6

I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly:

SU_WAP>shell

BusyBox v1.18.4 (2016-10-11 19:35:35 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.


profile close core dump

WAP(Dopra Linux) # ?

exit

getcustominfo.sh

restorehwmode.sh

These are all commands I can do in this mode. There is another way to look at the directories:

SU_WAP>wap list path /    
bin  
boot  
dev  
etc  
html  
lib  
libexec  
linuxrc  
mnt  
proc  
root  
sbin  
share  
sys  
tmp  
uer   
usr  
var

It works like 'ls'. But I can not read any file:

SU_WAP>wap list path /var/wifi.txt  
/var/wifi.txt  
success!

Commands like 'cat' aren't working. Does anybody know is there any way to read these files if you're connecting modem through telnet? Maybe this is not possible with this firmware?
Thank you:)

multithr3at3d
  • 611
  • 3
  • 15
HE9CbITb
  • 101
  • 1
  • 10
  • 1
    Why is cat not working? The command doesn't exist or doesn't work? Are there other commands that can open files? Maybe you could just dump the storage device that holds the firmware and analyze it from somewhere else. – multithr3at3d Dec 31 '20 at 15:32
  • Command is just not allowed. 'Exit', 'getcustominfo.sh', 'restorehwmode.sh' - that's all I can do in shell mode. Probably it's because of firmware. Analyzing the firmware is a good idea, maybe I can find some answers I'm looking for. I'll try it, thank you. – HE9CbITb Dec 31 '20 at 17:17
  • Btw thank you for editing my post, it looks much better now:) – HE9CbITb Dec 31 '20 at 17:22
  • Just for a sanity check, does ? return the same output as help, from busybox? – multithr3at3d Dec 31 '20 at 17:37
  • Yeah it actually does. I showed it in my first post. If I type 'help' - BusyBox says that it doesn't know what 'help' is:D – HE9CbITb Dec 31 '20 at 17:39
  • One more question: what tools are you using to get firmware file from modem? – HE9CbITb Jan 02 '21 at 15:24
  • 1
    Well if you had any shell commands like dd, you could read the raw device. Or, use hardware hacking to dump e.g. flash chip or gain a full shell that way. – multithr3at3d Jan 02 '21 at 18:33
  • Thank you one more time) – HE9CbITb Jan 02 '21 at 19:00
  • @HE9CbITb do have access to download config backup file ? – Vido Jan 10 '21 at 19:15
  • @Vido yes I do. – HE9CbITb Jan 11 '21 at 22:17
  • @HE9CbITb can you save that page where it says download configuration file and html/management/cfgfileroot.asp and send it to me ? Do you have discord ? – Vido Jan 12 '21 at 13:05
  • My first thought would be to run list path /bin/ and see what tools are available. – Mega Tonnage Jul 26 '22 at 23:51

1 Answers1

0

try

SU_WAP>display file /var/wifi.txt

Echolife HG8245W5-6T shell block

0xC0000022L
  • 10,908
  • 9
  • 41
  • 79
Leo
  • 9
  • 1