Welcome Guest ( Log In | Register )

5 Pages  1 2 3 > » Bottom

Outline · [ Standard ] · Linear+

Tech Support [Guide] Recovering PPPoE Password from Router

views
     
TSsoonwai
post Jun 14 2016, 04:20 PM, updated 3y ago


*******
Senior Member
9,989 posts

Joined: Oct 2007
From: KL


[Guide] Recovering PPPoE Password from Router

I find that this happens quite often. Perhaps you had UniFi installed some time back and decided to upgrade to a better router but have no idea what the PPPoE password is.

This guide will show you a few ways to obtain that password. I'll be using UniFi here but parts of it applies to other ISPs too.

Username and Password Example
Before we begin, here is an example of the UniFi username and password so you'll recognise it when you see it.
Username for home users: soonwai@unifi
For business users: soonwaisb@unifibiz
Password, if system generated, consists of 13 alpha and numeric characters: DRoWsSApYmTOn

Easy Low Tech Methods
Let's start with a few easy low-tech methods:

1. Look for the Service/Installation Order form
Look for the Service/Installation Order form that should have been given to you when UniFi was installed. It has the username and password on it. Maybe.

2. Call UniFi Support 100 (and other channels like Twitter and Facebook(?))
Call 100 to reset your password. After verification of your identity as the subscriber. UniFi will SMS the new system generated password to your mobile phone.

If the above didn't work then you can obtain the password from the existing router. First we'll need to gain access to the router

Logging in to the Router
Log in to the router with your router password. If you have not changed the password, you can try one of the following default passwords.

Default Router Passwords for UniFi Stock Routers
(DIR-615, TRG-212M, RG4332, L7-N-R2000)

Username: operator
Password: h566UniFi

Username: Management
Password: TestingR2

Default Router Password for Innacomm RGX4400
For the newer routers such as the Innacomm RGX4400, it's a bit different. It is:

Username: operator
Password: Opr@XXXX

where XXXX are the last 4 characters of your router's MAC address. You can get the MAC address from the box or the router's label.

Another way to get the MAC address is to log in as:

Username: admin
Password:

On the RGX4400 Router Status page, look under LAN Configuration for MAC address: 1CA532A6CC09. The last 4 characters are what you need. In this example, the password would be Opr@CC09 (in caps please)

Default Router Password for DLink DIR-850L
You don't have to enter a username. Password is on a sticker.

Password: admin@xxxx

Default Router Password for DLink DIR-850L (TIME)
You don't have to enter a username.

Password: TIMExxxx

Where xxxx are the last 4 characters of the router's MAC Address.

Default Router Password for TPLink Archer

Username: admin
Password: admin

Default Router Password for Maxis Technicolor TG784n v3
MaxisBB has a blank password.

Username: MaxisBB
Password:

For more settings you'll need the Administrator password. The default password for the Administrator account is either the Access Key or the Serial Number. Both are found on the sticker at the bottom of the router.

Username: Administrator
Password: Access Key or Serial Number

The Thomson router has one more login called tech which is used when you enable remote logins.

UniFi PPPoE Username and Password
Once you have managed to log in to the router as user "operator", the fun begins. I'll be brief for now until I have time to put in a few screenshots.

Inspect HTML Method
First, go to the WAN setup page. You can plainly see your UniFi username here and your password hidden.

1. Right click on the password and examine the HTML source of the page.
2. You may see something like this with your PPPoE password:

<input type="password" name="pppPassword" size="15" maxlength="29" value="DRoWsSApYmTOn">

Some routers try to be clever. For example, on the or RGX4400, you will see this:

<input type="password" name="pppPassword" size="15" maxlength="29" value="3487_TmPPPoE">

where 3487_TmPPPoE is not the actual password. Do a search for your username and you should find it:

it("enable", 1), new it("IpProtocol", 3), new it("ipDhcp", 0), new it("ipAddr", "0.0.0.0"), new it("remoteIpAddr", "0.0.0.0"), new it("netMask", "0.0.0.0"), new it("pppUsername", "soonwaisb@unifibiz"), new it("pppPassword", "DRoWsSApYmTOn"), new it("pppCtype", 0), new it("pppIdleTime", 0), new it("pppAuth", 0), new it("pppACName", "")

with the password next to it.

