Skip to content

Instantly share code, notes, and snippets.

@chriscpritchard
Last active September 9, 2024 17:44
Show Gist options
  • Save chriscpritchard/db98167c0a1372ef16e131bfe9b76956 to your computer and use it in GitHub Desktop.
Save chriscpritchard/db98167c0a1372ef16e131bfe9b76956 to your computer and use it in GitHub Desktop.
Technicolor DWA0120 - Obtain PPPOE Password
  1. Connect to the router via ssh, the username is "engineer" and the password is the access key on the bottom of your router
  2. You will be greeted with something akin to the following:
          |                 |           o             |
          |---  ,---. ,---. |---. ,---. . ,---. ,---. |     ,---. ,---.
          |     |---' |     |   | |   | | |     |   | |     |   | |
          `---' `---' `---' `   ' `   ' ` `---' `---' `---' `---' `
                     N E X T   G E N E R A T I O N   G A T E W A Y
     --------------------------------------------------------------------
     NG GATEWAY SIGNATURE DRINK
     --------------------------------------------------------------------
      * 1 oz Vodka          Pour all ingredients into mixing
      * 1 oz Triple Sec     tin with ice, strain into glass.
      * 1 oz Orange juice
     --------------------------------------------------------------------
    This program contains proprietary information which is a trade secret of Technicolor
    and also is protected by intellectual property as an unpublished work
    under applicable Copyright laws/right of authorship.
    This program is also subject to some patent and pending patent applications.
    Technicolor is registered trademark and trade name of Technicolor group company,
    and shall not be used in any manner without express written from Technicolor.
    The use of the program and documentation is strictly limited to your own internal
    evaluation of the product embedding such program, unless expressly agreed otherwise
    by Technicolor under a specific agreement.
    Recipient is to retain this program in confidence and is not permitted to use
    or make copies thereof other than as permitted in a written agreement with Technicolor,
    unless otherwise expressly allowed by applicable laws.
    Recipient is not allowed to make any copy, decompile, reverse engineer, disassemble,
    and attempt to derive the source code of, modify, or
    create derivative works of the program, any update, or any part thereof.
    Any violation or attempt to do so is a violation of the rights of Technicolor.
    If you or any person under your control or authority breach this restriction,
    you may be subject to prosecution and damages.
    Product: vbnt-2
    Release: Cobalt (18.3)
    Version: 18.3.0278-2741007-20190320103504-0a0de5fc444c0dd4b93760b5cebf15791868a0a7
    Hash config:         0a0de5fc444c0dd4b93760b5cebf15791868a0a7
    Hash openwrt:        f05086f310e02591a501232ceecfa6ca3641deb2
    Hash kernel:         0d40edb618b17d93b4b81a4178f38d107840bf58
    Hash technicolor:    d08bcf9fc16cc35e3967c8a1298d36d3cec1fdfe
    Hash routing:        210fc51dab0344d982f6be3c8cf289be0c27a689
    Hash custo:          597f3f0d2bbd794727911db87025a86da665b28a
    Hash lte:            ff91c9ab917fd6313ff2891788c33fef717d2425
    Hash packages:       cd399ca61469d26b2bf1777bc099a475fc19868d
    ====================================================================================
    engineer>
    
    
  3. run the command "ps"
  4. scroll through the list to find the "pppd" command, it will look something like: 5175 2365 root S 3304 1% 0% /usr/sbin/pppd nodetach ipparam wan ifname pppoe-wan lcp-echo-interval 10 lcp-echo-failure 5 lcp-echo-adaptive set PEERDNS=0 nodefaultroute usepeerdns maxfail 1 user PPPOEUSERNAME password PPPOEPASSWORD ip-up-script /lib/netifd/ppp-up ipv6-up-script /lib/netifd/ppp6-up ip-down-script /lib/netifd/ppp-down ipv6-down-script /lib/netifd/ppp-down plugin connstate.so mtu 1500 mru 1500 plugin rp-pppoe.so graceful_restart /etc/ppp/pppoesession_vlan_wan nic-vlan_wan host-uniq SOMMESTRING
  5. The username and password are passed as arguments to that pppd command, so copy them down and do with them what you want!
@darrylp1per
Copy link

`HELO
CPU0
PMCS
PMCD
CODE
L1CD
MMUI
ZBBS
MAIN
5.0203-1.0.38-161.188
DRAM
NVRAM memcfg 0x327
MCB chksum 0xf65f52a5
DDR3-1600 CL11 256MB
PASS

Technicolor Gateway
(c) 2018, All rights reserved

Gateway initialization sequence started
Boot Loader Version : 18.37.1138-0000000-20180919064610-fe2746878916b5342ae471d5c774a02a337aaac9
Boot Loader OID : 5ba1efb7c0f0e171f39b47f7
CPU : BCM63132_B0
RAM : 256MB
Flash : 125MB NAND
Board Mnemonic : VBNT-2
Market ID : FFFC
Booting : Bank 1
SW Version : 18.3.0278-2741042-20190614155643-0a0de5fc444c0dd4b93760b5cebf15791868a0a7
Starting the Linux kernel

Enabling watchdog
Code Address: 0x00008000, Entry Address: 0x00008000
Decompression LZMA image OK!
Entry at 0x00008000
Closing network.
Starting program at 0x00008000
cpu freq set to 666MHz
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 4.1.38 (repowrt-builder@c9dee36b6577) (gcc version 5.3.0 (OpenWrt GCC 5.3.0 unknown) ) #1 SMP PREEMPT Tue Feb 19 00:17:41 UTC 2019
[ 0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c5387d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] Machine: BCM963138
[ 0.000000] Prozone memory from command line 0ffe0000
[ 0.000000] Ignoring unrecognised tag 0x41000603
[ 0.000000] Memory policy: Data cache writealloc
[ 0.000000] creating a MT_MEMORY_NONCACHED device at physical address of 0x0ff00000 to virtual address at 0xcff00000 with size of 0x100000 byte for TCH_RESERVED
[ 0.000000] creating a MT_MEMORY_NONCACHED device at physical address of 0x0f500000 to virtual address at 0xcf500000 with size of 0x300000 byte for adsl
[ 0.000000] creating a MT_MEMORY_NONCACHED device at physical address of 0x0e000000 to virtual address at 0xce000000 with size of 0x1400000 byte for tm
[ 0.000000] creating a MT_MEMORY_NONCACHED device at physical address of 0x0dc00000 to virtual address at 0xcdc00000 with size of 0x400000 byte for mc
[ 0.000000] On node 0 totalpages: 58368
[ 0.000000] free_area_init_node: node 0, pgdat c052bf40, node_mem_map cfcb6000
[ 0.000000] DMA zone: 36 pages used for memmap
[ 0.000000] DMA zone: 0 pages reserved
[ 0.000000] DMA zone: 4096 pages, LIFO batch:0
[ 0.000000] Normal zone: 540 pages used for memmap
[ 0.000000] Normal zone: 54272 pages, LIFO batch:15
[ 0.000000] pmc_init:PMC using DQM mode
[ 0.000000] pmc_init:0 63138 a49
[ 0.000000] PERCPU: Embedded 11 pages/cpu @cfc9d000 s15424 r8192 d21440 u45056
[ 0.000000] pcpu-alloc: s15424 r8192 d21440 u45056 alloc=11*4096
[ 0.000000] pcpu-alloc: [0] 0 [0] 1
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 57792
[ 0.000000] Kernel command line: console=ttyS0,115200 irqaffinity=0 debug root=/dev/mtdblock1 rootfstype=squashfs coherent_pool=1M nosmp nosmp tbbt_addr=0x7d20000 btab=0xa100c btab_bootid=1 bl_version=18.37.1138-0000000-20180919064610-fe2746878916b5342ae471d5c774a02a337aaac9 board=VBNT-2 platform.prozone_addr=0xffe0000 bl_oid=5ba1efb7c0f0e171f39b47f7 <
[ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Memory: 225296K/233472K available (3932K kernel code, 246K rwdata, 1088K rodata, 176K init, 296K bss, 8176K reserved, 0K cma-reserved)
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xffc00000 - 0xfff00000 (3072 kB)
[ 0.000000] vmalloc : 0xd0800000 - 0xff000000 ( 744 MB)
[ 0.000000] lowmem : 0xc0000000 - 0xd0000000 ( 256 MB)
[ 0.000000] modules : 0xbec00000 - 0xc0000000 ( 20 MB)
[ 0.000000] .text : 0xc0008000 - 0xc04ef26c (5021 kB)
[ 0.000000] .init : 0xc04f0000 - 0xc051c000 ( 176 kB)
[ 0.000000] .data : 0xc051c000 - 0xc055999c ( 247 kB)
[ 0.000000] .bss : 0xc055999c - 0xc05a39e8 ( 297 kB)
[ 0.000000] Preemptible hierarchical RCU implementation.
[ 0.000000] NR_IRQS:256
[ 0.000000] Cortex A9 MPCORE GIC init
[ 0.000000] DIST at fc01f000, CPU_IF at fc01e100
[ 0.000000] L2C: DT/platform modifies aux control register: 0x02070000 -> 0x6a450000
[ 0.000000] L2C: DT/platform tries to modify or specify cache size
[ 0.000000] L2C-310 enabling early BRESP for Cortex-A9
[ 0.000000] L2C-310 full line of zeros enabled for Cortex-A9
[ 0.000000] L2C-310 I prefetch enabled, offset 1 lines
[ 0.000000] L2C-310 dynamic clock gating enabled, standby mode enabled
[ 0.000000] L2C-310 cache controller enabled, 16 ways, 512 kB
[ 0.000000] L2C-310: CACHE_ID 0x410000c9, AUX_CTRL 0x6e450001
[ 0.000000] L2C: failed to init: -19
[ 0.000000] map_hw_timer_interrupt,127: interrupt_id 96
[ 0.000000] map_hw_timer_interrupt,127: interrupt_id 97
[ 0.000000] map_hw_timer_interrupt,127: interrupt_id 98
[ 0.000000] map_hw_timer_interrupt,127: interrupt_id 99
[ 0.000000] clocksource timer_cs: mask: 0x3fffffff max_cycles: 0x3fffffff, max_idle_ns: 9556302227 ns
[ 0.000007] sched_clock: 30 bits at 50MHz, resolution 20ns, wraps every 10737418230ns
[ 0.422964] console [ttyS0] enabled
[ 0.426556] Calibrating delay loop... 1319.93 BogoMIPS (lpj=659968)
[ 0.441214] pid_max: default: 32768 minimum: 301
[ 0.446127] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.452784] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.460344] --Kernel Config--
[ 0.463092] SMP=1
[ 0.465229] PREEMPT=1
[ 0.467737] DEBUG_SPINLOCK=0
[ 0.470889] DEBUG_MUTEXES=0
[ 0.474234] Initializing cgroup subsys blkio
[ 0.478339] Initializing cgroup subsys memory
[ 0.482836] Initializing cgroup subsys net_cls
[ 0.487370] Initializing cgroup subsys debug
[ 0.491772] CPU: Testing write buffer coherency: ok
[ 0.496766] Broadcom Logger v0.1
[ 0.500282] Setting up static identity map for 0x8220 - 0x8254
[ 0.510275] Brought up 1 CPUs
[ 0.512744] SMP: Total of 1 processors activated (1319.93 BogoMIPS).
[ 0.519288] CPU: All CPU(s) started in SVC mode.
[ 0.529456] clocksource jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns
[ 0.539574] NET: Registered protocol family 16
[ 0.545570] DMA: preallocated 1024 KiB pool for atomic coherent allocations
[ 0.557062] cpuidle: using governor ladder
[ 0.565060] cpuidle: using governor menu
[ 0.569102]
[ 0.569102] *** Voice Board id is not initialized properly ***
[ 0.569102]
[ 0.586294] SCSI subsystem initialized
[ 0.589729] usbcore: registered new interface driver usbfs
[ 0.595252] usbcore: registered new interface driver hub
[ 0.600742] usbcore: registered new device driver usb
[ 0.606136] bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated
[ 0.613430] skb_free_task created successfully with start budget 128
[ 0.619487] gbpm_do_work scheduled
[ 0.623010] BLOG v3.0 Initialized
[ 0.627320] BLOG Rule v1.0 Initialized
[ 0.631150] Broadcom IQoS v0.1 initialized
[ 0.635350] Broadcom GBPM v0.1 initialized
[ 0.639623] NET: Registered protocol family 8
[ 0.644034] NET: Registered protocol family 20
[ 0.648845] Switched to clocksource timer_cs
[ 0.653949] NET: Registered protocol family 2
[ 0.658560] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.665214] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.671813] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.678374] UDP hash table entries: 256 (order: 1, 8192 bytes)
[ 0.684359] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[ 0.691084] NET: Registered protocol family 1
[ 0.695313] PCI: CLS 0 bytes, default 32
[ 0.699981] futex hash table entries: 512 (order: 2, 16384 bytes)
[ 0.706369] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.711926] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.722737] fuse init (API version 7.23)
[ 0.728393] io scheduler noop registered (default)
[ 0.733480] Broadcom NAND controller (BrcmNand Controller)
[ 0.738672] mtd->oobsize=0, mtd->eccOobSize=0
[ 0.743077] NAND_CS_NAND_XOR=00000000
[ 0.746818] Disabling XOR: Before: SEL=40000001, XOR=00000000
[ 0.752748] Disabling XOR: After: SEL=40000000, XOR=00000000
[ 0.758544] B4: NandSelect=40000000, nandConfig=25152300, chipSelect=0
[ 0.765254] brcmnand_read_id: CS0: dev_id=2cf18095
[ 0.770192] After: NandSelect=00000000, nandConfig=25152300
[ 0.775938] Block size=00020000, erase shift=17
[ 0.780589] NAND Config: Reg=25152300, chipSize=128 MB, blockSize=128K, erase_shift=11
[ 0.788726] busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff
[ 0.795725] BrcmNAND mfg 2c f1 MICRON MT29F1G08ABA 128MB on CS0
[ 0.801830]
[ 0.801830] Found NAND on CS0: ACC=c3840010, cfg=25152300, flashId=2cf18095, tim1=65324458, tim2=80000e54
[ 0.813203] BrcmNAND version = 0x80000700 128MB @00000000
[ 0.818759] brcmnand_scan: B4 nand_select = 00000000
[ 0.823898] brcmnand_scan: After nand_select = 00000000
[ 0.829236] handle_acc_control: default CORR ERR threshold 3 bits
[ 0.835586] ACC: 16 OOB bytes per 512B ECC step; from ID probe: 16
[ 0.841958] page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17
[ 0.849675] Brcm NAND controller version = 7.0 NAND flash size 128MB @18000000
[ 0.857085] ECC layout=brcmnand_oob_bch4_2k
[ 0.861397] brcmnand_scan: mtd->oobsize=64
[ 0.865691] brcmnand_scan: oobavail=35, eccsize=512, writesize=2048
[ 0.872160] brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=4, eccbytes=7
[ 0.881293] Gateway flash mapping
[ 0.884136] NAND FLASH TL: phy_addr 0x7d20000
[ 0.888607] brcmnand_reset_corr_threshold: default CORR ERR threshold 3 bits for CS0
[ 0.897387] [NAND] : tBBT loaded

