Howto get root via telnet on Vodafone fibre router HG658c

Dermot McDonnell

This works for the latest Vodafone firmware (V100R001C172B218 ) for the HG658c, their standard fibre router. I do not know if the method is compatible with earlier firmware versions.

Telnet is activated by modifying a saved config file. You can save your config by logging in via the GUI:

Username: admin
Password: admin1234

and going to the Maintenance - Device Menu - Configuration File. The file saved is encrypted, to change it, it must be decrypted via this method. A text editor may then be used to edit the file. The edited file must be encrypted, as per the method, so that the Vodafone firmware will validate it. Log in again and restore your personal encrypted config file from the same GUI menu.

Telnet will be available on port 23 once the router has rebooted.

$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
-------------------------------
-----Welcome to ATP Cli------
-------------------------------

Login: !!Huawei
Password: @HuaweiHgw
ATP>shell


BusyBox vv1.9.1 (2014-08-06 10:45:04 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# exit
ATP>exit
quit
Byebye! Have a nice day!
Connection closed by foreign host.

For convenience, I attached below a decrypted default config file from their latest firmware, worth a look if you think you are secure. Also, the edited version of the default config in text form, with telnet and an open wifi AP, HG658c_telnet, configured. Lastly, the encrypted version of the latter is here - Boards.ie prefers not to take it. Upload this last file if you wish to save time and effort. Remember to save your existing config first, your settings will be overwritten but VDSL etc will work by default.

Edit: Access to the config files attached is a problems at the moment, you can get the default config as a text here and the config, modified for telnet and and open wifi AP, here.

jt72

Excellent! Thanks for the post!