Debrand Ericsson W35 - Rogers Rocket Dock

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • nanakomeah
    Newbie
    • Nov 2013
    • 2

    #61
    little beastie
    ....Say it again, So apart from the stock ones that have the login credentials in the admin guide don't u know how or a software i can use to unlock.

    Comment

    • westofanywhere
      Newbie
      • Aug 2012
      • 17

      #62
      @nanakomeah:

      that is exactly right. It is only recently that I became aware of the root password that would allow access to, and the unlock of, the Rogers variant of the W35. Basically, any cellular ISP that provides the Ericsson W35 usually set them up with their own passwords.

      westofanywhere

      Comment

      • markko
        Newbie
        • Dec 2013
        • 1

        #63
        I'd appreciate any pointers or tips re: what settings to save or replace if I unlock my Rogers branded Ericsson W35 using the previously noted instructions.. I ended service with Rogers and want to use the hub as a mifi type device when traveling in the US. I think I'd opt for a service that uses AT&T's network. As a side note, the hub as it is works with Fido's service. I just changed the APN to one of Fido's and it worked. (Roger's owns Fido) Do you think it will work as it is (just change to AT&T APN) or will I need to unlock it?

        Comment

        • macovet
          Newbie
          • Apr 2014
          • 2

          #64
          Hello all - nice to find this thread!

          I have the Bell's Ericsson W35 Data & Voice Terminal.
          I did a firmware upgrade to version w35-006-R12C003.arc

          After the upgrade, it seems that the router have been locked.
          I am trying to connect through the web interface with password 'user' and I am getting the following message :
          -Enter password to access personalization options.
          -Password: user
          - 'The system database cannot be accessed right now, since it is locked. Please wait and retry later. Press back and correct the error.'
          The same through telnet.

          some specs:
          Before Upgrade:
          Product Id:KRC 101 1467/14 R2B
          Boot Loader: CXC 172 7029 R1A (Dec 9 2008)
          Application Software: CXC 172 7031 R13B (Nov 18 2010)


          My upgrade was with w35-006-R12C003.arc firmware.
          Any suggestions?

          Comment

          • jdupek
            Newbie
            • May 2014
            • 2

            #65
            can you flush with an original firmware version?

            Originally posted by macovet
            Hello all - nice to find this thread!

            I have the Bell's Ericsson W35 Data & Voice Terminal.
            I did a firmware upgrade to version w35-006-R12C003.arc

            After the upgrade, it seems that the router have been locked.
            I am trying to connect through the web interface with password 'user' and I am getting the following message :
            -Enter password to access personalization options.
            -Password: user
            - 'The system database cannot be accessed right now, since it is locked. Please wait and retry later. Press back and correct the error.'
            The same through telnet.

            some specs:
            Before Upgrade:
            Product Id:KRC 101 1467/14 R2B
            Boot Loader: CXC 172 7029 R1A (Dec 9 2008)
            Application Software: CXC 172 7031 R13B (Nov 18 2010)


            My upgrade was with w35-006-R12C003.arc firmware.
            Any suggestions?

            Comment

            • macovet
              Newbie
              • Apr 2014
              • 2

              #66
              Originally posted by jdupek
              can you flush with an original firmware version?
              Well, I can't login to the web interface. Is there a way to cold flush without login?

              Comment

              • jdupek
                Newbie
                • May 2014
                • 2

                #67
                this is from ericssonw35.com, can you ask Rogers to provide you with their original firmware file?

                Important

                Attn: Bell, Rogers & Telstra Customers
                Using this firmware will corrupt your W35's software and cause the warranty to be void. Please contact your carrier for software updates.

                (i) Please Note: Firmware upgrades are done at your own risk.

                (ii) A reboot before upgrading is recommended

                (ii) If your current firmware revision does not appear in the list above then it is highly likely you have unique firmware from your carrier, if this is the case upgrading using the above firmware may cause your unit to become inoperable. Contact your carrier for a software upgrade file.

