Based on https://github.com/gediz/trivial-tools-n-scripts/blob/master/superbox-hacks/v1-login-and-fetch-sms/poc.sh , adapted version for ZTE MF79, also added IP reset function. Also check orig blog post https://blog.aydindogm.us/posts/superbox-hacks-v1/

zte_MF79_helper.sh

#!/bin/bash

_usage() {
if [ $# -lt 3 ]; then
    echo "Usage: $0 user_id user_pw router_ip action"
    printf "\n"
    echo "Example: $0 admin p455w0rd 192.168.1.1 <list_sms|reset_ip>"
    exit 1
fi
}

epoch() {
    date +%s%3N
}

get_cmd() {
    curl -s -H "$HEADER_REF" "$URL_GET_CMD&cmd=$1" \
        | jq -r ".$1"
}

hex_to_utf8() {
    echo "$1" \
        | perl -CS -pe 's/[0-9A-F]{4}/chr(hex($&))/egi'

    # if [ $? -eq 0 ]; then
    #     echo "$DECODED"
    # else
    #     echo "$1"
    # fi
}

parse_date() {
    local year=${1:0:2}
    local month=${1:3:2}
    local day=${1:6:2}
    local hour=${1:9:2}
    local minute=${1:12:2}
    local second=${1:15:2}

    year=$((year + 2000))

    echo "$day.$month.$year $hour:$minute:$second"
}

    _set_AD() {
    echo "=setting AD"
    # get RD
    RD=$(get_cmd "RD")
    # get rd0 a.k.a. rd_params0 a.k.a. wa_inner_version
    rd0=$(get_cmd "wa_inner_version")
    # get rd1 a.k.a. rd_params1 a.k.a. cr_version
    rd1=$(get_cmd "cr_version")

    # compose AD with following formula: AD = md5(md5(rd0+rd1)+RD)
    MD5_rd=$(echo -n "$rd0$rd1" \
        | md5sum \
        | awk '{print $1}')

    AD=$(echo -n "$MD5_rd$RD" \
        | md5sum \
        | awk '{print $1}')

    echo RD=$RD rd0=$rd0 rd1=$rd1 AD=$AD 
    }

_auth() {

    URL_GET_CMD="http://$ROUTER_IP/goform/goform_get_cmd_process?isTest=false&_=$(epoch)"
    URL_SET_CMD="http://$ROUTER_IP/goform/goform_set_cmd_process"

    HEADER_REF="Referer: http://$ROUTER_IP/index.html"


    PATH_COOKIE_FILE=$(mktemp --suffix .superbox-cookie)

    HEADER_CONTENT_TYPE="Content-Type: application/x-www-form-urlencoded; charset=UTF-8"
    USER_PW_BASE64=$(echo -n "$USER_PW_PLAIN" | base64)
    #LOGIN_PARAMS="isTest=false&goformId=LOGIN_MULTI_USER&user=$USER_ID&password=$USER_PW_BASE64&AD=$AD"
    #LOGIN_PARAMS='isTest=false&goformId=LOGIN&password=YWRtaW4%3D'
    LOGIN_PARAMS="isTest=false&goformId=LOGIN&password=$USER_PW_BASE64"

    LOGIN_RESULT=$(curl -s -c "$PATH_COOKIE_FILE" -H "$HEADER_REF" -H "$HEADER_CONTENT_TYPE" -d "$LOGIN_PARAMS" "$URL_SET_CMD" | jq -r ".result")

    LOGIN_COOKIE=$(grep stok "$PATH_COOKIE_FILE" | awk '{print $7}')
    COOKIE_PARAM="Cookie: stok=$LOGIN_COOKIE"
    #cat "$PATH_COOKIE_FILE"
    rm "$PATH_COOKIE_FILE"

    
    echo LOGIN_COOKIE=$LOGIN_COOKIE
    # Possible values for LOGIN_RESULT (found by trial and error, not confirmed)
    # null: invalid json key
    # failure: missing POST parameter
    # 1: wrong credentials
    # 0: success

    if [ "$LOGIN_RESULT" = 0 ]; then
        echo "Successfully logged in."
    elif [ "$LOGIN_RESULT" = 1 ]; then
        echo "Invalid login credentials."
        exit 1
    else
        echo "Unknown error occurred."
        echo "LOGIN_RESULT: $LOGIN_RESULT"
        exit 1
    fi