[ 0.900225] Technicolor nand flash translation layer initialized.
[ 0.906660] flash mapping initialized, size=125 Mb
[ 0.911783] parse_btab: num_banks (5)
[ 0.915523] Creating 1 MTD partitions on "technicolor-nand-tl":
[ 0.921490] 0x000002400000-0x000004e60000 : "rootfs"
[ 0.927076] Creating 5 MTD partitions on "technicolor-nand-tl":
[ 0.932652] 0x0000000e0000-0x000002000000 : "rootfs_data"
[ 0.938693] 0x000002000000-0x000004e60000 : "bank_1"
[ 0.943829] 0x000004e60000-0x000007cc0000 : "bank_2"
[ 0.948961] 0x000000080000-0x0000000a0000 : "eripv2"
[ 0.954059] 0x0000000a0000-0x0000000e0000 : "rawstorage"
[ 0.960477] PPP generic driver version 2.4.2
[ 0.964428] PPP BSD Compression module registered
[ 0.969132] PPP Deflate Compression module registered
[ 0.974336] NET: Registered protocol family 24
[ 0.979165] brcmboard registered
[ 0.982226] brcmboard: brcm_board_init entry
[ 0.986632] print_rst_status: Last RESET due to SW reset
[ 1.004889] DYING GASP IRQ Initialized and Enabled
[ 1.010436] Serial: BCM63XX driver $Revision: 3.00 $
[ 1.014975] Magic SysRq with Auxilliary trigger char enabled (type ^ h for list of supported commands)
[ 1.025565] ttyS0 at MMIO 0xfffe8600 (irq = 64, base_baud = 921600) is a BCM63XX
[ 1.033307] ttyS1 at MMIO 0xfffe8620 (irq = 65, base_baud = 921600) is a BCM63XX
[ 1.040910] BPM: tot_mem_size=268435456B (256MB), buf_mem_size <20%> =53687080B (51MB), num of buffers=20712, buf size=2592
[ 1.052254] Broadcom BPM Module Char Driver v0.1 Registered<3004>
[ 1.199750] PCIe HCD (impl1)
[ 1.212477] bcm963xx-pcie: found core [0] Rev [3.01] with 1 Lanes
[ 1.798359] bcm963xx-pcie bcm963xx-pcie.0: PCI host bridge to bus 0000:00
[ 1.804809] pci_bus 0000:00: root bus resource [mem 0x90000000-0x9fffffff]
[ 1.811868] pci_bus 0000:00: root bus resource [bus 00-ff]
[ 1.817517] pci 0000:00:00.0: [14e4:6313] type 01 class 0x060400
[ 1.823737] pci 0000:00:00.0: PME# supported from D0 D3hot
[ 1.829507] PCI: bus0: Fast back to back transfers disabled
[ 1.835066] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 1.843428] pci 0000:01:00.0: [14e4:a8db] type 00 class 0x028000
[ 1.849542] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x00007fff 64bit]
[ 1.856571] pci 0000:01:00.0: supports D1 D2
[ 1.861015] pci 0000:00:00.0: Checking PCIe ASPM for vendor 14e4 device a8db
[ 1.869894] PCI: bus1: Fast back to back transfers disabled
[ 1.875077] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[ 1.881893] pci 0000:00:00.0: BAR 8: assigned [mem 0x90000000-0x900fffff]
[ 1.888884] pci 0000:01:00.0: BAR 0: assigned [mem 0x90000000-0x90007fff 64bit]
[ 1.896394] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 1.901506] pci 0000:00:00.0: bridge window [mem 0x90000000-0x900fffff]
[ 1.908537] pcieport 0000:00:00.0: enabling device (0140 -> 0142)
[ 1.914892] pcieport 0000:00:00.0: Max Payload Size set to 128/ 512 (was 128), Max Read Rq 512
[ 1.923899] pci 0000:01:00.0: Max Payload Size set to 128/ 128 (was 128), Max Read Rq 512
[ 1.942831] bcm963xx-pcie: found core [1] Rev [3.01] with 1 Lanes
[ 2.528814] bcm963xx-pcie bcm963xx-pcie.1: PCI host bridge to bus 0001:00
[ 2.535266] pci_bus 0001:00: root bus resource [mem 0xa0000000-0xafffffff]
[ 2.542311] pci_bus 0001:00: root bus resource [bus 00-ff]
[ 2.547977] pci 0001:00:00.0: [14e4:6313] type 01 class 0x060400
[ 2.554186] pci 0001:00:00.0: PME# supported from D0 D3hot
[ 2.559985] PCI: bus0: Fast back to back transfers disabled
[ 2.565520] pci 0001:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 2.573906] pci 0001:01:00.0: [14e4:4360] type 00 class 0x028000
[ 2.579989] pci 0001:01:00.0: reg 0x10: [mem 0x00000000-0x00007fff 64bit]
[ 2.587010] pci 0001:01:00.0: supports D1 D2
[ 2.591471] pci 0001:00:00.0: Checking PCIe ASPM for vendor 14e4 device 4360
[ 2.599899] PCI: bus1: Fast back to back transfers disabled
[ 2.605062] pci_bus 0001:01: busn_res: [bus 01-ff] end is updated to 01
[ 2.611897] pci 0001:00:00.0: BAR 8: assigned [mem 0xa0000000-0xa00fffff]
[ 2.618872] pci 0001:01:00.0: BAR 0: assigned [mem 0xa0000000-0xa0007fff 64bit]
[ 2.626416] pci 0001:00:00.0: PCI bridge to [bus 01]
[ 2.631488] pci 0001:00:00.0: bridge window [mem 0xa0000000-0xa00fffff]
[ 2.638539] pcieport 0001:00:00.0: enabling device (0140 -> 0142)
[ 2.644838] pcieport 0001:00:00.0: Max Payload Size set to 512/ 512 (was 128), Max Read Rq 512
[ 2.653911] pci 0001:01:00.0: Max Payload Size set to 512/ 512 (was 128), Max Read Rq 512
[ 2.662809] GACT probability NOT on
[ 2.666196] Mirror/redirect action on
[ 2.669977] u32 classifier
[ 2.672693] input device check on
[ 2.676482] Actions configured
[ 2.680306] NET: Registered protocol family 10
[ 2.685567] sit: IPv6 over IPv4 tunneling driver
[ 2.691087] NET: Registered protocol family 17
[ 2.695131] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[ 2.708132] Bridge firewalling registered
[ 2.712214] Ebtables v2.0 registered
[ 2.715958] ebt_time registered
[ 2.719114] ebt_ftos registered
[ 2.722342] 8021q: 802.1Q VLAN Support v1.8
[ 2.726770] Registering SWP/SWPB emulation handler
[ 2.740487] VFS: Mounted root (squashfs filesystem) readonly on device 31:1.
[ 2.747456] Freeing unused kernel memory: 176K (c04f0000 - c051c000)
open: No such file or directory
open: No such file or directory
[ 4.323250] init: Console is alive
[ 6.800011] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 6.862131] Button Hotplug driver version 0.4.1
[ 6.889977] usbcore: registered new interface driver usb-storage
[ 6.897342] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 6.914547] init: - preinit -
[ 7.632389] jffs2: jffs2_scan_inode_node(): CRC failed on node at 0x002917f4: Read 0xffffffff, calculated 0x1490a44b
[ 7.648208] jffs2: Empty flash at 0x00291838 ends at 0x00292000
[ 8.075216] jffs2: notice: (53) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
switching to overlay
[ 8.157267] insmod: module is already loaded - bankmgr
HOMEWARE_CONFIG_ON_ACTIVE_BANK
mounting overlay fs
open: No such file or directory
[ 8.571330] random: dd urandom read with 117 bits of entropy available
1+0 records in
1+0 records out
[ 9.035504] tommath: module license 'unspecified' taints kernel.
[ 9.041189] Disabling lock debugging due to kernel taint
[ 9.085418] brcm_otp_init entry
[ 9.144671] eRIPv2 secrets passed correctly to Linux
[ 9.185236] Dsl Annex A board
[ 9.188656] Set board (VBNT-2)
[ 9.335903] random: nonblocking pool is initialized
[ 9.705183] procd: - early -
[ 10.338006] procd: - watchdog -
[ 10.341258] procd: - ubus -
[ 10.558615] procd: - init -
[ 12.336068] tm_base_addr 0xce000000, size 20971520, tm_base_addr_phys 0x0e000000
[ 12.343107] mc_base_addr 0xcdc00000, size 4194304, mc_base_addr_phys 0x0dc00000
[ 12.350699] RDP reserved memory has been adjusted
[ 12.350699] TM: base_addr = 0xcdf00000, phys_addr = 0x0df00000, size = 17MB
[ 12.350699] MC: base_addr = 0xcdc00000, phys_addr = 0x0dc00000, size = 3MB
[ 12.370310]
[ 12.370310] RDP TM memory = 17MB, MC memory = 3MB : Max Possible Bufs <6826> of size <2560>; Allocating <5120> bufs; RDP enum <1>
[ 12.391034] ++++Runner gso_desc_pool created successfully
[ 12.410985] RDPA DS WAN UDP Filter Command Driver
[ 12.858101] kmodloader: loading kernel modules from /etc/modules.d/*
[ 12.870701] input: gpio-keys-polled as /devices/platform/gpio-keys-polled.0/input/input0
[ 12.924012] Initializing XFRM netlink socket
[ 12.929806] NET: Registered protocol family 15
[ 12.935832] ipip: IPv4 over IPv4 tunneling driver
[ 12.993709] L2TP core: blog_l2tp_rcv_check
[ 13.000971] l2tp_core: L2TP core driver, V2.0
[ 13.021939] l2tp_netlink: L2TP netlink interface
[ 13.041348] nat46: module (version 683fbd2b765506332a1af141545652bf58f03166) loaded.
