Table of Contents
This is a Fastweb (italian ISP) router with voip and usb port
Get a shell
- enable telnet server (via web interface)
- connect via telnet to your device using web interface credentials
- type the undocumented “sh” command
- enjoy your root shell!
Official firmware releases
Latest device was shipped with the very old 220.127.116.11 Linux kernel WITHOUT swap support. Swap support can't be compiled as module so you should be careful with memory usage.
For some strange reason in VoIP configuration the option “Interface name” must be the internal lan, not wan.- Fixed in latest firmware revision (3.7.130V-sip) Some phones doesn't show caller-id- Fixed in latest firmware revision (3.7.130V-sip)
- If you activate telnet on wan interface the service is reachable over this interface but the router won't accept admin credential
- telnet capabilities was limited, ncurses based application and others could works bad.
OpenWRT porting was done for a similar model that differ only for half size ram and flash. FXS/FXO ports are not working on OpenWRT (to be verified). I prefer keep the original firmware and extend its functionality.
- Download latest busybox for mips
- Download a brcm63xx generic jffs2-128k image (backfire link)
- Mount it on your computer (take a look in how-to section on Linux page) and copy contents making a tar archive to preserve permissions
- Unpack rootfs and move busybox on the drive to be attached to your Telsey
- Eject drive from your computer and attach it to your Telsey
- Login via telnet and enter in root shell
- Copy system files and bind system folders inside chroot
CHROOTDIR=/var/udev/mount/NASusbsda/openwrt_backfire cp /etc/hosts $CHROOTDIR/etc/hosts cp /etc/fstab $CHROOTDIR/etc/fstab cp /etc/resolv.conf $CHROOTDIR/etc/resolv.conf mount -o bind /proc $CHROOTDIR/proc mount -o bind /dev $CHROOTDIR/dev mount -o bind /var/udev/mount/NASusbsda $CHROOTDIR/mnt/NASusbsda
- Make a “boot” script to set right variables inside chroot
vi $CHROOTDIR/root/startchroot (paste this inside) #!/bin/sh source /etc/profile /bin/sh
./busybox-mips chroot $CHROOTDIR /root/startchroot
- DEL - ONLY in bash it print a ~ without delete characters, however it works fine in vi
- ENTER - ONLY in nano I can't confirm the filename when saving
Somethings works but for example reading log cause a system crash
SSH accepts commands but can't open a remote shell, so you can use direct commands in this way:
ssh root@Telsey "touch /tmp/thisworks"
or use rsync. This issue is related with the kernel that miss /dev/pts filesystem (and can't be fixed using a module)
DNS and hosts
Be sure that your /etc/resolv.conf contains a working DNS server /etc/hosts is not read when a DNS resolution is in progress so you can't specify a particular ip for a name or use localhost instead of 127.0.0.1
- Pegasus (usb-ethernet driver) kernel module - Available soon!
- Alsa+USB Soundcards kernel modules - Available soon!