#### # 开启 telent

注意：54XXXXXXXXC8 为光猫背后 ONU MAC：54-XX-XX-XX-XX-C8

1. 打开 http://192.168.X.X:8080 (网关地址) 使用密码登陆
2. 执行 http://192.168.X.X:8080/cgi-bin/telnetenable.cgi?key=54XXXXXXXXC8&telnetenable=1
3. 用 telent 命令登陆
   用户名：telecom 密码：nE7jA%5m
4. 获取 telnet 用户名密码

       1
       2
       3
       4

       获取telnet的用户名
       cfg_cmd get InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetUserName
       获取telnet的密码
       cfg_cmd get InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetPassword

5. 转为 root 用户

       1
       2

       su
       密码：Fh@XXXXXX(X为mac地址的后6位)

6. 获取 web 超级密码

       1

       cfg_cmd get InternetGatewayDevice.DeviceInfo.X_CT-COM_TeleComAccount.Password | grep 'get success' | cut -d = -f 2

   7、访问 http://192.168.1.1:8080/html/logoffaccount.html 把隐藏用户打开，其它选项改为可修改

两种命令模式：

#### # 工厂模式

1. 进入工厂模式

       1

       load_cli factory

2. 显示管理员密码

       1

       show admin_pwd

3. 显示所有命令

       1

       ?

4. 显示所有 show 命令

       1

       show ?

5. 显示所有 set 命令

       1

       set ?

6. 显示所有信息

       1

       show allinfo

#### # cfg_cmd 命令模式

1. 开启 TELNET

       1
       2
       3

       cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetEnable 1
       cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetUserName 用户名
       cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetPassword 密码

2. 打开 FTP 功能

       1
       2
       3

       cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.FtpEnable 1
       cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.FtpUserName 用户名
       cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.FtpPassword 密码

3. 获取 LOID

       1

       cfg_cmd get InternetGatewayDevice.X_CT-COM_UserInfo.UserName |grep 'value' |cut -d '=' -f 2

4. TR069

       1
       2
       3
       4
       5
       6
       7
       8
       9
       10

       cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.Enable
       cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.Enable 0 #0禁用，1启用
       cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.VLANIDMark
       cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.VLANIDMark 99 #默认46
       cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.Mode
       cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.Mode 2 #默认2
       cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_AccessControl.Enabled
       cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_AccessControl.Enabled 0 #0禁用，1启用
       cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1.Enable
       cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1.Enable 0 #0禁用，1启用

5. 关闭 TR069 中间件

       1

       cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_MiddlewareMgt.Tr069Enable 0

6. 删除 1_TR069_R_VID_46

       1

       cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.IP_Routed=''

7. 查看设备目前的连接数

       1

       cfg_cmd get InternetGatewayDevice.Services.X_CT-COM_MWBAND.TotalTerminalNumber

8. 设置设备连接数

       1

       cfg_cmd set InternetGatewayDevice.Services.X_CT-COM_MWBAND.TotalTerminalNumber 255

9. 用户信息

       1

       cfg_cmd get InternetGatewayDevice.X_CT-COM_UserInfo.UserName

10. 获取 cfg_cmd 帮助

        1

        cfg_cmd help

11. 获取指定节点后的节点

        1
        2

        cfg_cmd shownode InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1. [0|1]
        （如cfg_cmd shownode InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1. [0]）

烽火 天翼网关 破解 HG5143F