[ 13.058933] gre: GRE over IPv4 demultiplexor driver
[ 13.072657] ip_gre: GRE over IPv4 tunneling driver
[ 13.087964] ip6_gre: GRE over IPv6 tunneling driver
[ 13.103081] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 13.141008] ncr_master_key_set_internal
[ 13.145519] ncr: driver 0.2-mr1 loaded.
[ 13.158013] Speed Service CPU Layer Initialized
[ 13.167925] Allocated EXT_TIMER number 1
[ 13.176241] Speed Service Runner Layer Initialized
[ 13.182939] Broadcom Speed Service Driver (spdsvc) Char Driver v0.1 Registered <3028>
[ 13.204970] Netfilter messages via NETLINK v0.30.
[ 13.219165] ip_set: protocol 6
[ 13.299984] bcmxtmrt: Broadcom BCM3132B0 ATM/PTM Network Device v0.9
[ 13.311459] Created XTM Rx queue 5 with size 256,Descriptor base=00c1a000
[ 13.323953] Created XTM Rx queue 6 with size 256,Descriptor base=00c1c000
[ 13.403194] OSCK Loaded!
[ 13.455690] Client Private Key Loaded!
[ 13.479023] Broadcom Ingress QoS Module Char Driver v0.1 Registered<3003>
[ 13.495000] iq_drv_construct rdpa_cpu_get returned error
[ 13.506989]
[ 13.506989] Broadcom Ingress QoS ver 0.1 initialized
[ 13.533418] i2c /dev entries driver
[ 13.554598] NBUFF v1.0 Initialized
[ 13.598544] Total # of labels = 62
[ 13.607911] Initialized fcache state
[ 13.615913] Broadcom Packet Flow Cache Char Driver v4.0 Registered<3002>
[ 13.632759] Created Proc FS /procfs/fcache
[ 13.638932] Broadcom Packet Flow Cache registered with netdev chain
[ 13.651925] Broadcom Packet Flow Cache learning via BLOG enabled.
[ 13.666449] [FHW] pktDbgLvl[0xbf18e504]=0
[ 13.675696] [FHW] fhw_construct:
[ 13.687692] Initialized Fcache HW accelerator layer state
[ 13.702658] flwStatsThread created. numFlwsPerPoll 546 maxFlwIdx 16383
[ 13.723819] Constructed Broadcom Packet Flow Cache v4.0
[ 13.749286] Initialized Runner Host Layer
[ 13.761915] Initialized Runner Unicast Layer
[ 13.769916] Initialized Runner L2 Unicast Layer
[ 13.776997] Initialized Runner Multicast Layer
[ 13.787730] Broadcom Packet Flow Cache HW acceleration enabled.
[ 13.804924] Enabled Runner binding to Flow Cache
[ 13.811985] Initialized Runner Protocol Layer (700)
[ 13.822530] Broadcom Runner Blog Driver Char Driver v0.1 Registered <3009>
[ 13.846715] Runner Port#0 (Internal MUX Port#2) connects to Crossbar Port#1
[ 13.860922] Switch Port#3 (Internal MUX Port#0) connects to Crossbar Port#4
[ 13.875933] Unused MUX Internal Port#1 connects to Crossbar External Port#0
[ 13.891564] Cross Bar MUX Config : Internal Port 00 maps to External Port 04 <reg_val : 0x0000000c>
[ 13.908988] Cross Bar MUX Config : Internal Port 01 maps to External Port 00 <reg_val : 0x00000004>
[ 13.924971] Cross Bar MUX Config : Internal Port 02 maps to External Port 01 <reg_val : 0x00000044>
[ 13.954612] Broadcom BCM63132_B0 Ethernet Network Device v0.1
[ 13.967951] dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered
[ 13.981196] eth0: <Ext sw port: 0> <Logical : 08> PHY_ID <0x0007f008:0x08:Internal PHY> MAC:20:B0:01:C5:AA:0A
[ 14.003110] eth1: <Ext sw port: 1> <Logical : 09> PHY_ID <0x0007f009:0x09:Internal PHY> MAC:20:B0:01:C5:AA:0A
[ 14.023340] eth2: <Ext sw port: 2> <Logical : 10> PHY_ID <0x0007f00a:0x0a:Internal PHY> MAC:20:B0:01:C5:AA:0A
[ 14.045678] eth3: <Ext sw port: 3> <Logical : 11> MAC : 20:B0:01:C5:AA:0A
[ 14.063413] Chip Physical Port 13, Cross Bar Port 4, PHY_ID <0x0007f00b:0x0b:Internal PHY >
[ 14.079585] ++++ disabling GSO on logical_port=0 dev=eth4
[ 14.093189] eth4: <Int sw port: 0> <Logical : 00> MAC : 20:B0:01:C5:AA:0A
[ 14.108984] Chip Physical Port 10, Cross Bar Port 1, PHY_ID <0x0007f04c:0x0c:Internal PHY >
[ 14.132753] Ethernet Auto Power Down and Sleep: Enabled
[ 14.143461] Cross bar port 1 of Int switch port 0; Adv capability change : MII=0x01e1, GMII=0x0f00
[ 14.160936] Ext switch port 0; Adv capability change : MII=0x01e1, GMII=0x0f00
[ 14.174771] Ext switch port 1; Adv capability change : MII=0x01e1, GMII=0x0f00
[ 14.188899] Ext switch port 2; Adv capability change : MII=0x01e1, GMII=0x0f00
[ 14.199404] Cross bar port 4 of Ext switch port 3; Adv capability change : MII=0x01e1, GMII=0x0f00
[ 14.219989] All Port Bit Map: 0x0f01: eth4,eth0,eth1,eth2,eth3
[ 14.235000] Chip WAN Only Ports 0001, Defined WAN Only Ports 0000, WAN Only Port Result: 0x0001:eth4
[ 14.255931] Chip WAN Preffered Ports 0000, Defined WAN Preffered Ports 0000, WAN Preffered Port Result: 0x0000:
[ 14.274942] Chip LAN Only Ports 0f00, Defined LAN Only Ports 0000, LAN Only Port Result: 0x0f00:eth0,eth1,eth2,eth3
[ 14.294565] WAN/LAN Both Capable Ports 0x0000:
[ 14.317482] Created Ethernet Rx queue 4 with size 512, Descriptor base=00c1f000
[ 14.331741] Created Ethernet Rx queue 3 with size 512, Descriptor base=00c22000
[ 14.347098] ===> Activate Deep Green Mode
[ 14.367043] Wifi Forwarding Driver is initialized!
[ 14.475098] Initializing WLCSM Module
[ 14.483943] WLCSM Module loaded successfully
[ 16.762650] --SMP support
[ 16.771903] wl: dsl_tx_pkt_flush_len=338
[ 16.777698] wl: norm_wmark_tot=13462, pktc_wmark_tot=13462
[ 16.794161] wl 0000:01:00.0: enabling device (0140 -> 0142)
[ 16.806302] wl: passivemode=1
[ 16.810420] wl0: creating kthread wl0-kthrd
[ 16.858493] initvars_cis_pci: Not CIS format
[ 16.867133] Neither SPROM nor OTP has valid image
[ 16.873266] wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
[ 16.892046] wl: ID=pci/0/1/0/
[ 16.894604] wl: ID=pci/0/1/0/
[ 16.960920] wl: loading /etc/wlan/bcm43217_map.bin
[ 16.965337] srom rev:8
[ 16.970611] wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=20
[ 17.004802] wl0: allocskbmode=1 currallocskbsz=1024
[ 17.012544] Creating CPU ring for queue number 0 with 1024 packets descriptor=0xbf2137e8
Creating CPU ring for queue number 1 with 1024 packets descriptor=0xbf213804
wfd_bind: Dev wl%d wfd_idx 0 wl_radio_idx 0 Type skb configured WFD thread wfd0-thrd minQId/maxQId (8/9), status (0) qmask 0x3
[ 17.040555] Instantiating WFD 0 thread
[ 17.046134] wfd_registerdevice Successfully registered dev wl0 ifidx 0 wfd_idx 0
[ 17.061927] wl0: Broadcom BCM43227 802.11 Wireless Controller 7.14.170.34.cpe5.02L03.0-kdb
[ 17.074638] dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
[ 17.086018] wl 0001:01:00.0: enabling device (0140 -> 0142)
[ 17.104919] wl: passivemode=1
[ 17.112953] wl1: creating kthread wl1-kthrd
[ 17.151700] initvars_cis_pci: Not CIS format
[ 17.164183] Neither SPROM nor OTP has valid image
[ 17.170914] wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
[ 17.186026] wl: ID=pci/1/1/0/
[ 17.188586] wl: ID=pci/1/1/0/
[ 17.196813] wl: loading /etc/wlan/bcm4360_map.bin
[ 17.207838] srom rev:11
[ 17.217686] wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=20
[ 17.295303] wl1: allocskbmode=1 currallocskbsz=3500
[ 17.325962] Creating CPU ring for queue number 2 with 1024 packets descriptor=0xbf213820
Creating CPU ring for queue number 3 with 1024 packets descriptor=0xbf21383c
wfd_bind: Dev wl%d wfd_idx 1 wl_radio_idx 1 Type skb configured WFD thread wfd1-thrd minQId/maxQId (10/11), status (0) qmask 0xc
[ 17.367897] Instantiating WFD 1 thread
[ 17.387549] wfd_registerdevice Successfully registered dev wl1 ifidx 0 wfd_idx 1
[ 17.404086] wl1: Broadcom BCM4360 802.11 Wireless Controller 7.14.170.34.cpe5.02L03.0-kdb
[ 17.423379] dgasp: kerSysRegisterDyingGaspHandler: wl1 registered
[ 17.535834] bcmxtmcfg: bcmxtmcfg_init entry
[ 17.560142] adsl: adsl_init entry
[ 17.580141] [DSPHAL] dsphal_init: Starting DSPHAL driver.
[ 17.594284] [DSPHAL] dh_get_boardparms: Failed to obtain Voice board id string!
[ 17.594284] *** Please verify that Voice board configuration id is properly set up on the CFE prompt!
[ 17.635574] [DSPHAL] Failed to retrieve VoiceParams, voice hardware is not defined or not present ret: -22

