Sagem router has been cracked - take 2

[James67]

.
Before reading this thread Please read this first.
.

Edit: Please note that the two flash images referred to below have now been removed. A "safer" method can now be found here.



I've worked out what went wrong with my first attempt at this. As I suspected, there was something in my "three-reflashes" procedure that wasn't being done in the "two-reflashes" procedure that I detailed at the weekend.

The good news is that I think I've actually cracked it now. I've managed to get the connection username and password out of all three of my Sagem routers, so that seems to support that supposition.

Anyway, before anything else, here are the disclaimers…

This procedure is still experimental. If you are at all shaky about computing or networking then DON'T DO IT. If you have only one working Sky router then DON'T DO IT. In fact, the best advice is JUST DON'T DO IT.

Got that? Now read the standard SkyUser disclaimer on router cracking…

SkyUser make this information available in the interests of our members. Please do not upgrade your FW unless you fully understand the risks that it could go wrong and render your router useless. Please remember also, that it is against the Terms and Conditions of Sky Broadband. You also run a high risk of having your Broadband Connection suspended as well as receiving no Technical Support.

If you're still reading this, then you are either very brave or very stupid. I sincerely hope it's the former.

1. Download these two flash image files…
   
   
   • Latest Sagem F@ST2404 firmware
   • Modified version of the 1.1sky firmware
   
   Note that the modified version of the 1.1sky firmware is NOT the same as used in the previous cracking instructions. This one is called 1.1SKY-mod2.img
   
   
2. Ensure that you are connected to the router through Ethernet (wired networking). It's also a good idea that you have just the router and your PC on the network. It'll make things easier if you are using a fixed IP address for your PC - go to Network Connections and in the TCP/IP properties switch from "Obtain an IP address automatically" to "Use the following IP address" and enter a suitable IP address such as 192.168.0.2 with a netmask of 255.255.255.0. If you are using Windows Vista, make sure you have the telnet client enabled because you'll need it later.
   
   
3. Navigate to the router at http://192.168.0.1/ using the username admin and the password sky.
   
   
4. Select the Maintenance->Router Upgrade option. Browse to the F@ST2404 firmware image you downloaded in step 1 and then click on UPLOAD. Once the router has uploaded the new firmware, flashed it and rebooted, you should see just one light on the router - the Ethernet port light for your PC connection.
   
   
5. Change your PC's IP address to 192.168.1.2 and navigate to http://192.168.1.1/. You should see a rather sparse web page that has fields for Software File Name and MAC Base Address. Enter your router's MAC address in the appropriate box, then click on Save/Apply followed by Save/Reboot.
   
   
6. Once the router has rebooted, navigate to http://192.168.1.1/ with the username admin and password admin - note the changed password. You should see the standard Sagem F@ST2404 user interface.
   
   
7. Click on Management then Update Software. Browse to the 1.1SKY-mod2.img that you downloaded in step 1 and click on the Update Software button.
   
   
8. Once the router has rebooted, you should see just one light on the router. Navigate to http://192.168.1.1/ where again, you should see the same sparse web page that you saw in step 5. Again, enter your router's MAC address in the appropriate box, then click on Save/Apply followed by Save/Reboot.
   
   
9. Navigate to http://192.168.1.1/ with the username admin and password admin. The router will be now back in its Sky Broadband "skin".
   
   
10. Click on Start->Run and enter the command
    
    
    • telnet 192.168.1.1
    
    and in the telnet window, login using admin and admin. You should see a configuration menu with 14 items. At the -> prompt, type the command
    
    
    • sh
    
    and then type
    
    
    • crack SSID KEY
    
    where SSID is the default SSID assigned to the router and KEY is the default WPA network key. The SSID is always SKY followed by 5 digits, and the WPA network key is always eight uppercase letters. You can get these details from the label on the bottom of the router. Note that you have to enter the default SSID and WPA key even if you have changed them. So for example, if your router's default SSID is SKY12345 and its default WPA key is ZYXWABCD, you would type the following command…
    
    
    • crack SKY12345 ZYXWABCD
    
    When you have done that, type reboot to reboot the router.
    
    
11. Change your PC's IP address back to 192.168.0.2 - you can do this while the router is rebooting. Once the router has finished rebooting, telnet to the router, this time using the address 192.168.0.1 and username admin and password sky - note how the details have reverted to their Sky defaults. At the -> prompt, type the command
    
    
    • cat /var/password.txt
    
    and you should see your connection username after the -u and your connection password after the -p. The username should be your router's LAN MAC address, using lowercase hex letters and without the colons, followed by @skydsl. The password should be 15 characters long and may contain upper and lowercase letters, digits and the symbols + and /.

I'll stress the point once again, this is an experiment procedure. It is not guaranteed to work, so please, please, please don't do it if you're dependant on your Sky Sagem router for your Internet connection.

One other little point, anyone who tried the previous instructions should be able to follow these instructions and hopefully this time, they'll get the right results.

Let me know how you get on!

[vRS]

Im brave and got nothing to lose lol
Will give it a shot and get back to you

[James67]

Just a quick "heads-up" - I spotted an error in step 10. I've edited the original post so that it now has the correct IP address. Sorry about that.

[vRS]

You are the man James
Just did the above and it works 100%.
Got my username and password and stuck it into my Netgear DG834GT router, and it has connected up fine. No problems at all.
Im just going to plug my Sagem back in and test that.

Thanks for all your time and effort in achieving this

[precha]

Sweet!!

[Keiran2K8]

Awsome work once again James

[Undecided Adrian]

Superb and well done James for doing what was quoted as "impossible", perhaps you should be employed by a hardware manufacturer to test their new stuff out?

[vRS]

Backup up and running on the Sagem, with no problems.
Only difference is that the firmware is Sky 1.1 and not 1.5.
Not a big deal, im happy, so thanks again James.

"One other little point, anyone who tried the previous instructions should be able to follow these instructions and hopefully this time, they'll get the right results."

Except they may have already bricked their routers, not have a replacement and have no way of getting online. They'll now be waiting for sky to ship a spare router to them....downtime for them and unnessecary expense for sky......

[WelshBluebird]

Originally Posted by jb51053

"One other little point, anyone who tried the previous instructions should be able to follow these instructions and hopefully this time, they'll get the right results."

Except they may have already bricked their routers, not have a replacement and have no way of getting online. They'll now be waiting for sky to ship a spare router to them....downtime for them and unnessecary expense for sky......

to be fair, james did say don't do it unless your have another sky router, and that it was only experimental.