Welcome Guest ( Log In | Register )

Bump Topic Add Reply RSS Feed

Outline · [ Standard ] · Linear+

Unifi Fiberhome SR1041F backdoor root ssh access, Don't open port 80 on WAN side

views
     
dineshmike
post Dec 9 2023, 12:19 PM

Casual
***
Junior Member
344 posts

Joined: Oct 2006
From: Kulaijaya, Johor
Once logged in via SSH, you can retrieve encrypted configs using the tool cfg_cmd.
I found some of the strings below under:
/fhrom/preconfimg/FH_AP_MY_TM_Trunk/pre_usrconfig_conf

CODE
cat /fhrom/preconfimg/FH_AP_MY_TM_Trunk/pre_usrconfig_conf

config interface 'InternetGatewayDevice__DeviceInfo__X_FH_Account__X_FH_WebUserInfo__'
       option WebPassword '<Removed>'
       option WebSuperPassword 'B633193F7FDB2CF758572A34501FAD01'
       option WebSuperUsername '3F8B9BC17DED934E91559F809DCF334F'
       option WebUsername '26EE0AB437C406A66F849A961449A037'


You can get the current username and password of the web logins using the command below:
CODE
cfg_cmd get InternetGatewayDevice.DeviceInfo.X_FH_Account.X_FH_WebUserInfo.WebUsername
cfg_cmd get InternetGatewayDevice.DeviceInfo.X_FH_Account.X_FH_WebUserInfo.WebPassword


You can also set the current username and password of the web logins using the command below:
CODE
cfg_cmd set InternetGatewayDevice.DeviceInfo.X_FH_Account.X_FH_WebUserInfo.WebUsername myuser
cfg_cmd set InternetGatewayDevice.DeviceInfo.X_FH_Account.X_FH_WebUserInfo.WebPassword password123


I also tried extracting the superuser credentials this way but they didn't work. Not sure whether there is a separate config to enable the superuser account.

CODE
cfg_cmd get InternetGatewayDevice.DeviceInfo.X_FH_Account.X_FH_WebUserInfo.WebSuperUsername
cfg_cmd get InternetGatewayDevice.DeviceInfo.X_FH_Account.X_FH_WebUserInfo.WebSuperPassword

#cfg_cmd get InternetGatewayDevice.DeviceInfo.X_FH_Account.X_FH_WebUserInfo.WebSuperUsername
cmd get InternetGatewayDevice.DeviceInfo.X_FH_Account.X_FH_WebUserInfo.WebSuperPasswordargc = 3
argv[0] = cfg_cmd
argv[1] = get
argv[2] = InternetGatewayDevice.DeviceInfo.X_FH_Account.X_FH_WebUserInfo.WebSuperUsername
get success!value=superadmin
#cfg_cmd get InternetGatewayDevice.DeviceInfo.X_FH_Account.X_FH_WebUserInfo.WebSuperPassword
argc = 3
argv[0] = cfg_cmd
argv[1] = get
argv[2] = InternetGatewayDevice.DeviceInfo.X_FH_Account.X_FH_WebUserInfo.WebSuperPassword
get success!value=f1ber@dm!n
#
« Next Oldest · Networks and Broadband · Next Newest »
 

Add ReplyOptions
 

Change to:
| Lo-Fi Version
 0.0146sec    0.53    6 queries    GZIP Disabled
Time is now: 26th November 2025 - 02:09 AM
All Rights Reserved © 2002- 2025 Vijandren Ramadass (~unite against racism~)
Removal Request
Powered by Invision Power Board © 2025  IPS, Inc.