Last week I was asked if I knew how to enable SSH access on a Sphairon (ZyXEL) Speedlink 5501. My previous technique for the HomeBox 3232 (also manufactured by Sphairon) did not work as the expected magic bytes in the configuration backup file of the Speedlink 5501 could not be found. So I had to reverse this new file format to see, if a similar technique can be applied here.
- Sphairon Access Network & Wireless Cards Driver Download For Windows 8
- Sphairon Access Network & Wireless Cards Driver Download For Windows Xp
In this post I will explain the details of this new file format. With this knowledge we can unpack, modify and repack config files. Secondly, I will show you what config options have to be modified, in order to enable SSH access. Unfortunately, I have no time to write a ready-to-use tool this time. But anyone is invited to use these results to code their own unpacker. Please let me know, if you publish something so I can link to it from here.
Reversing the config file format
I downloaded the Firmware V4.37.2.4.4 from Deutsche Telekom. Using binwalk two lzma-compressed SquashFS file systems were easily spotted.
These filesystems were unpacked using the squashfs-tools from SquashFS 4.3 on a Debian system running 3.2.60 kernel (read here why this is important).
After browsing the first filesystem (named rootfs) it turned out, that it most likely contained no code related to the config file handling. So I started to investigate the second filesystem (named servfs) and quickly found a library called libconfig-export-api.so which sounded interesting to me.
By reverse engineering a part of the library’s code, the config file structure of the Speedlink 5501 could be reconstructed. It uses a 72 byte header followed by a gzipped tar archive (.tgz) of arbitary length.
The header contains two SHA-1 hashes. The first hash, tgz_sha1, is computed over the .tgz archive in which the actual configuration is stored. The second hash, header_sha1, is computed over the first 40 bytes of the header (i. e. up to header_sha1). Therefore, tgz_sha1 must be computed first, when assembling the header.
- Logging you out. This may take a few seconds FAQ username: password.
- Bus 001 Device 005: ID 114b:0110 Sphairon Access Systems GmbH Turbolink UB801R WLAN Adapter It uses the rt2500usb driver. The system worked with 11.1 and 11.3RC1 without problems.
Enabling SSH access
The 192.168.0.1 router IP address is a private address, and it’s used as the default router IP address for certain routers, including some models from Cisco, D-Link, LevelOne, Linksys, and many others.
After you have unpacked the .tgz file, you will have several subdirectories of which one is named sql. Inside you will find several .sql files. Open sql/persistent-network.db.sql with a text editor.
First we will modify the firewall to allow access on port 22. Search for “FirewallRulesStatic” and you will see the existing firewall rules (in my case 9 rules, IDs 0.8).
Simply append a 10th rule (with the ID 9) like this:
If you are curious for the syntax, you can scroll up a bit where the table FirewallRulesStatic is created. Most options should be self-explanatory.
Secondly, we will enable the SSH daemon. Search for the line
and change it to
Finally, we enable the existing SSH account. Search for
Sphairon Access Network & Wireless Cards Driver Download For Windows 8
and change it to
It is advisable to change the username and password as well.
Sphairon Access Network & Wireless Cards Driver Download For Windows Xp
After you have made all your changes, save the .sql file and repack everything back to a .tgz file. Unibrain 1394 driver download. Next, compute both SHA-1 hashes and modify the header accordingly. After the config file is uploaded to the router, it will reboot and start a SSH daemon for you.