I know there are a lot of Linux types on here so I thought I might see if any of you would chime in about rooting an Arris NVG589 modem. I bought it with the purpose of extracting the 802.1x certificate to free me from having to use At&t's provided and required gateway on my fiber service. My model is an 5268AC from Pace but I bought the Arris so I could work on it independently from my Internet gateway.

Anyway, I found some instructions to root at as the first step to getting at the certificate, however, I cannot get past telnetting into it. The instructions simply do not work. Either they are leaving something out presumed common knowledge or the instructions are just wrong for my application. Anyway, these are the instructions. I can get through steps 1-3 but 4-5 don't work. If I start a second telnet session, I can't establish a connection with port 9999 as instructed and if try within the same session it says it's a local connection. Thanks for any help!

Stu

1. Open a terminal/cmd and run telnet 192.168.1.254 or your router's IP here.
If you are running Windows 7 or any later version, you might need to add this feature in Control Panel.

2. For username enter admin, for password enter your access code.[1]

3. Run ping `telnetd -l sh -p 9999`
9999 is the port number and you can change it to anything between 1024-65536.[2]

4. Open a terminal/cmd and run telnet 192.168.1.254 9999 or the port number you just entered.

5. You should see a # and that means you are accessing the root shell now!

Which instructions are you following? Any chance it's this link?
https://github.com/MakiseKurisu/NVG589/wiki/Root-Access

I don't understand all of the instructions because I know dangerously little about Linux. But it looks (to my uneducated eye) like instruction 3 tries to enable a a telnet daemon on port 9999. What is the output from that command? Does it look like it succeeds?

If you say that you can connect to 9999 from the current session, but not from another session, I wonder if it's missing a step which enables the daemon for all users rather than just the one that's logged in. Maybe the instructions are missing some kind of elevation command before enabling the daemon on 9999. Or maybe a simple "sudo" is needed there?

Or maybe port 9999 is firewalled on that model of router, and you have to do more than just start a telnet daemon?

These are all wild guesses, or you may have already tried all those.

Any chance the "ping" part of that instruction is a typo? I don't understand what that command is doing, but that's probably just my lack of knowledge.

Yeah that's the one. Thanks Tony! I know very little about Linux either; I'd say way less than you. When I run step 3 I just get a standard ping output:

NOS/255307918359056> ping 'telnetd -l sh -p 9999'

PING telnetd -l sh -p 9999 (192.168.1.254): 56 data bytes
64 bytes from 192.168.1.254: seq=0 ttl=64 time=0.761 ms
64 bytes from 192.168.1.254: seq=1 ttl=64 time=0.356 ms
64 bytes from 192.168.1.254: seq=2 ttl=64 time=0.358 ms
64 bytes from 192.168.1.254: seq=3 ttl=64 time=0.355 ms
64 bytes from 192.168.1.254: seq=4 ttl=64 time=0.366 ms

--- telnetd -l sh -p 9999 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.355/0.439/0.761 ms

NOS/255307918359056>

It doesn't work at all unless I do it exactly as shown. It just comes back with "unrecognized command."


Not really sure what to do at this point. I can desolder the flash where the cert lives and extract it, but eventually I'm still going to have to interact with Linux and vague incomplete instructions like the ones in that link.

That step above is intended to be run ON THE MODEM, from the first telnet session, rather than on the connected PC.

No idea what the "ping" is in there for, but you can try it both with and without the ping prefix. So, from within the original telnet session, do this command on the modem:

telnetd -l sh -p 9999

This part (below) should not be necessary, as the modem is likely running busybox, and the busybox implementation of telnetd uses lowercase-l:

If that fails to do anything useful, try it again with an uppercase-L instead of lowercase:

telnetd -L sh -p 9999

Say, Stu: coming over for the Cambridge meet? Would love to meet you in person there!

The ping command substitution (the backticks) might be some way to work around and run telnetd as a privileged user?

I've tried with and without ping. Neither really seems to work correctly and I can't really run it any other way but with a windows client. There's no console in the modem interface. Thanks for everyone's help though!

Terminal shell v1.0
Copyright (C) 2013 Motorola Mobility, LLC. All rights reserved.
Motorola Netopia Model NVG589 VDSL/ADSL AnnexA Ethernet
Running Netopia SOC OS version 9.1.0 (build h4d38_1.1)
ADSL/VDSL capable
(admin completed login: Admin account with read/write access.)

NOS/255307918359056> telnetd -l sh -p 9999

Unrecognized command. Try "help".

NOS/255307918359056> telnetd -L sh -p 9999

Unrecognized command. Try "help".

NOS/255307918359056>

I don't think I will be making it to Cambridge although it would be great to meet all you fine people, I just don't travel much and it's really not in the budget.

Stu

Those are apostrophes ''''', but you need backticks `````.

Peter

Also, you can try locating the telnetd binary on the modem, and using its full path. Most likely, it is in /usr/sbin/, so that would mean trying these:

ping `/usr/sbin/telnetd -l sh -p 9999`
## Using backquote, often found at top left of a PC keyboard on the tilde (~) key.
## But really, the use of ping with quotes here makes no sense to me.