This method will work on most routers.

SSH/Telnet Method
SSH or Telnet to the router. Look for a file which may contain the PPPoE username and password. You may have to dig around. Some common files are chap-secrets and ppp-conf.

Example for RGX4400:
> cat /var/ppp/ppp.conf
CODE
if     dev   dev_v   gw phase          username                password   MRU
ppp0   PPPoE nas0_1  1  Network        soonwaisb@unifibiz    DRoWsSApYmTOn  1492


snmpwalk Method
This method works on the DIR-615. You'll get a whole bunch of SNMP results. Look for the following OIDs:

> snmpwalk -v 1 -c public 192.168.0.1 private
CODE
...
SNMPv2-SMI::enterprises.171.31.1.1.1.2.1.10.1 = STRING: "soonwaisb@unifibiz"
...
SNMPv2-SMI::enterprises.171.31.1.1.1.2.1.11.1 = STRING: "DRoWsSApYmTOn"
...


Mikrotik Routers
Mikrotik routers are very easy. Just toggle "Hide Passwords" off and you'll be able to see the passwords.

Software Method
If you have a backup of your router's config, there're a few utilities that can read the backup file and decrypt it. This works for many popular routers.

http://www.nirsoft.net/utils/router_password_recovery.html Thanks badai
http://securityxploded.com/dlink-password-decryptor.php

RouterPassView Thanks blacktubi

i dunno routers password
What if you don't know the routers password? Which means that you can't login to the router's admin page. There's one more method which I'll post later. This method requires physical access to the router, a screwdriver and a hammer drill.

This post has been edited by soonwai: Apr 6 2017, 04:08 PM
TSsoonwai
post Jun 14 2016, 04:20 PM


*******
Senior Member
9,989 posts

Joined: Oct 2007
From: KL


i dunno routers password
What if you don't know the routers password? Which means that you can't login to the router's admin page. There's one more method. This method assumes:

1. You have physical access to the router.
2. The router is working and connects to UniFi successfully.

PPPoE Server Method
I'll expand on this further but the basic steps are:

1. Setup a PPPoE server.
Any PPPoE server will do. One of the easiest ways is to setup a Mikrotik router as a PPPoE server.

2. Connect your router's WAN port to the above PPPoE server.

3. Check PPPoE server logs for the username & password sent by your router.
If you're using a Mikrotik router as the PPPoE server, you'll have to turn on logging for PPP in order to see the username and password being received by it.

This will work on almost any router though certain router settings can prevent this from working.

This post has been edited by soonwai: Jul 7 2016, 06:05 PM
badai
post Jun 15 2016, 01:11 PM

Enthusiast
*****
Senior Member
986 posts

Joined: Jan 2003
If you have backup your router config, can use this: http://www.nirsoft.net/utils/router_password_recovery.html
TSsoonwai
post Jun 15 2016, 06:25 PM


*******
Senior Member
9,989 posts

Joined: Oct 2007
From: KL


QUOTE(badai @ Jun 15 2016, 01:11 PM)
If you have backup your router config, can use this: http://www.nirsoft.net/utils/router_password_recovery.html
*
Thanks badai, I'll put that in too. I've used that a few times before. Works on DIR-615 but not on L7-N-R2000.

This post has been edited by soonwai: Jul 8 2016, 12:22 AM
weevm
post Jul 7 2016, 01:06 AM

New Member
*
Junior Member
14 posts

Joined: Sep 2014
how can i open my nat type on this router ?
TSsoonwai
post Jul 7 2016, 01:43 PM


*******
Senior Member
9,989 posts

Joined: Oct 2007
From: KL


QUOTE(weevm @ Jul 7 2016, 01:06 AM)
how can i open my nat type on this router ?
*
This thread isn't specific to any router. Try the RGX4400 thread.
blacktubi
post Jul 7 2016, 04:39 PM

-
Group Icon
Elite
7,508 posts

Joined: Jul 2008

I use RouterPassView.

