297.
You can use this password that is obtained in such a manner to log in to the router.
Now, there comes a problem with this method.
If anybody has messed around with the router.
Well, actually, on some of these routers,
I've noticed that you can't actually change the user name.
Which is very interesting.
And that the default user name is admin.
So you can just use admin as a log in name.
Maybe, maybe sometimes I've seen that they use a login name root.
But you can also go on the net and
type in default login names for that particular brand of the router.
And you can try a couple of them.
Usually, there's like maximum of four or five, something like that.
You're not going to get 100 different variants.
Just try a few of them, see how it works.
But this is the password, for sure.
You will be able to log into the router with it.
All that remains is finding the user name.
But 99% of the time, the username will be admin.
So no worries there.
Although some of the routers, they give very unique user names.
But they are public.
So just go on the net, type in the router model.
And apply that particular user name.
Now, before you actually try to do something crazy like this,
try the default login credentials.
Type in admin, admin.
And if admin, admin doesn't work, take the model number,
type it into your favorite search engine, and type in, default credentials.
Because default credentials can vary from router to router.
And if the router is in a different country,
see the IP address of the router, see to who it belongs.
Let me just show you how you can do that.
Major IP blocks.
I believe I've showed you this website before.
Come on, there we go.
So it says here, it gives the IP addresses.
It gives the IP address ranges, and
then the owner should be written in the far right.
But apparently I don't have it.
Come on. Look at how many IP address are for
US alone.
That's like a lot.
And it doesn't list the owners for the US, strangely.
But it doesn't matter.
Look, I can just take this address, copy it, oops, come on.
Why are you doing this to me?
Why, why, why?
I do not care for the Google Store.
I gotta delete this somehow so I don't click on it.
Who is.
And so it doesn't, you'll get the owner of the IP address here.
Once you get the owner of the IP address here, if it's a telecom,
and if it's a router then it's definitely a telecom.
If it's a home router, then what I want to say then it's definitely a telecom.
Once you actually figure out which telecom it is.
You can go ahead and type on the net configuration manuals of that
particular telecom for that particular router.
Because usually telecoms keep such files public.
And you can read the default username and
default password there which are unique to that particular telecom.
Cuz they can vary from one place to another.
This is primarily to prevent people from just mass scanning the Internet.
Well, one of the reasons, anyway.
To prevent people from mass scanning the Internet, and
then just trying the credentials admin, admin.
They still have default credentials, they're just not admin, admin.
So a lot of the scripts will actually fail to authenticate against them.
But if you just bother to look a bit further,
you will realize that the credentials are still public.
They can be changed by the users, of course, but users rarely do this,
and I mean rarely.
Anyway, I'm going to call this tutorial here.
In the next one, we're going to do pre-authentication exploitation.
And until then, I bid you farewell.