Hacker's ramblings

As I have promised a number of times to number of people. Here it finally is! The first version of my tool to alter your B593 configuration. With this tool you can change admin passwords for web GUI and SSH to something of your liking. It does not (yet) convert plaintext passwords into encrypted ones, but it successfully writes the changes to flash, thus making them permanent.

Prerequisites

• Huawei B593 u-12
• Access to your box for running commands, telnet/SSH are really good options for this
• While at Busybox sh prompt, internet connectivity via the mobile interface (4G/3G/2G)
  

Getting the tool

The MIPS32 binary version suitable for running at your B593 is at http://opensource.hqcodeshop.com/Huawei%20B593/curcfg/latest. The C source code is also available at: http://opensource.hqcodeshop.com/Huawei%20B593/curcfg/

1. Log into your box
2. (recommended) Change into directory /upgflash/
3. Download the binary into your box:
   wget -g -v -l curcfg_tool -r "/Huawei%20B593/curcfg/latest" opensource.hqcodeshop.com
   
• As you can see, Busybox has a mighty quirky wget!
• Anyway, that command will download the tool from the above URL and place it to the current directory with local name curcfg_tool.
• Also note, that your box must have a functioning Internet access for download. The only other viable option is via FTP-hack. The environment is very limited and file transfers are restricted heavily.
  
4. Make sure, that the file is executable:
   chmod a+x curcfg_tool
   

Running the tool

Now that you have the thing sitting there, run it:

# ./curcfg_tool
Usage:
-V                     - Print version information
-cw <base64 encoded web gui password>  - set password
-cs <base64 encoded SSH password>      - set password
-w                     - write changes to flash (default: don't write)
-fi <file name>        - input file (default: read from flash)
-fo <file name>        - write changes (default: /tmp/flashinfo.bin)

An example of resetting the web-GUI password would be:

# ./curcfg_tool -cw f5338SA1kb4= -w
Read data: addr = 0xe00000, len = 0x4 ...
Begin write to file
Export done
Reading 25785 bytes of config
Read data: addr = 0xe00000, len = 0x64bd ...
Begin write to file
Export done
Writing 25785 bytes of config
/tmp/flashinfo.bin size = 25790 Bytes
Read file done
Begin write to flash
Load file done

The magicical Base64 encoded 3-DES encrypted string f5338SA1kb4= is "admin" in plain text. After a reboot (just say reboot at prompt), you can login into your web-GUI and change the password into something of your liking.

What next?

That's pretty much it as of now. If you don't like your operator designated passwords, you can change them.

How do I ...

• ... see what my current password is:
  You cannot. Encryption key is not known for pre-SP100 firmware and SP100+ firmware is using double encryption with 3-DES and AES and entire flow of information is not yet known.
• ... access the prompt of my box:
  See B593_exploit.pl for details.
  
• ... access the prompt of my box, but I have SP100+ firmware and don't know any of my passwords:
  You cannot. Yet. Currently known exploits have been fixed preventing access.
  However, in this case the real question seems to be: "How did you get your box running in the first place?"
  
• ... run the B593_exploit.pl -tool, my Perl isn't working:
  You may want to install all CPAN-modules the script requires. Also skip the Windows and use a proper computer.