[ 17.670402] [DSPHAL] dsphal_init: Starting DSPHAL driver.
[ 17.683251] [DSPHAL] dh_get_boardparms: Failed to obtain Voice board id string!
[ 17.683251] *** Please verify that Voice board configuration id is properly set up on the CFE prompt!
[ 17.716625] [DSPHAL] Failed to retrieve VoiceParams, voice hardware is not defined or not present ret: -22
kmodloader: failed to load dsphal
[ 17.762735] [SLICSLAC] slicslac_init: Starting SLIC/SLAC driver.
[ 17.780774] [SLICSLAC] ss_get_board_parms: Failed to obtain Voice board id string!
[ 17.780774] *** Please verify that Voice board configuration id is properly set up on the CFE prompt
[ 17.822839] jnl: driver (9.4.4 9.4.4, LBD=ON) loaded at bf797000
[ 17.861725] [SLICSLAC] slicslac_init: Starting SLIC/SLAC driver.
[ 17.876913] [SLICSLAC] ss_get_board_parms: Failed to obtain Voice board id string!
[ 17.876913] *** Please verify that Voice board configuration id is properly set up on the CFE prompt
[ 17.917393] kmodloader: failed to load slicslac
[ 17.946079] ufsd: driver (9.4.4 9.4.4, ioctl, sd2(5), car) loaded at bf822000
[ 17.946079] NTFSJ support included
[ 17.946079] Hfs+ support included
[ 17.993184] usbcore: registered new interface driver cdc_acm
[ 18.004933] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[ 18.027686] usbcore: registered new interface driver cdc_wdm
[ 18.050962] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 18.072021] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 18.663592] nf_conntrack version 0.5.0 (3523 buckets, 14092 max)
[ 18.720182] ctnetlink v0.93: registering with nfnetlink.
[ 18.728896] nf_conntrack_rtsp v0.7 loading
[ 18.798016] nf_nat_rtsp v0.7 loading
[ 18.809760] usbcore: registered new interface driver usblp
[ 18.824273] usbcore: registered new interface driver usbserial
[ 18.860970] xt_time: kernel timezone is -0000
[ 18.867478] usbcore: registered new interface driver cdc_ether
[ 18.876385] usbcore: registered new interface driver cdc_ncm
[ 18.882788] usbcore: registered new interface driver huawei_cdc_ncm
[ 18.899999] usbcore: registered new interface driver qmi_wwan
[ 18.907306] usbcore: registered new interface driver rndis_host
[ 18.915087] usbcore: registered new interface driver sierra
[ 18.921055] usbserial: USB Serial support registered for Sierra USB modem
[ 18.930076] usbcore: registered new interface driver sierra_net
[ 18.943510] usbcore: registered new interface driver option
[ 18.948933] usbserial: USB Serial support registered for GSM modem (1-port)
[ 18.958221] usbcore: registered new interface driver qcserial
[ 18.965024] usbserial: USB Serial support registered for Qualcomm USB modem
[ 18.972428] kmodloader: 2 modules could not be probed
[ 18.977974] kmodloader: - dsphal - 0
[ 18.981193] kmodloader: - slicslac - 0
Note: Loading 6300 MDK (default) driver for 0 chip
Switch MDK: num_switches = 1
[63100] Switch MDK: unit = 1; phy_pbmp = 0xf; config_pbmp = 0xf nophy_pbmp = 0x0
Switch MDK link poll thread: unit=1; phypbmp=0xf config_pbmp=0xf
Checking country codes in /etc/wlan/brcm_country_map_2G (wl0)
Checking E0/778 --> OK
Checking Q1/45 --> OK
Checking AU/919 --> OK
Checking country codes in /etc/wlan/brcm_country_map_5G (wl1)
Checking E0/768 --> OK
Checking Q1/45 --> OK
Checking AU/919 --> OK
Hostapd starting... (1)
Hostapd starting... (2)
`

