[NEW] Orange "Bright Box" router hacking :-)

Just registered after installing the Brightbox router. It is really good and thanks to UNLOCKIA for providing deep insight into the settings

It would be greate to get DLNA support so that I can see the USB connected storage on my Music system. I had an IOMEGA box earlier which was visible on DLNA devices, but this one is not...any ideas on what could be done?

Also, should the default MTU be reduced from 1492 for greater speed?

I also noticed that the UPnP deviced when detected and "Invoked" on Windows Networks points to ":5438/" which errors - why would that happen?

questions:
=========

1/ Does anyone here own this router yet (apart from me)?
2/ Does anyone here want to help hack this router, with me?

This thread has had almost 1,500 views, and almost no replies. I am not complaining that people are taking an interest, but I would appreciate some help with my investigations, should you wish to do so.

SO many views, and so few replies is a little odd...

Thanks

Originally Posted by unlokia

Hi,
I got sent one of these routers by orange to replace the POS DGN1000 they kept sending me. It worked for 3 days before my oh pulled the plug out of the wall, doing so reset the thing to factory default and the wifi no longer works, it is all showing up right and all the settings are right but nothing can connect to it.

Anyway, just a word of warning there. Orange are replacing mine so let the hacking commence.

I had a quick look inside, dont have magnifier handy but looks like an eeprom chip inside along side pads for various other flash chip options, iguess they are useing the flash mem inside the main cpu and a small eeprom but left themselves open to adding larger external flash, i wonder if the firmware is capeable of recognising it if a tssop flash chip was added where the space is left on the board, would give us more space to play with for software.

Going to have to dump the eeprom at some point and try soldering a flash chip on, see if it is recognised. First thing im going to do though is add some more power supply filtering to the empty board spaces, might help avoid the thing loosing settings when it has been hard reset.

Also looks like they left themselves open to change antena config, there are pads on the board for more pigtails, maybe a version with external antennas was planned?

Owen

Hi

I wonder if you would be able to explain why I am having the following issue with the Orange BrightBox router.

I have the BrightBox connected to the internet at one side of my house and a Netgear DGN2000 at the other connected via a pair of ethernet over mains adaptors. The BrightBox has DHCP and NAT enabled the DGN2000 has a fixed IP address.

When I roam between the two the internet works perfectly but anything like my print server with a fixed IP address is not visible to the roaming laptop for around 3 to 4 minutes when I am in range of the BrightBox then suddenly I can ping it.

The BrightBox only shows attached devices that it has given an IP address to but never shows the static IP addresses.

Hoping someone can tell me how to fix this as it has been driving me mad for the last fortnight.

Cheers

Paul

Wow. I thought these things sold for MUCH more. Some dude has a Bright Box (new) on eBay with a current bid of £6.07, with only 12 hours left... AND NO RESERVE.

Should I buy it? Would you? Cheap enough for research:

http://www.ebay.co.uk/itm/Orange-Bri...item3cc25ad1b8

Wow. I thought these things sold for MUCH more. Some dude has a Bright Box (new) on eBay with a current bid of £6.07, with only 12 hours left... AND NO RESERVE.

Should I buy it? Would you? Cheap enough for research:

http://www.ebay.co.uk/itm/Orange-Bri...item3cc25ad1b8

Originally Posted by unlokia

I would if i didnt already have one.

Just registered after installing the Brightbox router. It is really good and thanks to UNLOCKIA for providing deep insight into the settings

It would be greate to get DLNA support so that I can see the USB connected storage on my Music system. I had an IOMEGA box earlier which was visible on DLNA devices, but this one is not...any ideas on what could be done?

Also, should the default MTU be reduced from 1492 for greater speed?

I also noticed that the UPnP deviced when detected and "Invoked" on Windows Networks points to ":5438/" which errors - why would that happen?

Originally Posted by nandugn

DLNA support should be pretty easy, i have been really slack but ill have to open mine up again tonight and have a play.

Great work, Unlokia.

I have one of these, but can't afford to mess with it too much as it's giving me great service compared to the total junk Netgear DGN1000 I had before.

