Ambit 250/255 Webstar 2100 Attacked

[boogeyman]

Originally Posted by toon_army

ok m8 no worries and thanx for letting me know



can any1 else shed some light on the situation as to wether i can reflash my modem and use it again or wether getting a new flashed modem would work thanx in advance

hi mate, if you wanna reflash you need a lift the tsop and flash a working dump with a williem programmer. by a new modam that hasnt been flashed and i will help you out.

[boogeyman]

Originally Posted by toon_army

alright all just wanted to know if i can use the firmware upgrade method using ethernet on the haynes cable manual and will it work if my modem has been attacked cheers

if modem has been hit, you needf to reprogram the tsop, not for faint hearted

[boogeyman]

Originally Posted by matthew4321

modems that have been bricked will come back on line, the two modems i have came back on line yestoday..this might help

your modems wernt bricked, you had macs blacklisted, belive me, brick modems dont come back to life on there own.

[boogeyman]

Originally Posted by lincsat

change the serial number of the infinite firmware:
power up modem without feed just Ethernet
now open hyperterminal and set your settings to:
connect using = TCP IP (winsock)
host address = 192.168.100.1
port number = 23
and login in with user & pass
then copy and paste the stop scan cmd:
Code:
cd \cm_hal
scan_stop
cd /
cd non-vol
cd snmp_cm
docsDevSerialNumber cmxxxxxxxxxxxxx (replace the xxxxxxxxxxxxx with the MAC without the
write
reboot modem.
Changing The USB MAC.
power up [modem] with-out feed just ethernet cable.
now open hyperterminal and set your settings to:
connect using = TCP/IP (winsock)
host address = 192.168.100.1
port number = 23
and login in with user & pass
then copy and paste the stop scan cmd:
Code:
cd \cm_hal
scan_stop
now enter the following cmds:
Code:
cd /
cd \non-vol/halif
usb_mac_address 00:xx:xx:xx:xx:xx (Make this 1 higher than your Normal MAC)
write

You can also use the terminal facility in the Ambit tool to perform these commands

the serial cmd is wrong, you dont type the cm. to change the seriel to mac you type mac in caps without :
for example docDevSeriel 1A2B3C4D5CE3

[lincsat]

Actually you do type the cm before the serial number - I may have only done a couple, but they both needed the cm.

E.G. docDevSeriel cm1A2B3C4D5CE3

[slacky]

how do i check if its changed or not? do i need to put it in capitals because i didnt

[boogeyman]

Originally Posted by lincsat

Actually you do type the cm before the serial number - I may have only done a couple, but they both needed the cm.

E.G. docDevSeriel cm1A2B3C4D5CE3

that cmd will work for flashed modems for around another 2 weeks, modems are being bricked via snmp and failed updates.

cm is the command for the hackware, to changed the original firmware so it looks ligit you dont type cm

[boogeyman]

Originally Posted by slacky

how do i check if its changed or not? do i need to put it in capitals because i didnt

i am guessing that u are using hackware, aslong as the command took and it told you settings have been written it should be fine.

[boogeyman]

how to flash an unmodified virgin modem to work on original firmware - by adam/ the jolly bodger - inspired by iamhim's guide for the 120, credit also to hackmax, breed, gentlex & solster
the point of this is that a recent attack used snmp responses which annouce the modem was an ininite, doh!
using original formware means that all the snmp response will be correct and by not enabling telnet etc we are keeping everything as genuine as possible.

install solarwinds tftp server or tftip32
save sb5100e.bin to c:\tftp-root
set network adapter to 192.168.100.6
run solarwinds
connect your max 232/233 to the modem
run hyperterminal, type in any name,connect to com1 (or whatever your using) change the baud rate (bits per second) to 115200 and press enter.
power up the modem and press p within 2 seconds
change board ip to 192.168.100.1 and press enter
press enter 4 times
select option g (run from ram)
set your tftp server as 192.168.100.6 and press enter
type sb5100e and press enter
file should transfer
when complete it will say Store parameters to flash ? [n] press enter
it will reboot and when you see the message 'The chosen tuner is not supported' type cd cm and press enter
then type scan_s and press enter
scanning should stop
type cd n\h (enter)
type mac_address 1 (followed by your good mac ie aa:bb:cc:dd:ee:ff) (enter)
type mac_address 2 (followed by your good mac ie aa:bb:cc:dd:ee:ff +1) (enter)
type usb_mac (followed by the same one you put for mac 2 above) (enter)
type cd \ (enter)
type cd n\snmp (enter)
type docsDevSerialNumber (followed by your mac, but in capitals and without the ':' (enter)
type cd \
type cd n\d (enter)
type enable bpi false (enter)
type dhcp_settings (enter)
hit enter 3 times
it should say 'Those are the only 3 that really need to be changed.
Do you want to change the other settings? [no]' type yes (enter)
now type in your tftp ip (enter) (you should know how to find this)
press enter
type cd \ (enter)
type cd n (enter)
type wri (enter)
type cd \ (enter)
type res (enter)
modem should reboot and is sorted.

[lincsat]

The file and TUT is in the downloads - just to confirm, this is for UNMODIFIED modems.