It is compatible with a lot of routers. Maybe someone can submit a config file for them to reverse engineer.

http://www.nirsoft.net/utils/router_password_recovery.html
Anime4000
post Jul 7 2016, 11:04 PM

Regular
******
Senior Member
1,917 posts

Joined: Jul 2009
From: /dev/null


on D-Link Router this method not working, it's encrypted anyways
TSsoonwai
post Jul 8 2016, 12:05 AM


*******
Senior Member
9,989 posts

Joined: Oct 2007
From: KL


QUOTE(Anime4000 @ Jul 7 2016, 11:04 PM)
on D-Link Router this method not working, it's encrypted anyways
*
Actually It works on "D-Link Router". Verified here. The million dollar question is "Which D-Link".
Anime4000
post Jul 8 2016, 02:50 PM

Regular
******
Senior Member
1,917 posts

Joined: Jul 2009
From: /dev/null


QUOTE(soonwai @ Jul 8 2016, 12:05 AM)
Actually It works on "D-Link Router". Verified here. The million dollar question is "Which D-Link".
*
D-Link I use is DIR-820L
using "Inspect Element" I believe my pppoe password not what it show
CODE

<input default="WHR9RfbDdH" id="poe_pass_s" name="poe_pass_s" size="20" maxlength="63" value="WHR9RfbDdH" onfocus="select();" type="password">

TSsoonwai
post Jul 8 2016, 02:58 PM


*******
Senior Member
9,989 posts

Joined: Oct 2007
From: KL


QUOTE(Anime4000 @ Jul 8 2016, 02:50 PM)
D-Link I use is DIR-820L
using "Inspect Element" I believe my pppoe password not what it show
CODE

<input default="WHR9RfbDdH" id="poe_pass_s" name="poe_pass_s" size="20" maxlength="63" value="WHR9RfbDdH" onfocus="select();" type="password">

*
You're right. That's not the password. In fact the string "WHR9RfbDdH" never changes even if you change your password. Which means that it is not even an encrypted representation of your password. This is similar to the L7-N-R2000 (DIR-614).

For these routers, afaik, the only way that works to recover the password is the PPPoE Server method.
dwijadas
post Dec 25 2016, 02:02 AM

Enthusiast
*****
Senior Member
713 posts

Joined: Sep 2004
From: Kuala Lumpur


QUOTE(soonwai @ Jul 8 2016, 02:58 PM)
You're right. That's not the password. In fact the string "WHR9RfbDdH" never changes even if you change your password. Which means that it is not even an encrypted representation of your password. This is similar to the L7-N-R2000 (DIR-614).

For these routers, afaik, the only way that works to recover the password is the PPPoE Server method.
*
Can you elaborate the PPOE server method ?

Thank you
TSsoonwai
post Feb 22 2017, 07:48 PM


*******
Senior Member
9,989 posts

Joined: Oct 2007
From: KL


QUOTE(dwijadas @ Dec 25 2016, 02:02 AM)
Can you elaborate the PPOE server method ?

Thank you
*
Sorry for the late reply. It's in the 2nd post. Basically just to use a dummy PPPoE server to capture the username and password sent by the router over ether1.
Dark9
post Aug 18 2017, 11:00 AM

New Member
*
Junior Member
22 posts

Joined: Jul 2014


Port forwarding on router unifi, is it block by TM? or there got limitation?
Try using ddns but not working...
TSsoonwai
post Aug 18 2017, 11:28 PM


*******
Senior Member
9,989 posts

Joined: Oct 2007
From: KL


QUOTE(Dark9 @ Aug 18 2017, 11:00 AM)
Port forwarding on router unifi, is it block by TM? or there got limitation?
Try using ddns but not working...
*
Some ports are blocked by TM.
ahrasis
post Aug 21 2017, 03:35 PM

