烽火 10G-ONU 天翼网关 4.0 破解（HG5143F)

# 开启 telent

注意：54XXXXXXXXC8 为光猫背后 ONU MAC：54-XX-XX-XX-XX-C8

1. 打开 http://192.168.X.X:8080 (网关地址) 使用密码登陆
2. 执行 http://192.168.X.X:8080/cgi-bin/telnetenable.cgi?key=54XXXXXXXXC8&telnetenable=1
3. 用 telent 命令登陆
   用户名：telecom 密码：nE7jA%5m
4. 获取 telnet 用户名密码
   

   1 2 3 4

   获取telnet的用户名 cfg_cmd get InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetUserName 获取telnet的密码 cfg_cmd get InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetPassword

5. 转为 root 用户
   

   1 2	su 密码：Fh@XXXXXX(X为mac地址的后6位)

6. 获取 web 超级密码
   

   1	cfg_cmd get InternetGatewayDevice.DeviceInfo.X_CT-COM_TeleComAccount.Password | grep 'get success' | cut -d = -f 2

   
   7、访问 http://192.168.1.1:8080/html/logoffaccount.html 把隐藏用户打开，其它选项改为可修改

两种命令模式：

# 工厂模式

1. 进入工厂模式
   

   1	load_cli factory

2. 显示管理员密码
   

   1	show admin_pwd

3. 显示所有命令
   

   1

   ?

4. 显示所有 show 命令
   

   1

   show ?

5. 显示所有 set 命令
   

   1

   set ?

6. 显示所有信息
   

   1	show allinfo

# cfg_cmd 命令模式

1. 开启 TELNET
   

   1 2 3

   cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetEnable 1 cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetUserName 用户名 cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.TelnetPassword 密码

2. 打开 FTP 功能
   

   1 2 3

   cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.FtpEnable 1 cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.FtpUserName 用户名 cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_ServiceManage.FtpPassword 密码

3. 获取 LOID
   

   1	cfg_cmd get InternetGatewayDevice.X_CT-COM_UserInfo.UserName |grep 'value' |cut -d '=' -f 2

4. TR069
   

   1 2 3 4 5 6 7 8 9 10

   cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.Enable cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.Enable 0 #0禁用，1启用 cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.VLANIDMark cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.VLANIDMark 99 #默认46 cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.Mode cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.Mode 2 #默认2 cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_AccessControl.Enabled cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_AccessControl.Enabled 0 #0禁用，1启用 cfg_cmd get InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1.Enable cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.WANIPConnection.1.Enable 0 #0禁用，1启用

5. 关闭 TR069 中间件
   

   1	cfg_cmd set InternetGatewayDevice.DeviceInfo.X_CT-COM_MiddlewareMgt.Tr069Enable 0

6. 删除 1_TR069_R_VID_46
   

   1	cfg_cmd set InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1.X_CT-COM_WANEponLinkConfig.IP_Routed=''

7. 查看设备目前的连接数
   

   1	cfg_cmd get InternetGatewayDevice.Services.X_CT-COM_MWBAND.TotalTerminalNumber

8. 设置设备连接数
   

   1	cfg_cmd set InternetGatewayDevice.Services.X_CT-COM_MWBAND.TotalTerminalNumber 255

9. 用户信息
   

   1	cfg_cmd get InternetGatewayDevice.X_CT-COM_UserInfo.UserName

10. 获取 cfg_cmd 帮助
    

    1	cfg_cmd help

11. 获取指定节点后的节点
    

    1 2	cfg_cmd shownode InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1. [0|1] （如cfg_cmd shownode InternetGatewayDevice.WANDevice.1.WANConnectionDevice.1. [0]）