diff options
Diffstat (limited to '_ont/ont-zte-f601.md')
| -rw-r--r-- | _ont/ont-zte-f601.md | 77 |
1 files changed, 76 insertions, 1 deletions
diff --git a/_ont/ont-zte-f601.md b/_ont/ont-zte-f601.md index 35c9e7d..cba66a2 100644 --- a/_ont/ont-zte-f601.md +++ b/_ont/ont-zte-f601.md @@ -23,7 +23,7 @@ parent: ZTE | IP address | 192.168.1.1 | 192.168.1.1 | 192.168.1.1 | | | Web Gui | ✅ user `admin`, password `admin` or user `user`, password `user` | ✅ user `admin`, password `admin` or user `user`, password `user` | | | | SSH | | | | | -| Telnet | | | | | +| Telnet | ✅ credentials are random generated by zte_factroymode.py, doesn't survive at reboot | ✅ credentials are random generated by zte_factroymode.py, doesn't survive at reboot | | | | Serial | ✅ | ✅ | | | | Form Factor | ONT | ONT | ONT | ONT | @@ -69,9 +69,81 @@ upgradetest switchver X Where `X` can be `0/1` based on the image you want to boot. + +You can also clone currently running image into other slot using this command: + +```sh +syn_version +``` + +ZTE has create various region code that loads default valuse based on local ISP, this configuration can be changed using this command: + +```sh +upgradetest sfactoryconf X +``` + +Where X is the number of supported regioncode into file `/etc/init.d/regioncode`, here is an example from TIM `V6.0.10N40` firmare: + +```sh +# cat /etc/init.d/regioncode +2:Lithuania +15:Portugal +17:TelMex +19:Turkey +32:JazzTel +38:Czechia +54:Viettel +59:SeteTec +63:Ais +88:GerNetCologne +97:ItalyTI +104:IndiaRJIO +110:IndiaGTPL +112:BrazilTIM +115:ItalyOpenFiber +116:ItalyTescali +118:PolandINEA +139:MultiLaser +198:Manufacture +``` + # General Settings and Useful Commands {% include alert.html content="Commands have been tested on V6/V7 HW rev on TIM and OF firmware" alert="Note" icon="svg-info" color="blue" %} +## Enable Telnet +{% include alert.html content="This is an external script, so use at your own risk! Credential doesn't survive at reboot!" alert="Note" icon="svg-info" color="blue" %} + +```sh +python3 zte_factroymode.py --user admin --pass admin --ip 192.168.1.1 --port 80 telnet open +``` + +You should get this output and credentials to login over telnet: + +```sh +trying user:"admin" pass:"admin" +reset facTelnetSteps: +reset OK! + +facStep 1: +OK! + +facStep 2: +OK! + +facStep 3: +OK! + +facStep 4: +OK! + +facStep 5: +OK! + +done +Username: 2W3iqFVt +Password: Eqb8X8Qt +``` + ## Changing the ONT's S/N {% include alert.html content="You have to change S/N and the VID. 2176 is for the VID (first 4 letters of the S/N) and 2177 is for the last 8 digits" alert="Note" icon="svg-info" color="blue" %} ```sh @@ -129,6 +201,8 @@ MIB INFO: ``` # Random notes +- F601v6/v7 read the software version exposed thru gpon_omci deamon from each kernel partition's header, so only way to spoof this parameter is to change the version in the header and recalculate CRC, otherwise bootloader refuse to load image +- F601v6 from TIM line use HWVer `VDF`, this can be changed back to `V6.0` issuing this command on telnet session: `setmac 1 32770 3` - The F601v7 is mounted 'upside down' to save on waveguides, the LEDs would be on the bottom of the PCB, so it would have to be turned upside down to make it cooler... - The F601v6 turns on and runs even with 9V input - The F601v7 turns on and runs even with 5V input @@ -138,6 +212,7 @@ MIB INFO: - [ZTE config.bin decoder](https://github.com/mkst/zte-config-utility) - [Usource GPON ONU STICK](https://www.usourcetech.com/web/userfiles/download/GPONSTICKSFPCLASSB-2B_Rev01.pdf) - [GPON module Dfp-34g-2c2 sfp](https://forum.openwrt.org/t/gpon-module-dfp-34g-2c2-sfp/51641) +- [ZTE Telnet enabled](https://github.com/douniwan5788/zte_modem_tools) # Theardown and other photos |