5 Feb
2019
5 Feb
'19
11:59 a.m.
Hello,
I am working on a EC25-1 which has problem with the USB communication
with a dwc2 usb host controller [1].
To find the problem my next step was to connect to the EC25 debug UART
on pin 11/12.
But the system needs a root password!
The one you have on your wiki does not work anymore [2].
I think I have the same version "msm LNX.LE.5.0.1-57031-9x40
mdm9607-perf /dev/ttyHSL0"
Do you have another password for this interface or where did you get
this information from?
Thanks for help
Flo
[1] https://www.spinics.net/lists/linux-usb/msg176613.html
[2]
https://osmocom.org/projects/quectel-modems/wiki/EC25_Linux#root-password
6 Feb
6 Feb
9:12 a.m.
Hi Florian,
On Tue, Feb 05, 2019 at 11:59:51AM +0100, Florian Eckert wrote:
I am working on a EC25-1 which has problem with the
USB communication with a
dwc2 usb host controller [1].
Thanks for letting us know.
To find the problem my next step was to connect to the
EC25 debug UART on
pin 11/12.
But the system needs a root password!
The one you have on your wiki does not work anymore [2].
I think I have the same version "msm LNX.LE.5.0.1-57031-9x40 mdm9607-perf
/dev/ttyHSL0"
Do you have another password for this interface or where did you get this
information from?
I suspect your easiest approach is to obtain the firmware update file and
then extract the rootfs, specifically the /etc/passwd or /etc/shadow file,
and then use a password cracker on that.
Regards,
Harald
--
- Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
2:36 p.m.
Hello Harald,
Thanks for the note.
I got the latest firmware version and extracted the passwd
Let's run the password cracker and see what comes out.
I will contact you again when I have the password.
Thanks
Flo
To find the problem my next step was to connect
to the EC25 debug UART
on
pin 11/12.
But the system needs a root password!
The one you have on your wiki does not work anymore [2].
I think I have the same version "msm LNX.LE.5.0.1-57031-9x40
mdm9607-perf
/dev/ttyHSL0"
Do you have another password for this interface or where did you get
this
information from?
I suspect your easiest approach is to obtain the firmware update file
and
then extract the rootfs, specifically the /etc/passwd or /etc/shadow
file,
and then use a password cracker on that. 
7 Feb
7 Feb
10:01 a.m.
2019년 2월 6일 수요일 오후 2시 36분 22초 CET에 Florian Eckert 님이 쓴 글:
Hello Harald,
Thanks for the note.
I got the latest firmware version and extracted the passwd
Let's run the password cracker and see what comes out.
I will contact you again when I have the password.
Thanks
Flo
_______________________________________________
qc-linux-modems mailing list
qc-linux-modems(a)lists.osmocom.org
https://lists.osmocom.org/mailman/listinfo/qc-linux-modems
Hello,
While I am not using the same model (EC21), but I got a root shell via adb in
this modem by using AT+QCFG command. This is the result of AT+QCFG=? on our
modem:
AT+QCFG=?
+QCFG:
"usbcfg",<vid>,<pid>,<diag>,<nmea>,<at_port>,<modem>,<rmnet>,<adb>,<uac>
AT+QCFG="usbcfg"?
+QCFG: "usbcfg",0x2C7C,0x0121,1,1,1,1,1,1,0
Unfortunately AT+QLINUXCMD is not available in this firmware revision
(EC21EFAR06A02M4G).
Although the Linux lsusb shows interface #5 with an ADB interface activated,
the latest revision of adb in Linux does not pick up the interface. I tried
putting the vendor ID in ~/.android/adb_usb.ini and checked udev permissions,
but no avail. Meanwhile I could get the ADB shell in Windows. Does someone
have any ideas why it is not working in Linux?
Shinjo
--
Shinjo Park <pshinjo(a)sect.tu-berlin.de>
Security in Telecommunications <sect.tu-berlin.de>
TU Berlin / Telekom Innovation Laboratories
Ernst-Reuter-Platz 7, Sekr TEL 17 / D - 10587 Berlin, Germany
Phone: +49 30 8353 58272
To find
the problem my next step was to connect to the EC25 debug UART
on
pin 11/12.
But the system needs a root password!
The one you have on your wiki does not work anymore [2].
I think I have the same version "msm LNX.LE.5.0.1-57031-9x40
mdm9607-perf
/dev/ttyHSL0"
Do you have another password for this interface or where did you get
this
information from?
I suspect your easiest approach is to obtain the firmware update file
and
then extract the rootfs, specifically the /etc/passwd or /etc/shadow
file,
and then use a password cracker on that.
1928
days inactive
1930
days old
qc-linux-modems@lists.osmocom.org
3 comments
3 participants
participants (3)
-
Florian Eckert -
Harald Welte -
Shinjo Park