Introduction

      Years ago, I already heard about the exhaustion of IPv4 addresses, and since I have some IPv6-only websites, I've always wanted to enable IPv6 on my home network. However, I never had the time to look into it until recently when I finally had some free time.

      During the process of bridging IPv6, getting the super password for the optical modem is the most critical step. After searching extensively and experimenting, I found that my modem happens to be one of the hardest models to crack. Fortunately, with some guidance from a friend, I managed to break through.

      If this seems too troublesome, I'd suggest just buying a one-click cracking service on Taobao. It's a bit pricey though (which is exactly why I did it myself—I was this close to buying one).

Preparation

Friendly reminder: This method theoretically works for China Mobile HG series optical modems.

• A photo of the back of the modem, which includes the following:
  • MAC address
  • Regular user's username and password
• A computer running Windows (macOS should theoretically work too)
• Telnet service ## Getting the Super Password ### Local Telnet

Enable the Telnet service in the Windows Control Panel.

Console Password

Write down the MAC address from the back of the modem and remove the hyphens.

For example, if the MAC address is 54-E0-05-2A-4F-20, removing all hyphens gives you 54E0052A4F20.

If you can't find the MAC address, read this step. If you successfully found it above, skip this part.

Open your computer's console (CMD on Windows) and run:

arp -a

A bunch of entries will appear. You just need to find the one corresponding to 192.168.1.1, for example:

Here, you only need to look at the first line 192.168.1.1 and note down 54:e0:5:2a:4f:20. Don't rush to remove the colons yet!

In theory, there should be two characters between each colon, but in this MAC string, you'll notice two colons are followed by only a single "5". In that case, you need to quietly add a 0 before that 5, turning it into 54:e0:05:2a:4f:20. Then convert all letters to uppercase and remove the colons, giving you 54E0052A4F20.

Modem Telnet

In your browser, enter http:/192.168.1.1/cgi-bin/telnetenable.cgi?telnetenable=1&key=

Append the MAC address you just edited to the end, so it becomes:

http:/192.168.1.1/cgi-bin/telnetenable.cgi?telnetenable=1&key=54E0052A4F20

If the browser shows "telnet enabled", then Telnet has been successfully activated on your modem.

If the browser shows "operation error", it means the MAC address wasn't obtained correctly.

Getting the Super Password

Open the console and run:

telnet 192.168.1.1

You'll then be prompted for a username and password.

The username can vary—it could be root, admin, etc. Try them one by one. In my case, the username was admin.

Those familiar with Linux will know that the password input is invisible by default. Just type it in and make sure it's correct.

The password here is Fh@ followed by the last six characters of the MAC address you obtained. For example, my password was Fh@2A4F20.

Now comes the crucial part of getting the password—different modems require different commands.

Here, I'll demonstrate the commands I used:

cfg_cmd get InternetGatewayDevice.DeviceInfo.X_CMCC_TeleComAccount.Username
cfg_cmd get InternetGatewayDevice.DeviceInfo.X_CMCC_TeleComAccount.Password

Run these two commands separately, and they'll display the super admin's username and password respectively.

At this point, we've successfully obtained the account and password.

If you're not interested, you can skip the next small section.

Commands that might work on other modems include:

load_cli factory
show admin_name
show admin_pwd

The first command enters factory mode, and the subsequent show commands use factory mode to display the username and password.

Q: The factory mode commands are simple and straightforward, so why don't we use them?

A: On HG6042 series modems, using these commands shows "Unknown command". It's said that the carrier blocked these commands, but it's also possible that factory mode lost its privileges. In the 2023 China Mobile version of FiberHome modems, the su password changed, causing a series of issues. As of May this year, only the HG6042 series modems couldn't be cracked, but that's now been resolved—around mid-July this year. So this is still a very fresh article.

Q: How was the password obtained on the HG6042 series modems?

A: By using the cfg_cmd get command, which leverages the Linux super admin privileges after Telnet to retrieve the account and password.

Enabling IPv6

I won't go into too much detail here. For a tutorial on enabling IPv6, please refer to: How to Enable IPv6 Network Access for Personal Broadband | IP Query (ipw.cn)

Reference Articles