                (iv) WLAN needs to be turned off to conserve memory during the upgrade.

                (v) Files do not need to be uncompressed.

                Comment

                • slyaskiw
                  Newbie
                  • Jul 2014
                  • 1

                  #68
                  I found an interesting thread wiht the root user and password.

                  Rocket Hub a.k.a Ericsson W35 Official Rogers Unlo... - Page 6 - Rogers Community

                  Hope this helps unlock the W35.

                  Comment

                  • denvalicious
                    Newbie
                    • Feb 2015
                    • 2

                    #69
                    Interesting thread but i dont understand

                    How can i get my ericsson w35 from zain Ghana unlocked ?

                    Comment

                    • denvalicious
                      Newbie
                      • Feb 2015
                      • 2

                      #70
                      am still asking if anyone has a success story about unlockng
                      this ericsson w35 router

                      Comment

                      • tr3ce13
                        Member
                        • Nov 2010
                        • 58

                        #71
                        format a flash drive ext2, make rw directoy & put into w35
                        open metasploit-framework console
                        samba symlink directory transvers
                        use auxiliary/admin/smb/samba_symlink_traversal
                        set RHOST 192.168.1.1
                        set SMBSHARE your_share
                        set SMBTARGET rw_dir/rootfs
                        exploit

                        add nat port on web interface and don't close.

                        create portforward router-cleanup.sh and staticroutes files with only this line
                        cd /;rwwipe files

                        copy 3 files to smb://192.168.1.1/your_share/rw_dir/rootfs/tmp/

                        go to navigator and refresh nat page (F5)

                        oooppp database error !!!!

                        wait 15 seconds, unplug ac & replug.

                        unbranded and root with default root passwrd, feb.07

                        but sierra MC8790V still locked :-(

                        my operator passwd file, metasploit faster than john :-p

                        root:$1$85W4UCwy$4rTH.lqYhFkdmjrbEq8Rr.:0:0:root:/root:/bin/sh
                        Last edited by tr3ce13; 18 August, 2015, 08:02.

                        Comment

                        • kevinds
                          Newbie
                          • Sep 2013
                          • 1

                          #72
                          Yes, very easy for the Rogers version...

                          root password is:
                          R0ger5

                          Log into the CLI, SSH on 22

                          Enter this command:
                          rwclean files

                          Wait 2-3 minutes, then power cycle..

                          New root password is:
                          feb.07

                          W35 wasn't SIM locked, just firmware locked.. Rogers' anyways

                          @tr3ce13 I may try this on a Bell one in a few days

                          Is the directory in the ext2 flash drive, 'rw' or 'rw_dir' ? I see your further instructions have 'rw_dir' in the path.
                          Also might try using ShellShock to do this... Unfortunately it has been a while since I played with the W35, and my Linux skills aren't that high, but worth a try right?
                          Last edited by kevinds; 29 August, 2015, 11:27. Reason: Remove Telnet reference

                          Comment

                          • tr3ce13
                            Member
                            • Nov 2010
                            • 58

                            #73
                            Originally posted by kevinds
                            Yes, very easy for the Rogers version...


                            Is the directory in the ext2 flash drive, 'rw' or 'rw_dir' ? I see your further instructions have 'rw_dir' in the path.
                            Also might try using ShellShock to do this... Unfortunately it has been a while since I played with the W35, and my Linux skills aren't that high, but worth a try right?
                            Any dir with rw permissions, change name as you want

                            Comment

                            • Richyboo
                              Newbie
                              • Nov 2016
                              • 2

                              #74
                              So great seniors on this wonderful thread, pls for novices like myself who don't have an idea as to how these command editing work, pls how can we go about unlocking the w35

                              Comment

                              • Richyboo
                                Newbie
                                • Nov 2016
                                • 2

                                #75
                                I see the commands alright but I don't know to go about it, pls help

                                Comment

                                Working...