GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → nikolas-n → Speedport-Plus-Cosmote-Router-hacks

nikolas-n / Speedport-Plus-Cosmote-Router-hacks

Licence: other
Exploring the Sercomm made router of Cosmote - OTE Group (Deutsche Telekom in Greece)

Programming Languages

shell
77523 projects
python
139335 projects - #7 most used programming language

Labels

apicurlhttprequestspeedportendpointotesercommcosmote

Projects that are alternatives of or similar to Speedport-Plus-Cosmote-Router-hacks

HttpRequest
Simplified HTTP client, A simplie golang HTTP client library.
Stars: ✭ 134 (+109.38%)
Mutual labels:  curl, httprequest
textics
📉 JavaScript Text Statistics that counts lines, words, chars, and spaces.
Stars: ✭ 36 (-43.75%)
Mutual labels:  curl
curlconverter
➰ ➡️ ➖ Translate cURL command lines into parameters for use with httr or actual httr calls (R)
Stars: ✭ 86 (+34.38%)
Mutual labels:  curl
CurlDSL
CurlDSL converts cURL commands into URLRequest objects
Stars: ✭ 56 (-12.5%)
Mutual labels:  curl
cj
正方教务系统成绩查询手机版，结合Weui，自动识别验证码
Stars: ✭ 20 (-68.75%)
Mutual labels:  curl
libopenTIDAL
TIDAL API interface written in ANSI C
Stars: ✭ 17 (-73.44%)
Mutual labels:  curl
curlall
Simple curl-like CLI tool to automatically page through APIs
Stars: ✭ 25 (-60.94%)
Mutual labels:  curl
easyhttp
EasyHttp 是一个轻量级、语义化、对IDE友好的HTTP客户端，支持常见的HTTP请求、异步请求和并发请求，让你可以快速地使用 HTTP 请求与其他 Web 应用进行通信。
Stars: ✭ 31 (-51.56%)
Mutual labels:  curl
boast
I want track all HTTP requests, and replay it easily.
Stars: ✭ 61 (-4.69%)
Mutual labels:  curl
squirrel
Like curl, or wget, but downloads directly go to a SQLite databse
Stars: ✭ 24 (-62.5%)
Mutual labels:  curl
opencv3-setup
Raspberry Pi whiptail Menu driven Easy Install and Compile of opencv3 python from source files.
Stars: ✭ 47 (-26.56%)
Mutual labels:  curl
Fetch
Asynchronous HTTP client with promises.
Stars: ✭ 29 (-54.69%)
Mutual labels:  curl
axios-curlirize
axios plugin converting requests to cURL commands, saving and logging them.
Stars: ✭ 152 (+137.5%)
Mutual labels:  curl
tentris
Tentris is a tensor-based RDF triple store with SPARQL support.
Stars: ✭ 34 (-46.87%)
Mutual labels:  endpoint
fortran-curl
Fortran 2008 interface bindings to libcurl
Stars: ✭ 25 (-60.94%)
Mutual labels:  curl
uva-tool
Command Line Based UVa OJ Submitting and uHunting Tool
Stars: ✭ 32 (-50%)
Mutual labels:  curl
orca
C Multi-REST API library for Discord, Slack, Reddit, etc.
Stars: ✭ 360 (+462.5%)
Mutual labels:  curl
GitHubAPI
[UNMAINTAINED] This is a simple Object Oriented wrapper for GitHub API v3, written with PHP7.
Stars: ✭ 36 (-43.75%)
Mutual labels:  curl
guile-curl
A language binding for the CURL network client library for the Guile version of the Scheme language
Stars: ✭ 23 (-64.06%)
Mutual labels:  curl
1c http
Подсистема 1С для работы с HTTP
Stars: ✭ 48 (-25%)
Mutual labels:  curl
View All Similar Projects ➔

Introduction

Here you can find some interesting data that you can get from your home router. Whatever is here has been found through a combination of crawling the web and sending http requests on the router's administration page.

Scripts added so far

  • device_connected.sh: Check which devices are connected to and disconnected from your router and send notifications in either case.
  • dynamic_dns.sh: Create a dyndns service of your own (you'll need to have somewhere a DNS server that you can update)
  • get_line_uptime.sh: Check how many days you've been online with the same IP
  • get_public_ip.sh: Retrieve your public IP without visiting any website on the internet
  • missed_calls.sh: Get notifications on your missed calls. You can always access all the calls (missed, received, outgoing) on this URL (which is surprisingly hidden from the web-ui): http://192.168.1.1/html/content/phone/phone_call_list.html
  • reboot.sh: Reboot your router.
  • get_data.py: Get the data from all of your endpoints (details at the bottom of this file)

Since all responses of the router are in JSON format, most scripts use jq, a very useful parser for the command line (available here).