I'll look into getting another as an experimental box via eBay, and consider cracking it open, if there are worthwhile adaptations which can be made.

Like another poster in thread, it would be fantastic to have a firmware to flash this with containing the stock orange build plus SSH, so that I can get some simple extras running on the box, especially with that handy USB port connected.

It would be great to have some kind of scripting environment and serially connect an Arduino for some kind of always-on sensor behaviours, for example. I don't know whether python plus the FTDI USB serial driver would be feasible.

Thanks for all the effort and expertise you're committing to this.

Hello

Ive got an Orange Brightbox router but my internet provider is Tesco, and I was wondering if and how I can use this router with my current internet.

Using / in internet explorer I was able to access the broadband settings using the brightbox router. However when trying to change the broadband settings etc to my tesco password and username it didnt accept it. Im at loss and not sure what to do and why this is happening.

I am also a novice re. hacking and do not understand this hacking process at all. So a simplified version and or a crack like you use in games would be helpful.

Thanks for any help with this.

Regards

Linda

Hi All,

Here's a question you intelligent people may know the answer and assist me with. I'm also using the orange Brightbox, finding it quite fast compared to the previous Livebox. I've allowed one of the lodgers access to my internet service FOC, not wishing to appear "tight" I've noticed they are on it downloading 24/7 (hopefully not pirate films/videos) this is reducing the access speed I can use, even though I'm not there very much.

Is there any way to allow them continued access whilst say throttling their connection so I can have some decent speed myself. I am reasonably familiar within the set up pages. Aslo what all the different configurations mean I'm slightly at a loss, so if it is fairly straightforward wonderful.

Thanks in advance guys.....

Use OpenDNS to block access to file sharing sites, that's if you can manually set the DNS in the Brightbox

Patioheater,

Thank you for reply, I will look into the settings deeper and take it from there, I guess there must be 1,000's of sites requiring blocking so probably out of the question. As I've never used any of these I would need to find what the names are etc.

Any help on how to alter the DNS settings if I locate this facility?

Again thanks in advance, enjoy your Easter break .....

You don't need to block them individually. The OpenDNS site has clear instructions on how to set it up in your router

I've been following your progress over the past month or two after receiving my own BrightBox. Although have done nothing to mine since it's the only one I have.

However, after searching for links between the information you (Unlockia) had posted, and Open-WRT, it appears that someone in Spain has been hacking a router very similar to ours, and has Open-WRT running.

(You might need to translate the page, unless you are familiar with Spanish).
http://foro.seguridadwireless.net/op...de-telefonica/

Maybe the user "gmtii", from that thread, has some ideas on how to port Open-WRT to our router.

Hope this is of help.

Hi All,

Here's a question you intelligent people may know the answer and assist me with. I'm also using the orange Brightbox, finding it quite fast compared to the previous Livebox. I've allowed one of the lodgers access to my internet service FOC, not wishing to appear "tight" I've noticed they are on it downloading 24/7 (hopefully not pirate films/videos) this is reducing the access speed I can use, even though I'm not there very much.

Is there any way to allow them continued access whilst say throttling their connection so I can have some decent speed myself. I am reasonably familiar within the set up pages. Aslo what all the different configurations mean I'm slightly at a loss, so if it is fairly straightforward wonderful.

Thanks in advance guys.....

Originally Posted by grandan

You turn on QOS first, then throttle WiFi here:

I've been looking for unlocked firmware for the Orange Brightox Wireless Router by Astoria Networks. If anyone can help please let me know

be interested in any developments on getting a custom firmware for this Brightbox.

I really need to get loopback somehow enabled on my router.
When i am browsing the net on my mobile and want to access various sources on my network, using WAN addresses, i cant access them
Need loopback!!!!