Or

/usr/sbin/telnetd -l sh -p 9999

If it still says something like "Unrecognized command", then you will have to find exactly where telnetd is hiding. This might work for that:

find / -name telnetd

That was it! I couldn't paste into the session (gave me a weird question mark in a box), so I was just misreading it. The ping is necessary as is a new session for step 5 by the way. Now to figure out how to extract the cert! Thanks everyone. I thought it might be something simple!

Terminal shell v1.0
Copyright (C) 2013 Motorola Mobility, LLC. All rights reserved.
Motorola Netopia Model NVG589 VDSL/ADSL AnnexA Ethernet
Running Netopia SOC OS version 9.1.0 (build h4d38_1.1)
ADSL/VDSL capable
(admin completed login: Admin account with read/write access.)

NOS/255307918359056> `telnetd -l sh -p 9999`

Unrecognized command. Try "help".

NOS/255307918359056> ping `telnetd -l sh -p 9999`

BusyBox v1.18.3 (2013-06-13 18:56:43 EDT) multi-call binary.

Usage: ping [OPTIONS] HOST


New Session after telnet 192.168.1.254 9999:
#

Oh, okay, I get it. The modem is running some kind of limited custom shell (aka. "command interpreter"). So it doesn't allow most commands, but apparently does have a built-in "ping" command. And the child who wrote the custom shell added backquote support to make it easier to script config stuff. And thereby also opened up a massive hole in the custom shell.

Surrounding an expression with backquotes tells the shell (command interpreter) to first run the command within the backquotes, and then provide the resulting output as a command line parameter to the original (ping in this case) command.

The telnetd command doesn't output anything useful to ping, but that's unimportant here. The idea instead is to just trick the shell into running a command it normally won't run, telnetd in this case.

Thanks Mark for the explanation! Those vulnerabilities were patched later on. The gateway had to be downgraded to an old firmware to do this. It bugs me that people in the isp circles are so secretive about how to do all this. They say they are worried about AT&T finding out and patching the holes, but they already did and that’s why the downgrade is necessary.

Thanks again for everyone’s help,
Stu

I was thinking of going with an ER4 router to run the WPA supplicant with the extracted cert. It should easily support my symetrical gigabit connection and it’s fanless. Just need to decipher all these guides on doing that!

Stu

Dayammm. That's a spicy meatball.

Nice explanation. Woulda been nice if the original writer of those instructions could have done the same.

I'm glad that seeing "ping" running with "telnetd" as its parameter looked weird to me, enough so that I thought it was a typo at first. Shows I'm learning at least something about Linux here and there. :-)

I wish you the best of luck, Stu, on getting the fiber service gateway tweaked to your liking. I fully support the idea of one using one's own hardware on a cable/fiber company's line. That's as it should be.

But I will warn that I've had trouble in that area before. Though it was with a cable modem on Comcast, so it's a different situation. Be prepared for trouble, is what I'm saying. My trouble was this:

- I wanted the monthly modem charge offa my cable bill. I wanted to buy my own modem and save the $10.00/mo
- I needed the modem to be one with Voip line plugs in it (for my land line and burglar alarm).
- That limited the number of modems I could buy. There really was only one kind readily available as a "new" item, a particular Arris unit that Comcast supported.
- The Arris unit would work for a few months and then mysteriously brick to an unrepairable state. Neither Arris nor Comcast tech support was able to fix the modem, and there was a lot of finger pointing.
- I went through something like three of these things before a Comcast tech told me in confidence that it was known issue, that it was possible to remotely brick the Arris modems via bad remote commands and/or bad automatic firmware updates from the cable company.
- I had to ebay a whole different model/make of modem, this time one with the Xfinity logo on it. (Took two tries to find one on ebay which wasn't a reclaimed/blacklisted unit.) That one has been working steadily for years now.

Let us know how it goes for you.

Seems pretty clever. I'm thinking of writing clear instructions for the whole process to make it less mysterious once I get it all sorted out.



I will keep at it this weekend and try to get it going. Will let everyone know. I'm getting a super deal with the exception of the forced crap gateway. 1000mb up and down unlimited for $70/mo supposedly for a lifetime.

That's horrible! If AT&T bricks my $199 router, there's going to be trouble for sure!

I'm attempting to extract the cert files from the gateway and can't figure out how to get them out onto my PC. I ran the command:
mount mtd:mfg -t jffs2 /mfg&&cp /mfg/mfg.dat /tmp/&&umount /mfg
This presumably copies the mfg.dat file to a folder called tmp I guess, but how do I copy it to C on my Windows machine? I've tried scp in the root shell, but I get the response scp not found. Anyone know how to do this?

Edit: After looking at the busybox docs, it does not appear scp is supported. Not sure why it was suggested. What ways are there to transfer files out from busybox?

busybox (on Ubuntu, at least) has a built-in HTTP server (busybox httpd). Maybe the version you've got also has that?


Try "busybox httpd -f -p 8080"

Thanks! I’ll try that this weekend. Supposedly the gateway supports USB transfers after running these commands but they don’t say what to do after so I have no idea.