Responses Samples

You can find samples of all the endpoints found until now in the responses_samples folder. Values of the objects have been masked as they contain sensitive data :-)

Endpoints

The endpoints all live under the data path, i.e. http://speedport.ip/data/*.json. For instance, if the router is on 192.168.1.1 (default one), then the login endpoint will be: http://192.168.1.1/data/Login.json (the capital L on Login is needed, as any other capital letter in all the endpoints).

HTTP Requests to the router

All requests need at least one header to be accepted, and that is the Accept-Language (its value plays no role whatsoever). So, make sure you always add that, for example when checking the status of the router:

curl -H 'Accept-Language: en' "http://192.168.1.1/data/Status.json"

When not logged in, that will return data found on the html/login/status.html page.

Logging in

If your firmware version is earlier than 09022001.00.030_OTE5, then you don't need to login because of a bug of the router's software. If your firmware is 09022001.00.030_OTE5 then you have to login with the followin command:

curl -c - -H 'Accept-Language: en' "http://192.168.1.1/data/Login.json" -d "showpw=0" -d "username=*****" -d "password=*****"

After you have logged in, then you will have to use the cookie you got for the following requests. For instance, to have an overview of what's going on in your router you can hit the Overview endpoint like this:

curl -H "Cookie: session_id=2C43334D07267CAF5F9334596916E616" -H 'Accept-Language: en' "http://192.168.1.1/data/Overview.json"

The bug

UPDATE: It has been fixed with the latest update of the firmware (09022001.00.030_OTE5).

If your router hasn't (automatically) been updated yet or you downgraded with the included .img file, you don't need to login and get a cookie. You can just omit that part and just send:

curl -H "Cookie: session_id=" -H 'Accept-Language: en' "http://192.168.1.1/data/Overview.json"

You'll still get everything as if you were logged.

The only case you will get a 302 Error response is if someone else (including you) is logged into the router, e.g. normally through the web page on a regular browser. Even so, you can kick them out, with:

curl -H 'Accept-Language: en' "http://192.168.1.1/html/login/index.html"

And then you can access all endpoints with the "broken" requests provided earlier.

Responses

All responses are valid JSON files that begin with the following:

{"vartype":"value","varid":"device_name","varvalue":"Speedport Plus"}
{"vartype":"value","varid":"rebooting","varvalue":"0"}
{"vartype":"value","varid":"router_state","varvalue":"OK"}
{"vartype":"value","varid":"provis_inet","varvalue":"xx3"}
{"vartype":"value","varid":"provis_voip","varvalue":"xx3"}
{"vartype":"value","varid":"save_fails","varvalue":"0"}
{"vartype":"page_title","varid":"title","varvalue":"Speedport Plus Configuration Program"}
{"vartype":"status","varid":"loginstate","varvalue":"1"}
{"vartype":"status","varid":"status","varvalue":"ok"}

If an endpoint is valid but not activated, i.e. does not return the relevant data, then it will at least return that JSON. For example, PhoneDialedCalls.json, PhoneMissedCalls.json and PhoneTakenCalls.json are examples of such responses.

List of the available endpoints

The Speedport Plus router has the following endpoints (you can also find them in the endpoints_list.txt file):