is the serial bootup string ( not connected )

the serial port does not have a login :-(

@LuKePicci
Copy link

maybe you know already but you-re very close in getting this VBNT-2 rooted, if you are interested we can integrate this model&firmware into https://github.com/hack-technicolor/hack-technicolor
I will tell you how to get a root shell, how to dump firmware decryption keys and how to share a dump of the current firmware in case you have no flashable ones.

@totallytechit
Copy link

Hey @chriscpritchard
I've connected to my brand new DWA0120 and run the commands that you have suggested however I only get this out the output

3651 root 2356 S /usr/sbin/pppd nodetach ipparam wan ifname pppoe-wan

Any ideas what else I can try please?

@totallytechit
Copy link

@chriscpritchard

Oh I tried ps -w and I got this:

2152 root 2356 S /usr/sbin/pppd nodetach ipparam wan ifname pppoe-wan lcp-echo-interval 10 lcp-echo-failure 5 lcp-echo-ada

slightly better but still missing the vital info - I've tried putty, KiTTY and solar-putty, but they all do the same thing...

@mhw
Copy link

mhw commented Feb 1, 2021

@totallytechit top exists, and will print out the full command line for all processes including pppd

@totallytechit
Copy link

@mhw - thats perfect thank you!

@theCrius
Copy link

theCrius commented Feb 9, 2021

@totallytechit top doesn't show anything of the sort. I'm using a, modded I suppose, Technicolor DWA0120 from SSE and have the same issue of @mhw. Both ps and top shows no details. Nevermind, silly me I was missing that the output had a couple lines scrolling above the window, even in full screen.

Quite frustrating also that nothing on hack-technicolor.readthedocs.io mention anything about these model (DWA0120) @LuKePicci. Is there somewhere you can point us out? I'm italian if that helps (I see most of the forum links are for italian broadbands)
I'd like to manage to get access to the root user but can't seem to find something for this model

@LuKePicci
Copy link

LuKePicci commented Feb 9, 2021

I can help you, as I was saying a few posts above here you can easily get root on this firmware. You will need a variant of the current #D strategy. I can explain you how to achive this. Once done, I'll kindly ask you to share your firmware dump and other stuff like firmware download history and firmware decryption keys. I can tell you how to get all of them. @theCrius reach me on Telegram if you like, same nickname.

