联通光猫DT741-csf 完全po解 改桥接

1.管理员密码破解，把光猫的loid pppoe用户名密码，各个连接vlan id记下来

打开链接 http://192.168.1.1/hidden_version_switch.html

version选择Default Version，点击submit，光猫默认重启。重启后ip地址变为192.168.1.1 并且dhcp默认是关闭的，需要设置电脑ip也在192.168.1.0 网段

2.打开 http://192.168.1.1/cu.html，使用CUAdmin CUAdmin登录进去

  新增连接，复原之前的连接。注意vlan id别写错了

3.打开 http://192.168.1.1/register.gch输入之前记下的loid进行注册，没有意外的应该会卡主rms阶段。

4.重新打开管理页面，查看连接，发现地址已经获取到了，但是由于RMS未下发成功，还是不能上网，不能上网的原因是DNS劫持了，所有的页面都重定向loid注册页面。注意：即使使用桥接拨号方式光猫也能劫持DNS，所以一定要执行下一步。

5.关闭自动弹出loid页面http://192.168.1.1/hidden_forcepush_switch.html

点击关闭，光猫自动重启。如果控制台提示有错误，自行补全缺少的方法。

至此完全破解完成！

telnet 用户名root Pon521 ，html页面在/home/httpd目录下，有兴趣的可以研究一下

/ # ls
GN25L95_datas  etc            lib            proc           sys            userconfig     wlan
bin            home           linuxrc        root           tagparam       usr
db_excp        init           mnt            run            temp           var
dev            kmodule        opt            sbin           tmp            webpages
/ # cd home/httpd/
/home/httpd # ls
ChunkSpy-0.9.8                         host_gch.gch                           prefix_gch.gch
IPv4_wan_query.gch                     igmp_proxy_gch.gch                     project.conf
IPv6_internet_wan_query.gch            igmp_snoop_gch.gch                     public
IPv6_wan_query.gch                     index.lp                               qos_localapp_gch.gch
SN_register_gch.gch                    index.lua                              qos_localapp_new_gch.gch
SN_write_gch.gch                       ipv6_net_prefix_js.gch                 qos_localapp_tr069_queue_gch.gch
ThirdPart                              ipv6_net_prefix_t.gch                  qos_localapp_voip_netqos_gch.gch
act_inform_gch.gch                     ipv6_prefix_gch.gch                    qos_qa_gch.gch
ajaxComLogic.gch                       lan_status_link_t.gch                  qos_qa_new_gch.gch
all_mac_gch.gch                        langcn.conf                            qos_qp_gch.gch
all_url_gch.gch                        langen.conf                            qos_qq_basic_gch.gch
anhui_monitor_config_t.gch             lib                                    qos_qq_gch.gch
app_ddns_conf_js.gch                   log_gch.gch                            qos_qq_new_gch.gch
app_ddns_conf_t.gch                    logging                                qos_qq_stats_gch.gch
app_dev_domain_js.gch                  logging.lua                            qos_qqstats_entry_gch.gch
app_dev_domain_t.gch                   login.gch                              qos_qr_gch.gch
app_dev_name_js.gch                    login_admin_jl.gch                     qos_qt_gch.gch
app_dev_name_t.gch                     login_t.gch                            query_dir.gch
app_dms_js.gch                         luaprofiler-2.0.2                      quickSetup_t.gch
app_dms_t.gch                          mac_table_gch.gch                      ra_server_gch.gch
app_dmz_conf_js.gch                    manage_server_gch.gch                  register.gch
app_dmz_conf_t.gch                     manage_tr069_gch.gch                   registerLang.gch
app_ftp_client_js.gch                  manager_SN_register_js.gch             return2factory.gch
app_ftp_client_t.gch                   manager_SN_register_t.gch              rip_gch.gch
app_igmp_conf_js.gch                   manager_act_inform_js.gch              route_static_gch.gch
app_igmp_conf_t.gch                    manager_act_inform_t.gch               route_table_gch.gch
app_igmp_snoop_js.gch                  manager_aduser_conf_js.gch             samba_cfg_gch.gch