  • Abuseadv.json
  • Abuse.json
  • AnsweringMachine.json
  • Assistant.json
  • AuswAss.json
  • Connect.json
  • DECT.json (empty)
  • DECTStation.json (empty)
  • DynDNS.json
  • EAStatus.json
  • ExtendedRules.json
  • FilterAndTime.json
  • FirmwareUpdate.json
  • INetIP.json
  • InternetConnection.json
  • IPPhoneHandler.json
    • Applicable for versions older than 09022001.00.030_OTE5: Here you will find info about your land line. Among that info you can find the password that is used to authenticate your user to the VoIP cosmote server. Below you can check how you can use your landline from any other client!
  • IPPhone.json (not activated)
  • IPPhoneNumbers.json (not activated)
  • IPPrenumber.json
  • ISDNPhonePlugs.json
  • LAN.json
  • Login.json
  • ManagedDevice.json
  • Modules.json
  • NASBackupEntry.json
  • NASBackup.json
  • NASDevice.json
  • NASGuest.json
  • NASLight.json
  • NASMediacenter.json
  • NASMediaReplay.json
  • NASSync.json
  • NASUser.json
  • NASWorkgroup.json
  • NewDirectoryEntry.json
  • OtherDevice.json (not activated)
  • Overview.json
  • PhoneBook.json
  • PhoneCalls.json
    • Returns all data regarding calls. Dialed, Taken (i.e. received) or Missed for up to (at least) three months.
  • PhoneDialedCalls.json (not activated)
  • Phone.json
  • PhoneLineset.json
  • PhoneMissedCalls.json (not activated)
  • PhoneNumberAssignment.json
  • PhoneNumbers.json (not activated)
  • PhonePlugs.json
  • PhoneSettings.json
  • PhoneTakenCalls.json (not activated)
  • PhoneWebnWalk.json
  • Portforwarding.json
  • Reboot.json
  • Router.json (not activated)
  • SecureStatus.json
  • Status.json
  • SystemMessages.json
  • temp.json
  • TimeRules.json
  • WebnWalk.json (empty)
  • WLANAccess.json
  • WLANBasic.json

Receive/Make calls from anywhere

UPDATE: The latest update of Cosmote's firmware makes the IPPhoneHandler.json return an empty string, so this info is no longer available.

Applicable for firmware versions older than 09022001.00.030_OTE5

The info needed to do so are the following:

User name: +30XXXXXXXXXX
Password: this is the password you found in IPPhoneHandler as  t_password
Domain/Registrar: ims.otenet.gr
Authentication Name: [email protected]

You can enter these details in any VoIP client, e.g. CsipSimple in Android, and you can have your landline anywhere!

The only limitation is that you cannot be registered simultaneously from multiple clients. If you register from another client, then you will receive/make calls to that client. If you deregister from your other client, you'll have to make sure that SpeedPort is re-registered again. You can do that by disabling and enabling the tickbox Enable on the Tel.Numbers page of the administration webpage (https://speedport.ip/html/content/phone/VoIP_index.html).

Flashing the older Firmware

To flash your router with older firmware, you need to do the following:

  1. Make sure you have git lfs installed. This step is needed so that the repo is cloned along with the img file
  2. Clone this repo
  3. Go to http://192.168.1.1/html/content/config/check_for_updates.html
  4. Click Browse to choose the img file, navigate to your file and then click install
  5. Your router will reboot to effect the change

When you're done with downloading, you can revert to the latest version by repeating the same steps using the latest firmware file you can download from here (latest as of 8/7/20). Your voIP password does not change this way since they really had no idea you did that.

Getting your data

You can get all the current data of your router with getData.py (python 3). Create the folder my_router_responses, install the requests python3 package with pip3 install requests and then run the file with:

python3 getData.py

Reverse engineering

Playing around with the router, a possibly interesting information has come up. This is how you can check yourself:

  1. Go to Settings
  2. Click on Save Settings
  3. Click on Saving and then click on the Saving button
  4. A file of the following format will be downloaded (depneding on your version and when you made the export of the settings): Speedport_Plus_09022001.00.035_OTE5_2022-03-22_003825.config
  5. If you cat this you'll see a long hex
  6. Run xxd -p -r Speedport_Plus_09022001.00.035_OTE5_2022-03-22_003825.config > speedport.data. NOTE: xxd is a command line to make and reverse hex dumps. Here we're using (-r) reversing
  7. If you now run file speedport.data you'll get Dyalog APL aplcore version 198.157

It seems that the REST API of the router is written in dyalog and the config is created using this function here. It would be interesting to see if this file can be decoded somehow. Leaving it here in case someone has any luck or any idea of how this could be achieved.

Other telecom providers using this modem

Deutsche Telekom distributes this modem in many of its subsidiaries.

  • Crnogorski Telekom (Montenegro)
  • Hrvatski Telekom (Croatia)
  • HT Eronet (Bosnia and Herzegovina)
  • Magenta Telekom (Austria)
  • Magyar Telekom (Hungary)
  • Makedonski Telekom (North Macedonia)
  • Slovak Telekom (Slovakia)
  • T-Mobile (Czechia)
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].