@theCrius
Copy link

theCrius commented Feb 9, 2021

Gotcha, following up in telegram

@vrbello
Copy link

vrbello commented May 3, 2021

Hello, I dont get see my pppoe passwordas suggested. Please have a look below. Router is DGA4231
PID USER VSZ STAT COMMAND
1 root 2856 S /sbin/procd
2 root 0 SW [kthreadd]
3 root 0 SW [ksoftirqd/0]
5 root 0 SW< [kworker/0:0H]
6 root 0 SW [kworker/u4:0]
7 root 0 SW [rcu_preempt]
8 root 0 SW [rcu_sched]
9 root 0 SW [rcu_bh]
10 root 0 SW [migration/0]
11 root 0 SW [migration/1]
12 root 0 SW [ksoftirqd/1]
14 root 0 SW< [kworker/1:0H]
15 root 0 SW< [khelper]
16 root 0 SW< [netns]
17 root 0 SW< [writeback]
18 root 0 SW [kworker/0:1]
19 root 0 SW< [crypto]
20 root 0 SW< [bioset]
21 root 0 SW< [kblockd]
22 root 0 SW [skb_free_task]
23 root 0 SW [bcmFapDrv]
24 root 0 SWN [kswapd0]
25 root 0 SW [fsnotify_mark]
38 root 0 SW< [kthrotld]
39 root 0 SW [cfinteractive]
40 root 0 SW [kworker/1:1]
41 root 0 SW< [linkwatch]
42 root 0 SW< [ipv6_addrconf]
43 root 0 SW< [deferwq]
44 root 0 SW [kworker/u4:1]
47 root 0 SW< [kworker/1:1H]
48 root 0 SW< [kworker/0:1H]
60 root 0 SWN [jffs2_gcd_mtd2]
181 root 2484 S /sbin/ubusd
230 root 5492 S /usr/sbin/cgrulesengd -n -Q -u root
315 root 0 SW [kbdmf_shell]
354 root 0 SW [spdsvc_timer_th]
368 root 0 SW [bcmxtm_rx]
389 root 0 SW [bcmFlwStatsTask]
412 root 0 SW [bcmsw_rx]
437 root 0 SW [bcmsw]
635 root 0 SW [dhd_watchdog_th]
636 root 0 SW [dhd0_dpc]
637 root 0 SW [wfd0-thrd]
666 root 0 SW [dhd_watchdog_th]
667 root 0 SW [dhd1_dpc]
668 root 0 SW [wfd1-thrd]
955 root 2024 S /usr/sbin/watchdog-tch -c /var/etc/watchdog.conf --f
1235 root 3724 S {status-led-even} /usr/bin/lua /sbin/status-led-even
1239 root 5656 S {ledfw.lua} /usr/bin/lua /sbin/ledfw.lua
1284 root 6532 S /sbin/logd -S 4096
1367 root 19812 S /usr/bin/swmdk
1415 root 2516 S /usr/bin/bcmubusbridge
1437 root 2276 S /usr/bin/dhcpopassthrud
1462 root 6000 S lua /usr/bin/hostmanager.lua
1788 root 5244 S {interceptd} /usr/bin/lua /usr/bin/interceptd
2044 root 57676 S hostapd -bund -p /var/run/hostapd.pid -e /tmp/hostap
2486 root 2828 S /sbin/netifd
2549 root 2824 S < /usr/sbin/conntrackd -C /etc/conntrackd/conntrackd.c
2820 root 5300 S {mobiled.lua} /usr/bin/lua /lib/netifd/mobiled.lua -
2960 root 2436 S /usr/sbin/dropbear -F -P /var/run/dropbear.1.pid -p
3053 root 2564 S /usr/sbin/odhcpd
3102 root 3452 S /usr/sbin/crond -f -c /etc/crontabs -l 5
3242 root 5840 S lua /usr/bin/lcmd
3292 root 32940 S lua /usr/bin/transformer
3407 root 2524 S /usr/bin/dhcpsnooper -q 1
3463 root 6480 S {lte-doctor-logg} /usr/bin/lua /usr/bin/lte-doctor-l
3536 root 2368 S /usr/bin/mcsnooper
3591 root 2528 S /usr/bin/neighmd -m 0x7
3672 root 24624 S /usr/bin/nqnd
3673 root 24604 S /usr/bin/nqcs
3813 root 2056 S xl2tpd -D -l -p /var/run/xl2tpd.pid
3902 root 7056 S {mobiled} /usr/bin/lua /usr/bin/mobiled
4213 root 2948 S /usr/bin/igmpproxy
4378 root 2840 S /usr/bin/mldproxy
4469 root 5492 S nginx: master process /usr/sbin/nginx -c /etc/nginx/
4562 nobody 10336 S nginx: worker process
4608 root 12256 S /usr/sbin/urlfilterd
4734 root 3944 S /usr/sbin/miniupnpd-igdv1 -f /var/etc/miniupnpd-tch.
4802 root 7252 S lua /usr/bin/gre-hotspotd.lua
4864 root 3164 S /usr/sbin/opticald
5006 root 2440 S /usr/bin/fseventd -d
5082 root 3488 S {time_change_mon} /usr/bin/lua /sbin/time_change_mon
5113 root 14448 S /usr/bin/mvfs -o config=/tmp/.mvfs/mvfs.ini /var/mvf
5262 root 38436 S N
/usr/bin/mud -d -t /etc/mud/mud_file_type_config.ini
5289 root 3068 S mmpbxfwctl
5463 root 29924 S /usr/bin/dlnad -f /var/etc/dlnad.conf
6123 root 5288 S lua /usr/sbin/lxc_monitor.lua
6124 root 3044 S lxc-start -F -n lxc_ee
6210 root 2200 S /sbin/mountd -f
6272 root 3156 S {init} /bin/sh /sbin/init
6343 root 5248 S lua /usr/bin/pinholehelper.lua
6428 root 5252 S lua /usr/bin/redirecthelper.lua
9286 root 59620 S /usr/bin/cwmpd
9287 root 5228 S lua /usr/bin/cwmpevents
25626 root 3304 S /usr/sbin/pppd nodetach ipparam wan ifname pppoe-wan
26197 root 2260 S odhcp6c -R -s /lib/netifd/dhcpv6.script -P0 -S -r12
26531 dnsmasq 2788 S /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.dnsmasq -
26537 root 2788 S /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.dnsmasq -
26689 root 3552 S < /usr/sbin/ntpd -n -N -l -S /usr/sbin/ntpd-hotplug -p
26945 root 0 SW [kworker/0:0]
28048 root 0 SW [kworker/1:0]
30729 root 2564 S /usr/sbin/dropbear -F -P /var/run/dropbear.1.pid -p
30770 engineer 6692 S lua /usr/bin/clash
31279 root 0 SW [kworker/u4:2]
31332 root 3024 S sleep 10
31333 root 3324 S sh -c sleep 10
31334 root 3192 S sleep 10
31338 root 3456 R /bin/ps

@vrbello
Copy link

vrbello commented May 3, 2021

My Router is a DGA4231. I tried following your instructions above but no joy to get the pppoe password.. Please see below