app_igmp_snoop_t.gch                   manager_aduser_conf_t.gch              sapi.lua
app_iptv_gch.gch                       manager_buss_mgr_gch.gch               sec_firewall_attack_t.gch
app_iptv_js.gch                        manager_buss_mgr_js.gch                sec_firewall_conf_js.gch
app_iptv_t.gch                         manager_buss_mgr_t.gch                 sec_firewall_level_t.gch
app_mld_conf_js.gch                    manager_dev_conf_js.gch                sec_fw_alg_js.gch
app_mld_conf_t.gch                     manager_dev_conf_t.gch                 sec_fw_alg_t.gch
app_mld_snoop_js.gch                   manager_dev_conf_t_user.gch            sec_ipfilter_conf_js.gch
app_mld_snoop_t.gch                    manager_dev_ping_js.gch                sec_ipfilter_conf_t.gch
app_rip_js.gch                         manager_dev_ping_t.gch                 sec_macfilter_conf_js.gch
app_rip_t.gch                          manager_dev_query_t.gch                sec_macfilter_conf_t.gch
app_route_table_js.gch                 manager_dev_reback_js.gch              sec_portfilter_conf_js.gch
app_route_table_t.gch                  manager_dev_reback_t.gch               sec_portfilter_conf_t.gch
app_samba_cfg_js.gch                   manager_dev_version_js.gch             sec_url_filter_conf_js.gch
app_samba_cfg_t.gch                    manager_dev_version_t.gch              sec_url_filter_t.gch
app_sipline_js.gch                     manager_dsl_diag_js.gch                sec_user_firewall_level_t.gch
app_sipline_t.gch                      manager_dsl_diag_t.gch                 sec_user_fw_alg_t.gch
app_upnp_conf_js.gch                   manager_log_conf_js.gch                sec_user_macfilter_conf_t.gch
app_upnp_conf_t.gch                    manager_log_conf_t.gch                 sec_user_portfilter_conf_t.gch
app_user_ddns_conf_t.gch               manager_mirro_js.gch                   sec_user_url_filter_t.gch
app_user_dmz_conf_t.gch                manager_mirro_t.gch                    self_diagnose_result.gch
app_user_virtual_conf_t.gch            manager_svr_stimulate_js.gch           self_diagnose_running.gch
app_virtual_conf_js.gch                manager_svr_stimulate_t.gch            serial_config_gch.gch
app_virtual_conf_t.gch                 manager_test_over_js.gch               serial_config_js.gch
app_voip_BasicControl_js.gch           manager_test_over_t.gch                serial_config_t.gch
app_voip_BasicControl_t.gch            manager_trace_route_js.gch             serverapi
app_voip_Dtimer_gch.gch                manager_trace_route_t.gch              setlang.gch
app_voip_SLCTime_gch.gch               manager_user_act_inform_t.gch          sntp_gch.gch
app_voip_VoiceProfile_gch.gch          manager_user_conf_js.gch               socket
app_voip_cid_gch.gch                   manager_user_conf_t.gch                status_dev_info_t.gch
app_voip_cid_js.gch                    manager_user_dev_conf_t.gch            status_dev_info_t_fj.gch
app_voip_cid_t.gch                     manager_user_dev_ping_t.gch            status_dslite_if_t.gch
app_voip_h248_servs_js.gch             manager_user_trace_route_t.gch         status_dsliteeth_if_t.gch
app_voip_h248_servs_t.gch              manager_version_query_t.gch            status_ethlan_dhcp_info_t.gch
app_voip_h248auth_js.gch               manager_voip_switch_js.gch             status_ethwan_if_t.gch
app_voip_h248auth_t.gch                manager_voip_switch_t.gch              status_interactive_t.gch