Hi guys! Just a quick pop by to say that if you think my work is worth doing so, would you maybe make a small contribution via PayPal? I am unemployed, literally totally skint (£2 to my name!) and if you would like to see future hacks and projects etc, posted at more frequent intervals, I know I would be extremely grateful for anything you send... even if it's only 25p! :-)

God bless you. Here is my donations link (No obligations!):

https://www.paypal.com/cgi-bin/websc...if%3aNonHosted

Hi there,
Question for unlokia: is there a away of allowing a different user name to the one dictated by orange (ended by @fs) without having to hack the firmware. is this check done at the webpage level?
Regards
Papi

Hi there,
Question for unlokia: is there a away of allowing a different user name to the one dictated by orange (ended by @fs) without having to hack the firmware. is this check done at the webpage level?
Regards
Papi

Originally Posted by Papi

Hi. Sorry for the long wait, I have not been here much (as you can see). You can put in any username you wish, although I am unsure if the Bright Box is ISP locked, as yet. You just need to go into advanced settings and change it.


### HACKING UPDATE ###

I posted a thread about the Bright Box MONTHS ago, here:

http://www.psidoc.com/showthread.php...cking-a-router

and I have recently found a reply...

The embedded webserver is mini-httpd by Jef Poskanzer. He released the source code for the daemon under a *BSD "do-as-you-please" licence [1] There is an extension to mini-httpd support server-side scripting. The scripts are very primitive - being pretty much limited to a single function call within the delimiters <% and %> These are vaguely similar to JSP/ASP.

As you've discovered, the server-side script functions are actually compiled into the binary of the httpd daemon.

The special symbols <% and %> are used to show where a server-side script function starts and ends. In between the <% and the %> is the function name, and the parameters to the function. Here's one example from your zip, in the resource cgi/cgi_dsl_status.js.. It's entwined with Javascript..

var up_data_rate='<% CFG_GET(ADSL_UP_RATE); %>';

The server-side script function is CFG_GET and it has a single parameter ADSL_UP_RATE, probably an enumeration.

The web server has a script parsing engine. A resource (e.g. cgi_dsl_status.js) is requested through an HTTP GET or POST request. The http server retrieves the resource from the local file system in the device. The resource is passed to the scripting engine for parsing. When the engine encounters those special symbols <% and %>, it invokes by name the function contained within the symbols. The return value from the function is substituted in the resource, and only then is the resource served up to the requestor.

That substitution would do something like this (where 1284 kbps is the upstream data rate obtained from the xdsl kernel driver):

var up_data_rate= '1284';

It's often possible to exploit this so that the web server will "execute arbitrary code". It's basically a cross-site scripting vulnerability. There's a glaring hole in the security of many of these Broadcom-based routers. Briefly, if the GUI has a web page where you can run a test that pings an IP address, it's sometimes possible to modify the URL so that instead of executing the ping command, it will execute whatever command you want. You could do all manner of nasties.. overwrite the nameserver settings etc..

Many of the server-side script functions work indirectly by invoking queries to a middleware server running on the device. That server retrieves the requested info from the relevant source, e.g. with requests for XDSL layer data, these will be obtained by way of an ioctl() call to the xdsl kernel driver. [2]

I've had a brief look through the static web resources for your device and can't immediately see any obvious holes that could be used to execute an arbitrary command, e.g. telnetd. That's not to say there aren't any holes though!

If there are any server-side scripts which execve() an arbitrary binary in the embedded file system (such as to test ping an IP address), then you can theoretically exploit that. [3] For example, you could temporarily re-mount your own file over the top of that binary or shell script to ensure that it is invoked instead. [4]

cheers, a

[1] http://www.acme.com/software/mini_httpd/
[2] http://huaweihg612hacking.wordpress....tenuation-bug/
[3] http://linux.die.net/man/2/execve
[4] http://fermilinux.fnal.gov/documenta...nt-bind-chroot

Thanks Unlokia,
I guess I will have to make a cable and start playing with it.
Regards
Papi

Thanks Unlokia,
I guess I will have to make a cable and start playing with it.
Regards
Papi

Originally Posted by Papi

You are very welcome. God bless you

### UPDATE ###

I am going to attempt to find the JTAG pin-outs this weekend, so keep your eyes on this thread for a few more photos and some updated info.