PID USER VSZ STAT COMMAND
1 root 2856 S /sbin/procd
2 root 0 SW [kthreadd]
3 root 0 SW [ksoftirqd/0]
5 root 0 SW< [kworker/0:0H]
6 root 0 SW [kworker/u4:0]
7 root 0 SW [rcu_preempt]
8 root 0 SW [rcu_sched]
9 root 0 SW [rcu_bh]
10 root 0 SW [migration/0]
11 root 0 SW [migration/1]
12 root 0 SW [ksoftirqd/1]
14 root 0 SW< [kworker/1:0H]
15 root 0 SW< [khelper]
16 root 0 SW< [netns]
17 root 0 SW< [writeback]
18 root 0 SW [kworker/0:1]
19 root 0 SW< [crypto]
20 root 0 SW< [bioset]
21 root 0 SW< [kblockd]
22 root 0 SW [skb_free_task]
23 root 0 SW [bcmFapDrv]
24 root 0 SWN [kswapd0]
25 root 0 SW [fsnotify_mark]
38 root 0 SW< [kthrotld]
39 root 0 SW [cfinteractive]
40 root 0 SW [kworker/1:1]
41 root 0 SW< [linkwatch]
42 root 0 SW< [ipv6_addrconf]
43 root 0 SW< [deferwq]
44 root 0 SW [kworker/u4:1]
47 root 0 SW< [kworker/1:1H]
48 root 0 SW< [kworker/0:1H]
60 root 0 SWN [jffs2_gcd_mtd2]
181 root 2484 S /sbin/ubusd
230 root 5492 S /usr/sbin/cgrulesengd -n -Q -u root
315 root 0 SW [kbdmf_shell]
354 root 0 SW [spdsvc_timer_th]
368 root 0 SW [bcmxtm_rx]
389 root 0 SW [bcmFlwStatsTask]
412 root 0 SW [bcmsw_rx]
437 root 0 SW [bcmsw]
635 root 0 SW [dhd_watchdog_th]
636 root 0 SW [dhd0_dpc]
637 root 0 SW [wfd0-thrd]
666 root 0 SW [dhd_watchdog_th]
667 root 0 SW [dhd1_dpc]
668 root 0 SW [wfd1-thrd]
955 root 2024 S /usr/sbin/watchdog-tch -c /var/etc/watchdog.conf --f
1235 root 3724 S {status-led-even} /usr/bin/lua /sbin/status-led-even
1239 root 5656 S {ledfw.lua} /usr/bin/lua /sbin/ledfw.lua
1284 root 6532 S /sbin/logd -S 4096
1367 root 19812 S /usr/bin/swmdk
1415 root 2516 S /usr/bin/bcmubusbridge
1437 root 2276 S /usr/bin/dhcpopassthrud
1462 root 6000 S lua /usr/bin/hostmanager.lua
1788 root 5244 S {interceptd} /usr/bin/lua /usr/bin/interceptd
2044 root 57676 S hostapd -bund -p /var/run/hostapd.pid -e /tmp/hostap
2486 root 2828 S /sbin/netifd
2549 root 2824 S < /usr/sbin/conntrackd -C /etc/conntrackd/conntrackd.c
2820 root 5300 S {mobiled.lua} /usr/bin/lua /lib/netifd/mobiled.lua -
2960 root 2436 S /usr/sbin/dropbear -F -P /var/run/dropbear.1.pid -p
3053 root 2564 S /usr/sbin/odhcpd
3102 root 3452 S /usr/sbin/crond -f -c /etc/crontabs -l 5
3242 root 5840 S lua /usr/bin/lcmd
3292 root 32940 S lua /usr/bin/transformer
3407 root 2524 S /usr/bin/dhcpsnooper -q 1
3463 root 6480 S {lte-doctor-logg} /usr/bin/lua /usr/bin/lte-doctor-l
3536 root 2368 S /usr/bin/mcsnooper
3591 root 2528 S /usr/bin/neighmd -m 0x7
3672 root 24624 S /usr/bin/nqnd
3673 root 24604 S /usr/bin/nqcs
3813 root 2056 S xl2tpd -D -l -p /var/run/xl2tpd.pid
3902 root 7056 S {mobiled} /usr/bin/lua /usr/bin/mobiled
4213 root 2948 S /usr/bin/igmpproxy
4378 root 2840 S /usr/bin/mldproxy
4469 root 5492 S nginx: master process /usr/sbin/nginx -c /etc/nginx/
4562 nobody 10336 S nginx: worker process
4608 root 12256 S /usr/sbin/urlfilterd
4734 root 3944 S /usr/sbin/miniupnpd-igdv1 -f /var/etc/miniupnpd-tch.
4802 root 7252 S lua /usr/bin/gre-hotspotd.lua
4864 root 3164 S /usr/sbin/opticald
5006 root 2440 S /usr/bin/fseventd -d
5082 root 3488 S {time_change_mon} /usr/bin/lua /sbin/time_change_mon
5113 root 14448 S /usr/bin/mvfs -o config=/tmp/.mvfs/mvfs.ini /var/mvf
5262 root 38436 S N
/usr/bin/mud -d -t /etc/mud/mud_file_type_config.ini
5289 root 3068 S mmpbxfwctl
5463 root 29924 S /usr/bin/dlnad -f /var/etc/dlnad.conf
6123 root 5288 S lua /usr/sbin/lxc_monitor.lua
6124 root 3044 S lxc-start -F -n lxc_ee
6210 root 2200 S /sbin/mountd -f
6272 root 3156 S {init} /bin/sh /sbin/init
6343 root 5248 S lua /usr/bin/pinholehelper.lua
6428 root 5252 S lua /usr/bin/redirecthelper.lua
9286 root 59620 S /usr/bin/cwmpd
9287 root 5228 S lua /usr/bin/cwmpevents
25626 root 3304 S /usr/sbin/pppd nodetach ipparam wan ifname pppoe-wan
26197 root 2260 S odhcp6c -R -s /lib/netifd/dhcpv6.script -P0 -S -r12
26531 dnsmasq 2788 S /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.dnsmasq -
26537 root 2788 S /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.dnsmasq -
26689 root 3552 S < /usr/sbin/ntpd -n -N -l -S /usr/sbin/ntpd-hotplug -p
26945 root 0 SW [kworker/0:0]
28048 root 0 SW [kworker/1:0]
30729 root 2564 S /usr/sbin/dropbear -F -P /var/run/dropbear.1.pid -p
30770 engineer 6692 S lua /usr/bin/clash
31279 root 0 SW [kworker/u4:2]
31332 root 3024 S sleep 10
31333 root 3324 S sh -c sleep 10
31334 root 3192 S sleep 10
31338 root 3456 R /bin/ps

@jamesmcallister
Copy link

make sure the wan port is plugged in to something, other wise the "pppd" command won't be running

@jatf2
Copy link

jatf2 commented Aug 23, 2023

Thanks! This method works for DGA0122 as well. Use top instead ps command.

@jameslloyd
Copy link

Any idea for the DGA4135?

@levid0s
Copy link

levid0s commented Dec 21, 2023

If the router firmware is based on customzied OpenWRT, you can try:

uci show network.wan.password
uci show network.wan

@vrbello
Copy link

vrbello commented Dec 24, 2023 via email

@nickjwest
Copy link

nickjwest commented Sep 9, 2024

As someone else has said, for the model Technicolour 4135, the password for user 'engineer', is under the sticker on the back of the router. Took me a while to work out, but all good now. I bought a new Router as the Trooli one was blocking outgoing for certain Apps, which can be fixed by setting the Firewall to 'Low', and the wireless was a bit flakey, as well as the switch being very temperamental if it had a hard power down. Good luck!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment