Extract Jio Backup file data

[cochin007]

From JIO Router we can back up the settings.
But its encrypted using some certificate . Is there anyway to decrypt this to see if we can disable something ourself.
I used Nginx proxy manager to put my website on internet but issue is there is some code which doesnt allow the modem from accessed outside 192.168.29.X network or may be it checks the domain name(not sure)
Any one knows how to see the data in backup or any hacks for the router.?

 

[symshilld]

Try the Github link mentioned here: JioFiber Root Access [How to] [with Proof] | Reliance JioFiber

there is some code which doesnt allow the modem from accessed outside 192.168.29.X network

I can SSH into my device connected to the router from outside using IPv6.

 

[cochin007]

I was able to edit in the html source just for fun to disable dms server. Not sure if it works .. Bridge doesnt work anyway...
another question is if you are able to get into the box cant u get the certificates used to encrypt the jio backup file?Its a crap router because i could see some wifi once which i could see without ssid...

 

[cochin007]

Quick question ? has any one used anything like openwrt and spoof the mac id of jio router.. it shoulld work right? if the port of jio checks just for mac id..Those with root access can check if there is some password for PPOE authentication like small ISP

 

[symshilld]

Afaik, Jio doesn't use PPPoE authentication. The ACS server tags VLAN ID's.

 

[cochin007]

vlan id is just a number like 200 or 02 right? How is it working?isnt it a tag applied to network packets to group it?

https://fota.slv.fxd.jiophone.net/ONT/Skyworth/JCOW407/SKYWTF1_JCOW407_R2.45.img is the firmware for skylink
SKYWTF1_JCOW407_R2.45 ,It needs key to decrypt which i dont have

 

[cochin007]

This curl works


curl 'http://192.168.29.1/platform.cgi' \
-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7' \
-H 'Accept-Language: en-US,en;q=0.9' \
-H 'Cache-Control: no-cache' \
-H 'Connection: keep-alive' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-H 'DNT: 1' \
-H 'Origin: http://192.168.29.1' \
-H 'Pragma: no-cache' \
-H 'Referer: http://192.168.29.1/platform.cgi?page=index.html' \
-H 'Upgrade-Insecure-Requests: 1' \
-H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36' \
--data-raw 'thispage=index.html&users.username=admin&users.password=Android%4022&button.login.users.dashboard=Login' \
--compressed \
--insecure





But in POst man i used

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 105
Content-Type: application/x-www-form-urlencoded
DNT: 1
Host: 192.168.29.1
Origin: http://192.168.29.1
Pragma: no-cache
Referer: http://192.168.29.1/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36



Body as
thispage: index.html
users.username: admin
users.password: Android@22
button.login.users.dashboard: Login


But it fails.. ANy one who knows why ? It goes back to error in login and again asks me to login
<h1 class="unAuthorised" style="line-height:60px !important">A critical error encountered while loading web page </h1>
Any one?