app_voip_h248basic_js.gch              menu.gch                               status_itms_info_t.gch
app_voip_h248basic_t.gch               menu_BJ.gch                            status_lan_info_t_user.gch
app_voip_h248endpoint_js.gch           menu_admin_jl.gch                      status_plugin_t.gch
app_voip_h248endpoint_t.gch            mirror_gch.gch                         status_ponlan_info_t.gch
app_voip_service_js.gch                mld_proxy_gch.gch                      status_registerinfo_t.gch
app_voip_service_t.gch                 mld_snoop_gch.gch                      status_service_info_t.gch
app_voip_sipadv_js.gch                 mode_middleware.gch                    status_smart_info_t.gch
app_voip_sipadv_t.gch                  net_11n_conf_js.gch                    status_usb_info_t.gch
app_voip_sipdigitmap_js.gch            net_11n_conf_t.gch                     status_user_registerinfo_t.gch
app_voip_sipdigitmap_t.gch             net_arpdetect_js.gch                   status_user_voip_4less_t.gch
app_voip_sipmed_js.gch                 net_arpdetect_t.gch                    status_voip_4less_t.gch
app_voip_sipmed_t.gch                  net_dhcp_bindonport_js.gch             status_voip_phoneNumber_t.gch
app_voip_sippro_js.gch                 net_dhcp_bindonport_t.gch              status_wanstatu_ipv6wansta_t.gch
app_voip_sippro_t.gch                  net_dhcp_dynamic_FJ_js.gch             status_wlaninfo_t.gch
app_voip_sipqos_js.gch                 net_dhcp_dynamic_js.gch                system_busy_t.gch
app_voip_sipqos_t.gch                  net_dhcp_dynamic_t.gch                 tele_register_note.gch
app_voip_sipslc_gch.gch                net_dhcp_specialdevice_js.gch          tele_register_note_fj.gch
app_voip_sipslc_js.gch                 net_dhcp_specialdevice_t.gch           tele_sec_tserver_js.gch
app_voip_sipslc_t.gch                  net_dhcp_static_js.gch                 tele_sec_tserver_t.gch
app_voip_vpCallTimer_gch.gch           net_dhcp_static_t.gch                  tele_wait.gch
arp_table_gch.gch                      net_dhcpcleanlink_gch.gch              tele_wanregister.gch
arpdetect_gch.gch                      net_dhcpcleanlink_js.gch               tele_wanregister_AH.gch
atm_oam_gch.gch                        net_dhcpcleanlink_t.gch                tele_wanregister_HB.gch
auth                                   net_dslite_conf_js.gch                 tele_wanregister_admin_jl.gch
auth_check_gch.gch                     net_dslite_conf_t.gch                  tele_wanregister_cq.gch
auth_gch.gch                           net_dsliteeth_conf_t.gch               tele_wanregister_fj.gch
bridge2route_gch.gch                   net_ethwan_conf_js.gch                 tele_wanregister_gd.gch
bridge_route.gch                       net_ethwan_conf_t.gch                  tele_wanregister_hn2.gch
cgilua                                 net_gateway_js.gch                     tele_wanregister_lc.gch
cgilua.lua                             net_gateway_t.gch                      tele_wanregister_ln.gch
checkSessionToken.gch                  net_mtu_mtucg_gch.gch                  tele_wanregister_reset_nopassword.gch
checkSessionToken_log.gch              net_mtu_mtucg_js.gch                   tele_wanregister_reset_password.gch
checktoupper.conf                      net_mtu_mtucg_t.gch                    tele_wanregister_sc.gch
cmc_wlanWapiCert_dev_query_t.gch       net_prefix_js.gch                      tele_wanregister_self_diagnose.gch
cmc_wlan_wapicert.gch                  net_prefix_t.gch                       tele_wanregister_simcard.gch
common_gch.gch                         net_qos_congestion_js.gch              tele_wanregister_success.gch
common_gch_zxy.gch                     net_qos_congestion_statisticsYN_t.gch  tele_wanregister_switch.gch
common_page                            net_qos_congestion_statistics_js.gch   template.gch
config                                 net_qos_congestion_statistics_t.gch    template.lp
dbg                                    net_qos_congestion_t.gch               template.lua
dbg.lua                                net_qos_qostemplate_js.gch             template_jl.gch
ddns_client_gch.gch                    net_qos_qostemplate_t.gch              template_multiMedia.lp
ddns_gch.gch                           net_qos_speed_js.gch                   template_select.lp
ddns_hostname_gch.gch                  net_qos_speed_t.gch                    test_over_gch.gch
ddns_service_gch.gch                   net_route_static_js.gch                top.gch
debug                                  net_route_static_t.gch                 top_jl.gch
debug_file_js.gch                      net_sntp_conf_js.gch                   tr069_business_t.gch
debug_file_t.gch                       net_sntp_conf_t.gch                    tr069_registering.gch
dev_ping_gch.gch                       net_tr069_basic_js.gch                 tr069_registering_t.gch
dev_restart_t.gch                      net_tr069_basic_t.gch                  tr069_servering.gch
devname_gch.gch                        net_tr069_cafile_js.gch                tr069_updating.gch
dhcp_basic_gch.gch                     net_tr069_cafile_t.gch                 tr069_updatingfinish.gch
dhcp_bind_gch.gch                      net_user_dhcp_dynamic_t.gch            trace_route_gch.gch
dhcp_bindonport_gch.gch                net_user_dhcp_static_t.gch             tserver_cfg_gch.gch
dhcp_host_gch.gch                      net_user_gateway_t.gch                 tunnel_gch.gch
dhcp_hostinfo_gch.gch                  net_user_sntp_conf_t.gch               upgrade.gch
dhcp_specialdevice_gch.gch             net_user_wan_conf_js.gch               upgrade_select.gch
diag_netDiag_arpTable_js.gch           net_user_wan_conf_t.gch                upnp_config_gch.gch
diag_netDiag_arpTable_t.gch            net_v6_dhcp_dynamic_js.gch             url_write_sn.gch
diag_netDiag_macTable_js.gch           net_v6_dhcp_dynamic_t.gch              urlsafe.lua
diag_netDiag_macTable_t.gch            net_v6_ra_server_js.gch                usbbackup_js.gch
diagnose_voice_gch.gch                 net_v6_ra_server_t.gch                 usbbackup_t.gch
diagnose_voice_js.gch                  net_v6_user_dhcp_dynamic_t.gch         usbbakrst_gch.gch
diagnose_voice_t.gch                   net_vlan_port_binding_js.gch           usbrestore_js.gch
dmenu.conf                             net_vlan_port_binding_t.gch            usbrestore_t.gch
dmenu_cucc_bj.conf                     net_wlan_adv_conf_t.gch                user_gateway_gch.gch
dmenu_cucc_jl.conf                     net_wlan_conf_js_user.gch              user_info_gch.gch
dmenu_cucc_ln.conf                     net_wlan_conf_t_user.gch               user_register_gch.gch
dmenu_func.gch                         net_wlan_essid_js.gch                  v6_br0_dhcp_gch.gch
dmenuapi.lua                           net_wlan_essid_t.gch                   v6_dhcpc_gch.gch
dms_cfg_gch.gch                        net_wlan_secrity_FJ_js.gch             v6_dhcpdns_gch.gch
dns_dhcphost_gch.gch                   net_wlan_secrity_js.gch                v6_dhcps_gch.gch
dns_gch.gch                            net_wlan_secrity_t.gch                 v_rtpadv_gch.gch
dns_host_gch.gch                       networkstat_error.gch                  version_switch.gch
dslite_gch.gch                         pagefunc_js.gch                        vlan_if_query.gch
e8_net_qos_basic_js.gch                pageinfo_func.gch                      vlan_port_binding_gch.gch
e8_net_qos_basic_new_js.gch            physicstat_error.gch                   voip_adv.gch
e8_net_qos_basic_new_t.gch             pldt_fm_ftpservercfg_gch_p0.gch        voip_digitalmap.gch
e8_net_qos_basic_t.gch                 pon_app_ftp_gch.gch                    voip_faxmodemrptctrl_gch.gch
e8_net_qos_configuration_js.gch        pon_app_ftp_js.gch                     voip_faxt38_gch.gch
e8_net_qos_configuration_t.gch         pon_app_ftp_t.gch                      voip_fix_gch.gch
e8_net_qos_localapp_js.gch             pon_app_voip_cid_gch.gch               voip_h248_servs.gch
e8_net_qos_localapp_new_js.gch         pon_cltlmt_gch.gch                     voip_h248endpoint_gch.gch
e8_net_qos_localapp_t.gch              pon_ethwancpppuser_gch.gch             voip_h248main_gch.gch
e8_net_qos_type_js.gch                 pon_ftpclient_gch.gch                  voip_h248main_qos_gch.gch
e8_net_qos_type_t.gch                  pon_loid_conf_gch.gch                  voip_h248qos_gch.gch
e8_qos_basic_new_gch.gch               pon_loid_conf_lc_gch.gch               voip_h248qos_js.gch
e8_qos_qb_gch.gch                      pon_manager_hltmode_conf_js.gch        voip_h248qos_t.gch
e8_qos_qb_new_gch.gch                  pon_manager_hltmode_conf_t.gch         voip_h248sub_gch.gch
e8_simcard_loid_t.gch                  pon_manager_led_control_gch.gch        voip_linevmedai_gch.gch
e8_status_wlan_info_t.gch              pon_manager_led_control_js.gch         voip_protocal_gch.gch
epon_status_lan_info_t.gch             pon_manager_led_control_t.gch          voip_rtp_gch.gch
epon_status_link_info_t.gch            pon_monitor_config_js.gch              voip_rtp_qos_gch.gch
epon_status_link_info_t_user.gch       pon_monitor_config_t.gch               voip_rtpred_gch.gch
equip_gch.gch                          pon_monitorconfig_gch.gch              voip_service.gch
erroutput.lua                          pon_net_LCloid_conf_js.gch             voip_sip_gch.gch
ethwancbridge_gch.gch                  pon_net_backloop_conf_gch.gch          voip_sip_qos_gch.gch
ethwancip_gch.gch                      pon_net_backloop_conf_js.gch           voip_sip_server_gch.gch
ethwancppp_gch.gch                     pon_net_backloop_conf_t.gch            voip_sippro.gch
ethwanctype_gch.gch                    pon_net_cltlmt_js.gch                  voip_sipqos_gch.gch
fm_ftpservercfg_gch.gch                pon_net_cltlmt_t.gch                   voip_switch_gch.gch
fm_ftpuser_gch.gch                     pon_net_loid_conf_js.gch               voip_voiceproc_gch.gch
frGo2SystemBusy.gch                    pon_net_loid_conf_t.gch                voip_vpPhyInterface_gch.gch
frRequestTimeout.gch                   pon_net_ponloid_js.gch                 voip_vpcallfeature_gch.gch
frame.gch                              pon_net_ponloid_t.gch                  voip_vpcodec_gch.gch
ftpclient_gch.gch                      pon_net_user_ponloid_t.gch             voip_vpdtmf_gch.gch
function_module                        pon_net_wanuser_conf_js.gch            wan_dsl_query.gch
fw_alg_gch.gch                         pon_net_wanuser_conf_t.gch             wan_eth_query.gch
fw_base_conf_gch.gch                   pon_net_wlan_conf_js.gch               wan_func.gch
fw_base_gch.gch                        pon_net_wlan_conf_t.gch                wan_lan_query.gch
fw_dmz_gch.gch                         pon_net_wlan_guest_js.gch              wan_query.gch
fw_ip_gch.gch                          pon_net_wlan_guest_t.gch               wan_tty_query.gch
fw_level_gch.gch                       pon_net_wlan_wps_js.gch                web_config_file
fw_mac_base_gch.gch                    pon_net_wlan_wps_t.gch                 wlanWapiCert_js.gch
fw_mac_gch.gch                         pon_simcard_newcardreboot.gch          wlanWapiCert_t.gch
fw_pm_gch.gch                          pon_simcard_notonline.gch              wlan_cmc_config.gch
fw_url_gch.gch                         pon_simcard_writefail.gch              wlan_config.gch
global.gch                             pon_statistics_lan_info_t.gch          wlan_config_gch.gch
global.lua                             pon_statistics_wan_info_t.gch          wlan_config_pri.gch
gotoshop.gch                           pon_statistics_wlan_info_t.gch         wlan_driver_gch.gch
gotoshop_getURL.gch                    pon_status_alarm_info_t.gch            wlan_essid.gch
gpon_status_lan_info_t.gch             pon_status_gemport_info_t.gch          wlan_essid_adv.gch
gpon_status_link_info_t.gch            pon_status_stat_info_t.gch             wlan_essid_getSSIDbyIndex_gch.gch
gpon_status_link_info_t_user.gch       pon_user_statistics_lan_info_t.gch     wlan_psk_gch.gch
gpon_status_link_t.gch                 pon_user_statistics_wlan_info_t.gch    wlan_security.gch
help_t.gch                             pon_voip_cid_sip_gch.gch               wlan_wapi_gch.gch
hidden_enableall_input.gch             pon_voip_renew_gch.gch                 wlan_wepkey_gch.gch
hidden_factory_switch.gch              pon_voip_renew_js.gch                  write_sninterface_js.gch
hidden_forcepush_switch.gch            pon_voip_renew_t.gch                   write_sninterface_t.gch
hidden_version_switch.gch              pon_voip_siprenew_js.gch
hltmode_gch.gch                        pon_voip_siprenew_t.gch/home/httpd # cat hidden_forcepush_switch.gch
<script language="javascript">
function pageSetValue(flag)
{
getObj("ForcePushFlg").value = flag;
}
function pageSubmit(flag)
{
pageSetValue(flag);
setValue("IF_ACTION","apply");
getObj("fSubmit").submit();
}
function pageLoad(url)
{
getObj("fSubmit").action = url;
var errstr= getValue("IF_ERRORSTR");
var errpara = getValue("IF_ERRORPARAM");
}
</script>
<%
IMPORT FILE "common_gch.gch";
var FP_ERRORSTR     = "SUCC";
var FP_PARANUM      = 1;
var FP_HANDLE;
var FP_INSTNUM = 1;
var FP_IDENTITY = "IGD";
var FP_OBJNAME = "OBJ_ForcePushFlag_ID";
var PARA[1] =
{
"ForcePushFlg"
};
create_form_start("fSubmit", "");
createBasicHidden();
var FP_ACTION = request("IF_ACTION");
if(FP_ACTION == "apply")
{
log_gch("++++++++++apply+++++++++++++");
FP_HANDLE = create_paralist();
setpara(FP_HANDLE, PARA[0]);
set_inst(FP_HANDLE, "OBJ_ForcePushFlag_ID", "IGD");
}
FP_HANDLE = create_paralist();
get_inst(FP_HANDLE, FP_OBJNAME, FP_IDENTITY);
create_hidden_para(FP_HANDLE, PARA, FP_PARANUM);
var forechpush = get_para(FP_HANDLE, "ForcePushFlg");
destroy_paralist(FP_HANDLE);
getDisplayInstError(FP_ERRORSTR);
create_form_end();
%>
<style>
body{text-align:center; margin:0 auto;}
a{ color:blue;}
</style>
<p>褰撳墠鐘舵€?<a><%if ("1" == forechpush){%>鎵撳紑<%}else{%>鍏抽棴<%}%></a></p>
<p>娉ㄥ唽椤甸潰鎺ㄩ€?
<input type="button" name="tForcePushFlg" value="鎵撳紑" onclick="pageSubmit(1);"/>
&nbsp;&nbsp;
<input type="button" name="tForcePushFlg" value="鍏抽棴" onclick="pageSubmit(0);"/>
</p>
<p>*鎿嶄綔鍚庣郴缁熶細閲嶅惎</p>