    # Query a CMD that requires AUTH.

    TEST_CMD=WPAPSK1
    TEST_RETRIEVE=$(curl -s -H "$HEADER_REF" -H "$COOKIE_PARAM" "$URL_GET_CMD&cmd=$TEST_CMD" | jq -r ".$TEST_CMD")

    echo -n "Data retrieve test: "
    if [ -n "$TEST_RETRIEVE" ]; then
        echo "Success"
    else
        echo "Fail"
    fi


    }

_reset_ip() {

    _auth
echo "= Data off"
_set_AD ; curl -Ss "$URL_SET_CMD" -d "isTest=false&notCallback=true&goformId=DISCONNECT_NETWORK&AD=$AD" -H "$HEADER_REF" -H "$COOKIE_PARAM"  
echo
sleep 2

sleep 2
echo "= 3g"
_set_AD ; curl -Ss "$URL_SET_CMD" -H "$HEADER_REF" -H "$COOKIE_PARAM" -d "isTest=false&goformId=SET_BEARER_PREFERENCE&BearerPreference=Only_WCDMA&AD=$AD" 
echo


sleep 2
echo "= Auto"
_set_AD ; curl -Ss "$URL_SET_CMD" -H "$HEADER_REF" -H "$COOKIE_PARAM" -d "isTest=false&goformId=SET_BEARER_PREFERENCE&BearerPreference=NETWORK_auto&AD=$AD"
echo

for i in 1 2
do
echo "= Data on $i"
_set_AD ; curl -Ss "$URL_SET_CMD" -d "isTest=false&notCallback=true&goformId=CONNECT_NETWORK&AD=$AD" -H "$HEADER_REF" -H "$COOKIE_PARAM"
echo
sleep 2
done

}


_list_sms() {
    _auth
    QUERY_SMS="sms_data_total&page=0&data_per_page=500&mem_store=1&tags=10&order_by=order+by+id+desc"

    MSG_RESPONSE="$(curl -s -H "$HEADER_REF" -H "$COOKIE_PARAM" "$URL_GET_CMD&cmd=$QUERY_SMS")"

    echo "Fetch messages..."
    echo "-----------------"

    # Some contacts include "space" in their name. If we do not ignore "space",
    # it would be split apart into multiple lines.
    IFS=$'\n'
    for msg in $(echo "$MSG_RESPONSE" | jq -c '.messages | .[]'); do
        # echo "$msg"
        MSG_ID="$(echo "$msg" | jq -r '.id')"
        MSG_NUMBER="$(echo "$msg" | jq -r '.number')"
        MSG_DATE_RAW="$(echo "$msg" | jq -r '.date')"
        MSG_TEXT_RAW="$(echo "$msg" | jq -r '.content')"

        MSG_DATE=$(parse_date "$MSG_DATE_RAW")
        MSG_TEXT=$(hex_to_utf8 "$MSG_TEXT_RAW")

        printf "[%3d] %s | %s\n" "$MSG_ID" "$MSG_NUMBER" "$MSG_DATE"
        echo "- - - - - - - - - - - - - - - - - - - - - - -"
        echo "$MSG_TEXT"
        # echo "$MSG_TEXT_RAW"
        # echo "$MSG_TEXT_RAW" | xxd -ps -r
        printf "\n"
    done
}

main() {
    # Let's skip input validation and sanitization for now.
    USER_ID="$1"
    USER_PW_PLAIN="$2"
    ROUTER_IP="$3"
    ACTION="$4"

    case $ACTION in
    reset_ip) _reset_ip ;;
    list_sms) _list_sms ;;
    *)      echo unknown call 
            _usage ;;
    esac 
}

main "$@"

exit 0