Sorry that the links are down, guys. I have re-uploaded a ZIP file containing all the rips, web UI, partition backups and some photos. I had *thought* I had accidentally deleted all this when I formatted my Windows 7 partition to re-install it... but then I remembered I did all this within Ubuntu, so it's safe

https://rapidshare.com/files/1026176...ightBoxRip.zip <---- download here

Remember guys: If you want to login to the Bright Box over the serial port, the parameters are 115,200 baud, 8N1:

Pin-out
~~~~~



Appeal: I don't mind doing any of this hacking; in fact, I LOVE doing it. As I am unemployed with zero income right now, if anyone would consider making as small a donation as they would like, OR if you could donate hardware, such as spare Bright Box routers/other routers, I would humbly and most gratefully accept them. I would like people to know that I am not your usual, brash "BUY ME A BEER - CLICK HERE--->" type person; I do NOT expect financial reward for my work - I love hacking, and NOONE must feel guilty for not donating - I am a Christian, and I believe that guilt is wrong.

Let's make it simple - if you would *like* to donate, click: https://www.paypal.com/cgi-bin/websc...if%3aNonHosted - but I definitely will not be offended if noone does.

Thank you guys!

Update:

To those hacking the Bright Box, the root prompt is constantly interrupted by an sntp network time protocol command/service. You can kill ALL processes except those in your session login, ergo preventing this annoying distraction, by using:

killall5

That will silence it

I've recently moved from Orange Broadband to Tesco Broadband, and find the Thomson GT580 that they gave me to be rather unsatisfactory. Its signal strength is pitiful when compared to the Brightbox and its a horrible device to tweak network settings.

Im ranked somewhere below "noob" when it comes to hacking firmware, but using unlokia's BrightBoxRip (quoted at the bottom, THANKS!) I've found the script where Orange have stopped us from using a username that doesnt end in "@fs" etc

Its part of the CGI script cgi_atmint.js located in www\cgi

I figured I could just tweak this to include my "@tescobb.com" domain so that it deems at as a valid username, or possible even take out this check all together. However, Im not sure how unlokia was able to retrieve this rip, so I dont know how to upload a modified script back up to the router.

Im willing (and hopefull capable) to follow instructions given and prepared to take my Brightbox apart, safely, to make it more usable. Any help or advise would be great!

https://rapidshare.com/files/1026176...ightBoxRip.zip <---- download here

Originally Posted by unlokia

I've recently moved from Orange Broadband to Tesco Broadband, and find the Thomson GT580 that they gave me to be rather unsatisfactory. Its signal strength is pitiful when compared to the Brightbox and its a horrible device to tweak network settings.

Im ranked somewhere below "noob" when it comes to hacking firmware, but using unlokia's BrightBoxRip (quoted at the bottom, THANKS!) I've found the script where Orange have stopped us from using a username that doesnt end in "@fs" etc

Its part of the CGI script cgi_atmint.js located in www\cgi

I figured I could just tweak this to include my "@tescobb.com" domain so that it deems at as a valid username, or possible even take out this check all together. However, Im not sure how unlokia was able to retrieve this rip, so I dont know how to upload a modified script back up to the router.

Im willing (and hopefull capable) to follow instructions given and prepared to take my Brightbox apart, safely, to make it more usable. Any help or advise would be great!

Originally Posted by NSF12345

Hi

You won't be able to upload a modified script back to the BBox, as the filesystem in /www is "ro" (read only) as it's "squashfs".

I ripped the bright box contents very easily:

1/ You need to access the serial port INSIDE the Bright Box, with a USB to Serial adaptor or other COM port interface (I think the Bright Box serial levels are 3v).

2/ You need a USB flash drive formatted in FAT32 or NTFS, or a USB hard disk, plugged into the USB port on the bright box.

3/ With the drive plugged in, boot the Bright Box and you will see the boot sequence on whatever serial terminal you are using (it's 115,200 baud, 8N1).

4/ Once the Bright Box has booted (give it 3 mins to be sure), in the command prompt (the serial console), type (only the red parts):

root@BrightBox:/ # killall5

Find out the name of your drive, by doing:

root@BrightBox:/ # ls /mnt

Mine is "usb1_1"

Next, copy ALL the "/www" folder to the flash drive/hard drive by doing:

root@BrightBox:/ # cp -R /www/* /mnt/usb1_1/

Next, power off the Bright Box, remove the drive, and plug it into a PC. You'll see the following directory listing:

3g.htm loginduperr.htm system_info.htm
3g_conn.xml loginerr.htm system_main.htm
3g_pincode.htm md5.js system_p.htm
accessControlAdd.htm menu.js system_r.htm
adsl.htm menulist.js system_t.htm
atmint.htm nas_addUser.htm tl.htm
atmint1.htm nas_admin.htm tools_backup.htm
atmpvc.htm nat.htm tools_restore.htm
cgi nat.js top.htm
cpe nat_m.htm top_conn.xml
data.js nat_show.htm u132xzp32aai.htm
ddns_main.htm nat_sp.htm upnp_main.htm
do_cmd.htm nat_v.htm usb.htm
dsl_status.htm pvc_tb.htm usb_basic.htm
firewall_a.htm qos_addrule.htm usb_sharedFolder.htm
firewall_d.htm qos_diffserv.htm wait.htm
firewall_mac.htm qos_main.htm wireless_1X.htm
firewall_main.htm qos_traffic_map.htm wireless_WPS.htm
firewall_rule.htm qos_wifi.htm wireless_advance.htm
firewall_rule_a.htm qos_wmm.htm wireless_bmain.htm
firewall_spi_h.htm routine.js wireless_e.htm
firewall_u.htm security_log.htm wireless_id.htm
global.js setup_dns.htm wireless_mac.htm
help.htm status.htm wireless_main.htm
hsakjsd status_conn.xml wireless_wep.htm
images styles_orange.css wireless_wpa.htm
index.htm subformvar.js wps_status.xml
lan.htm system_adv.htm xc324m12sdlo.htm
lan_addRev.htm system_c.htm yds32u872vld.htm
lan_dhcp.htm system_d.htm z983erv3210ba.htm
lang system_f.htm
login.htm system_fw.htm

Hey Unlokia,

First of all, thank you so much for all the work you've done on this box so far!

Do you know if it's possible to get access to the ARP table via telnet and add a static ARP entry in order to make WOL work from the internet?

Hey Unlokia,

First of all, thank you so much for all the work you've done on this box so far!

Do you know if it's possible to get access to the ARP table via telnet and add a static ARP entry in order to make WOL work from the internet?

Originally Posted by Admin0389

Uhmmm, EH? lol.

Uhmmm, EH? lol.

Originally Posted by unlokia

Sorry,

Right, WOL or Wake On LAN is used to turn a machine on from cold. Obviously the machine has no IP addresses but is still connected to the network. The only way to differentiate it from other machines is it's MAC address.

The ARP table is used by routers to link hardware addresses or MAC addresses to IP addresses. This allows a message bound for an IP Address arrive at its target even if the target doesn't have an IP address.

Unfortunately most routers rebuild the ARP table every so often so you need to add a static entry. So whenever anything arrives for 192.168.0.10 the router always directs it to the same end point, regardless of the end points current status.

You gained access to telnet earlier in your exploration, were you able to make it give you a list of commands? Does it recognise the command "arp"?

Thanks Unlokia

Sorry,

Right, WOL or Wake On LAN is used to turn a machine on from cold. Obviously the machine has no IP addresses but is still connected to the network. The only way to differentiate it from other machines is it's MAC address.

The ARP table is used by routers to link hardware addresses or MAC addresses to IP addresses. This allows a message bound for an IP Address arrive at its target even if the target doesn't have an IP address.

Unfortunately most routers rebuild the ARP table every so often so you need to add a static entry. So whenever anything arrives for 192.168.0.10 the router always directs it to the same end point, regardless of the end points current status.

You gained access to telnet earlier in your exploration, were you able to make it give you a list of commands? Does it recognise the command "arp"?

Thanks Unlokia

Originally Posted by Admin0389

I've no idea - why not give it a go! :-)