New Member
*
Newbie
38 posts

Joined: Aug 2017
QUOTE(Dark9 @ Aug 18 2017, 11:00 AM)
Port forwarding on router unifi, is it block by TM? or there got limitation?
Try using ddns but not working...
I think, except for outbound on port 25 (for sending emails directly from your email server, if you have any), other ports should portforward just fine. Ddns also should work just fine. Most probably you are not setting your router correctly. What is your router anyway?
Raipaes
post Sep 13 2017, 09:10 PM

New Member
*
Newbie
10 posts

Joined: Sep 2017
QUOTE(soonwai @ Jun 14 2016, 04:20 PM)
i dunno routers password
What if you don't know the routers password? Which means that you can't login to the router's admin page. There's one more method. This method assumes:

1. You have physical access to the router.
2. The router is working and connects to UniFi successfully.

PPPoE Server Method
I'll expand on this further but the basic steps are:

1. Setup a PPPoE server.
Any PPPoE server will do. One of the easiest ways is to setup a Mikrotik router as a PPPoE server.

2. Connect your router's WAN port to the above PPPoE server.

3. Check PPPoE server logs for the username & password sent by your router.
If you're using a Mikrotik router as the PPPoE server, you'll have to turn on logging for PPP in order to see the username and password being received by it.

This will work on almost any router though certain router settings can prevent this from working.
*
Will this method work with the Huawei HG8245H? I have tried the other methods including the XML config file. The password shows a hash. I want to bridge this router and use ASUS RT-AC68u as main router. This is no easy task in the country I live. The ISP will not help with this and won't provide any info or PPPoE password. Thank you.
TSsoonwai
post Sep 13 2017, 09:15 PM


*******
Senior Member
9,989 posts

Joined: Oct 2007
From: KL


QUOTE(Raipaes @ Sep 13 2017, 09:10 PM)
Will this method work with the Huawei HG8245H? I have tried the other methods including the XML config file. The password shows a hash. I want to bridge this router and use ASUS RT-AC68u as main router. This is no easy task in the country I live. The ISP will not help with this and won't provide any info or PPPoE password. Thank you.
*
Yes, it will, provided you know the vlan, if any, the Huawei is using to communicate with the pppoe server. Another condition is that the Huawei is using an unencrypted ppp authentication protocol such as PAP.
Raipaes
post Sep 13 2017, 09:42 PM

New Member
*
Newbie
10 posts

Joined: Sep 2017
QUOTE(soonwai @ Sep 13 2017, 09:15 PM)
Yes, it will, provided you know the vlan, if any, the Huawei is using to communicate with the pppoe server. Another condition is that the Huawei is using an unencrypted ppp authentication protocol such as PAP.
*
It is using PPPoE authentication. I have access to the HG8245H WAN configuration and it shows the correct user name which is my ISP customer code. When I use the easy methods such as inspect element or show the hidden password, I get a bunch of letters and numbers instead of plain text password like: 58741beaa104b9bbfb963dd1fe255bcdd61e3651ed57fed93bd0e8cca17e6f60 . I saw on a blog it is a double hash SHA256(MD5('password')). https://zedt.eu/tech/hardware/obtaining-adm...huawei-hg8247h/
I want to use my Asus router as I have more functions than the ISP supplied router. I know the Vlan on the WAN config page of the router. What tools do I need to extract the pass using the PPPoE server method which I suppose is my last option?
TSsoonwai
post Sep 13 2017, 11:26 PM


*******
Senior Member
9,989 posts

Joined: Oct 2007
From: KL


I'm afraid I'm not familiar with the Huawei.

If you search in the source code of the WAN config page for your pppoe username, do you see anything near it that may resemble your pppoe password?

For the pppoe server method, all you need is a pppoe server and that may be a pc setup as one or, what I usually use, a Mikrotik router configured as a PPPoE server.

btw, which country are you in? and which ISP?

5 Pages  1 2 3 > » Top
 

Change to:
| Lo-Fi Version
0.0221sec    0.04    6 queries    GZIP Disabled
Time is now: 29th March 2024 - 05:03 AM