# 烽火 10G-ONU 天翼网关 4.0 破解（HG5143F) - 技术分享 - 生活 | ☆∵∴Hito∴∵★ = 涛声依旧 = 天下事有难易乎？为之，则难者亦易矣
Keywords: 烽火,天翼网关,破解,HG5143F

#### # 开启 telent

注意：54XXXXXXXXC8 为光猫背后 ONU MAC：54-XX-XX-XX-XX-C8

1. 打开 http://192.168.X.X:8080 (网关地址) 使用密码登陆
2. 执行 http://192.168.X.X:8080/cgi-bin/telnetenable.cgi?key=54XXXXXXXXC8&telnetenable=1
3. 用 telent 命令登陆
   用户名：telecom 密码：nE7jA%5m
4. 获取 telnet 用户名密码

    获取telnet的用户名

    cfg_cmd get InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetUserName

    获取telnet的密码

    cfg_cmd get InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetPassword

5. 转为 root 用户

    su

    密码：Fh@XXXXXX(X为mac地址的后6位)

6. 获取 web 超级密码

    cfg_cmd get InternetGatewayDevice.DeviceInfo.X_CT-COM_TeleComAccount.Password | grep 'get success' | cut -d = -f 2

7、访问 http://192.168.1.1:8080/html/logoffaccount.html 把隐藏用户打开，其它选项改为可修改

两种命令模式：

#### # 工厂模式

1. 进入工厂模式

    load_cli factory

2. 显示管理员密码

    show admin_pwd

3. 显示所有命令

    ?

4. 显示所有 show 命令

    show ?

5. 显示所有 set 命令

    set ?

6. 显示所有信息

    show allinfo

#### # cfg_cmd 命令模式

1. 开启 TELNET

    cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetEnable 1

    cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetUserName 用户名

    cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetPassword 密码

2. 打开 FTP 功能

    cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.FtpEnable 1

    cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.FtpUserName 用户名

    cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.FtpPassword 密码

3. 获取 LOID

    cfg_cmd get InternetGatewayDevice.X_CT-COM_UserInfo.UserName |grep 'value' |cut -d '=' -f 2

4. TR069

    cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.Enable

    cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.Enable 0 #0 禁用，1 启用

    cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.VLANIDMark

    cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.VLANIDMark 99 #默认 46

    cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.Mode

    cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.Mode 2 #默认 2

    cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_AccessControl.Enabled

    cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_AccessControl.Enabled 0 #0 禁用，1 启用

    cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1.Enable

    cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1.Enable 0 #0 禁用，1 启用

5. 关闭 TR069 中间件

    cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_MiddlewareMgt.Tr069Enable 0

6. 删除 1_TR069_R_VID_46

    cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.IP_Routed=''

7. 查看设备目前的连接数

    cfg_cmd get InternetGatewayDevice.Services.X_CT-COM_MWBAND.TotalTerminalNumber

8. 设置设备连接数

    cfg_cmd set InternetGatewayDevice.Services.X_CT-COM_MWBAND.TotalTerminalNumber 255

9. 用户信息

    cfg_cmd get InternetGatewayDevice.X_CT-COM_UserInfo.UserName

10. 获取 cfg_cmd 帮助

    cfg_cmd help

11. 获取指定节点后的节点

    cfg_cmd shownode InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1. [0|1]

    （如cfg_cmd shownode InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1. [0]）

烽火 天翼网关 破解 HG5143F