1. insmod /lib/modules/2.6.30.10-motopia/kernel/drivers/usb/storage/usb-storage.ko

You might need to change this path to your USB storage device driver.

2. modprobe usb-storage
Note:

You can find your hard driver in /media/hda1.

Several file system drivers are located in /lib/modules/2.6.30.10-motopia/kernel/fs/, load them if you are having trouble to read the data.

Since there is only one class under usb folder, NVG589 is unlikely to support other types of device.

If that's the case, then you can copy the file to the stick as follows:

Code:

mount mtd:mfg -t jffs2 /mfg && cp /mfg/mfg.dat /media/hda1/ && umount /mfg
umount /media/hda1 ; sync

If that still gives trouble, then perhaps you can set up an RDP server on the machine for me to connect to and I'll get it sorted. Apparently I can do this directly from Linux too, even if the remote machine (yours) is running MSWin.

Let me try your USB method and if it doesn’t work, I’ll let you know. Thanks again Mark!

Nope. Not working. I assume I am supposed run the USB code I posted first. I tried with and without. Tried a couple different sticks. Will keep tinkering this weekend.

Result without initial USB code:

Code:

# mount mtd:mfg -t jffs2 /mfg && cp /mfg/mfg.dat /media/hda1/ && umount /mfg
cp: can't create '/media/hda1/': Is a directory

Result with initial USB code:

Code:

# insmod /lib/modules/2.6.30.10-motopia/kernel/drivers/usb/storage/usb-storage.ko
# modprobe usb-storage
# mount mtd:mfg -t jffs2 /mfg && cp /mfg/mfg.dat /media/hda1/ && umount /mfg
mount: mounting mtd:mfg on /mfg failed: Device or resource busy

Just try the cp /mfg/mfg.dat /media/hda1/ part after that last one (the "busy" complaint was because of the previous attempt failing).

Unfortunately I keep getting the "cp: can't create '/media/hda1/': Is a directory" error.

# insmod /lib/modules/2.6.30.10-motopia/kernel/drivers/usb/storage/usb-storage.ko
# modprobe usb-storage
# mount mtd:mfg -t jffs2 /mfg && cp /mfg/mfg.dat /media/hda1/ && umount /mfg
cp: can't create '/media/hda1/': Is a directory
#
# cp /mfg/mfg.dat /media/hda1/
cp: can't create '/media/hda1/': Is a directory
# insmod /lib/modules/2.6.30.10-motopia/kernel/drivers/usb/storage/usb-storage.ko
insmod: can't insert '/lib/modules/2.6.30.10-motopia/kernel/drivers/usb/storage/usb-storage.ko': File exists
# modprobe usb-storage
# mount mtd:mfg -t jffs2 /mfg && cp /mfg/mfg.dat /media/hda1/ && umount /mfg
mount: mounting mtd:mfg on /mfg failed: Device or resource busy
# cp /mfg/mfg.dat /media/hda1/
cp: can't create '/media/hda1/': Is a directory

It seems my version of busybox does not have httpd.

# busybox httpd -f -p 8080
httpd: applet not found

With the USB stick inserted, and all of the USB recipes done, what does this command output:

cat /proc/mounts /proc/partitions

Thanks Mark! Here goes:


# insmod /lib/modules/2.6.30.10-motopia/kernel/drivers/usb/storage/usb-storage.ko
# modprobe usb-storage
# mount mtd:mfg -t jffs2 /mfg && cp /mfg/mfg.dat /media/hda1/ && umount /mfg
cp: can't create '/media/hda1/': Is a directory
# cat /proc/mounts /proc/partitions
rootfs / rootfs rw 0 0
mtd:rootfs / jffs2 rw,relatime 0 0
procfs /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
tmpfs /media tmpfs rw,relatime 0 0
tmpfs /var tmpfs rw,relatime 0 0
devfs /dev tmpfs rw,relatime 0 0
pts /dev/pts devpts rw,relatime,mode=600 0 0
mtd:data /data jffs2 rw,noatime 0 0
mtd:mfg /mfg jffs2 rw,relatime 0 0
major minor #blocks name

31 0 40960 mtdblock0
31 1 40960 mtdblock1
31 2 46976 mtdblock2
31 3 128 mtdblock3
31 4 1024 mtdblock4
8 0 60397568 sda
8 1 60393536 sda1
#

The problem was in the third-party instructions which suggested that the USB-stick would have been auto-mounted at /media/hda1

I did have my doubts, now confirmed, as USB-sticks are normally /dev/sdX devices rather than /dev/hdX devices, but some setups do weird things in that regard (eg. the empeg itself!). And there does not seem to be any auto-mounting happening either.

So insert the USB stick, and do this:

I have written it out one command per line to make it easier to grok, but one could condense it by combining commands. A semi-colon (;) can be used to separate multiple commands placed on the same line. Another way is to join commands with &&, which means "only continue if the previous command worked".

You can see examples of those from the earlier attempts above.

The # symbol is for comments, and means "ignore the rest of this line". I generally write it as ## to make it more obvious, rather than #, but either way it's a comment that doesn't need to be typed out.

Here is a more fully commented version of the above: