Airtel DragonPath (707GR1) Router unlock

[SR7007]

The device is downgraded using a tool bro, then flash a new firmware.

 

[Nandeesh13]

@SR7007 Which tool? Can i get link for that? and guide?

 

[chiraglol]

I'm probably very late to the party but 707GR1 is fairly easy to mess with.

router firmware version (what i tested with)

V01.00.01_152

[th]
Firmware Version

[/th]


1. go to your gateway address, login
2. head over to advance(d) -> advance -> remote access
3. open devtools, go to console, type $$("iframe")[0].src, navigate to this url
4. go back to console, type document.querySelectorAll('button, input, select, textarea').forEach(el => el.disabled = false);
5. check everything for LAN and uncheck everything for WAN. (IMPORTANT: if something is already checked, uncheck it and check it again), press apply changes

you should now be able to ssh as the user user with the password user, however that does not grant all permissions.
6. lookup how to use tftp on your os, copy the file /etc/passwd locally (using tftp get), copy the hash for the user user and replace the hash for the user admin with it, use tftp put to replace the /etc/passwd file on the router.

ssh as the user admin with password user.
you should now have access to everything on the router, it'll open the router cli, feel free to disable tr069 using that, and then hop it into shell by typing sh.

my main purpose behind doing this was to somehow get ipv6 working (which i did, although unfortunately with a nat66-like config)
you can end up doing pretty cool shit, i managed to get my landline working on my pc