ZTE MF910V Root exploit

ZTE MF910/ZTE910B/ZTE MF910V/Telstra MF910v 

This guide exists in both linux and windows format
Please follow the instructions as per O/S or untill instructions converge

|+++++++++++++++++++++++++++++++++++++|

Default credentials:
For ZTE MF910/ZTE910B/ZTE MF910V/Telstra MF910v
root:oelinux123

Web Interface Password:
password

|+++++++++++++++++++++++++++++++++++++|

Getting Setup:
Download the mode switch html to run locally:
http://lopoteam.com/3AY9

Also ensure you have ADB (Android Debug Bridge) installed on your computer:

ADB:

Linux:
https://dl.google.com/android/repository/platform-tools-latest-linux.zip
http://lopoteam.com/37Bw

Windows:
https://dl.google.com/android/repository/platform-tools-latest-windows.zip
http://lopoteam.com/37Ac

|+++++++++++++++++++++++++++++++++++++|

Lets Begin

|+++++++++++++++++++++++++++++++++++++|

Plug your device into the computer to download drivers.

Linux:
Open Terminal
cd (*adb-folder*)
adb start-server
adb devices

Windows:
Open Command Prompt:
chdir (*adb-folder*)
adb start-server
adb devices

|+++++++++++++++++++++++++++++++++++++

          Starting ADB Listener On Router

|+++++++++++++++++++++++++++++++++++++|

**Linux & Windows**

Login to http://192.168.0.1/
(see default password)
Now open the Tools.html file in your browser.
Select the checkbox for ADB and press submit,
your device will now flash and adb will be enabled

|+++++++++++++++++++++++++++++++++++++|
Controling The Device And Creating Shell

|+++++++++++++++++++++++++++++++++++++|

******Linux & Windows**

Next we start our shell from the command prompt / terminal:

adb devices

List of devices attached
PXXXXXXXXD000000 device
adb shell

You should now have a root shell on the router,
now we can enable ssh and create a random password generator

# adduser -s /bin/sh -S (Your New User Name)
# passwd (Your New User Name)
# iptables -t filter -I INPUT -p tcp --dport 22 -j ACCEPT
# iptables -t filter -I INPUT -p udp --dport 22 -j ACCEPT

|+++++++++++++++++++++++++++++++++++++|

Gaining Persistant Root Access Even After Reset

|+++++++++++++++++++++++++++++++++++++|

First Generate a New Random Password Or Use Your Own.
Write This Down Or Make Sure You Can Remember It!

vi /usr/zte/zte_conf/scripts/firewall_init.sh

Add a Comments in front of line 92 and 93

#iptables -t filter -I INPUT -p tcp --dport 22 -j DROP
#iptables -t filter -I INPUT -p udp --dport 22 -j DROP

Further Down The Script add these commands

echo "password
password
"|passwd

Replace the passwords with your password

now save and close the file.

(This Will Be Persistant But Will Not Stop Adb From Root Access)
(Change web interface password to deter unauthorised adb access)
(Now The Device Will Start SSH At Boot And Reset)

Reboot the device.
(This will now disable ADB mode and the device will start normally)

Now SSH into the Router:

login:(Your New User Name)

(Your New User Name)[[@192.168.0.1]]'s password:

You Could Also Login As Root

This guide exists in both linux and windows format
Please follow the instructions as per O/S or untill instructions converge

|+++++++++++++++++++++++++++++++++++++|

ZTE MF 90

Web Interface Password:
password

|+++++++++++++++++++++++++++++++++++++|

Getting Setup:
Download the mode switch html to run locally:
http://lopoteam.com/3Bkf

Also ensure you have ADB (Android Debug Bridge) installed on your computer:

ADB:

Linux:
https://dl.google.com/android/repository/platform-tools-latest-linux.zip
http://lopoteam.com/37Bw

Windows:
https://dl.google.com/android/repository/platform-tools-latest-windows.zip
http://lopoteam.com/37Ac

|+++++++++++++++++++++++++++++++++++++|

Lets Begin

|+++++++++++++++++++++++++++++++++++++|

Plug your device into the computer to download drivers.

Linux:
Open Terminal
cd (*adb-folder*)
adb start-server
adb devices

Windows:
Open Command Prompt:
chdir (*adb-folder*)
adb start-server
adb devices

|+++++++++++++++++++++++++++++++++++++|

Starting ADB Listener On Router

|+++++++++++++++++++++++++++++++++++++|

**Linux & Windows**

Login to http://192.168.0.1/
(see default password)
Now open the Tools.html file in your browser.
Select the checkbox for ADB and press submit,
your device will now flash and adb will be enabled

|+++++++++++++++++++++++++++++++++++++|
Controling The Device And Creating Shell

|+++++++++++++++++++++++++++++++++++++|

******Linux & Windows**

Next we start our shell from the command prompt / terminal:

adb devices

List of devices attached
PXXXXXXXXD000000 device
adb shell

You should now have a root shell on the router,
now we can enable telnet and create a random password

# adduser -s /bin/sh -S (Your New User Name)
# passwd (Your New UserPass)
# iptables -t filter -I INPUT -p tcp --dport 22 -j ACCEPT
# iptables -t filter -I INPUT -p udp --dport 22 -j ACCEPT

|+++++++++++++++++++++++++++++++++++++|

Gaining Persistant Root Access Even After Reset

|+++++++++++++++++++++++++++++++++++++|

First Generate a New Random Password Or Use Your Own.
Write This Down Or Make Sure You Can Remember It!

Edit /usr/zte/zte_conf/scripts/firewall_filter_init.sh :

echo "(Your New Password)
(Your New Password)
"|passwd

telnetd -F -p 23 &

echo "firewall init done"
#nat.sh

Now The Next Script Edit:

vi /usr/zte/zte_conf/scripts/firewall_init.sh :

iptables -t filter -I INPUT -p tcp --dport 23 -j ACCEPT
iptables -t filter -I INPUT -p udp --dport 23 -j ACCEPT
iptables -t filter -I OUTPUT -p udp --dport 23 -j ACCEPT
iptables -t filter -I OUTPUT -p tcp --dport 23 -j ACCEPT

echo "firewall init done"
#nat.sh

now save and close the file.

(This Will Be Persistant But Will Not Stop Adb From Root Access)
(Change web interface password to deter unauthorised adb access)
(Now The Device Will Start Telnet At Boot)

Reboot the device.
(This will now disable ADB mode and the device will start normally)

Now Telnet into the Router:

login:(Your New User Name)

(Your New User Name)[[@192.168.0.1]]'s password: