"Hacking" the (Telekom) Zyxel GPON SFP module (PMG3000-D20B)

Overview

"Hacking" the (Telekom) Zyxel GPON SFP module (PMG3000-D20B)

The SFP can be sourced very easily and is widely available in Germany.

TLDR

Checkout the three options for configuring your SFP.

1. WEB UI

  1. Configure the ethernet interface the SFP is in with the IP 10.10.1.2/24.
  2. Port-forward the SFPs web interface to your local machine via SSH: ssh -L 127.0.0.1:8080:10.10.1.1:80 .
  3. Access the web-interface on http://localhost:8080, username admin, password 1234.

2. CLI (on the SFP)

Note: The PLOAM ID has to be HEX encoded, in case yours is a 10-character string, you can transform it using python3 -c 'print(hex(" "))' . Omit the 0x prefix.

  1. Configure the ethernet interface the SFP is in with the IP 10.10.1.2/24.
  2. SSH into the module using [email protected], password admin.
  3. Login into the CLI with user admin, paddword 1234.
  4. Change the PLOAM/SLID/Installationskennung by entering following commands followed by a newline:
    • hal
    • password

3. CLI (remote)

Note: requires Python >= 3.8

NAME
    zyxel_gpon_sfp.py --sfp_addr=http://10.10.1.1

SYNOPSIS
    zyxel_gpon_sfp.py --sfp_addr=http://10.10.1.1 - COMMAND

COMMANDS
    COMMAND is one of the following:

     info

     set_slid

     set_sn

Motivation

My ISPs (Deutsche Telekom) FTTH offering uses on a GPON network and distributes ONUs with a 1G (or 2.5G Ethernet) for non-business customers. I intended to run the fiber directly into my Linux router (using one of the SFP+ ports). Looking at the business offerings building upon the same technology revealed SFPs distributed only business customers using the Digitalisierungsbox Premium 2. The mentioned SFP is made by Zyxel with the identifier PMG3000-D20B and sold as Digitalisierungsbox Glasfaser Modem (Telekom only sells it to business customers but it is available online for ~40 Euros).

Accessing the module

After reverse engineering (this time it has been a fzf through all files, not analysing the binaries) the firmware of Telekom Digitalisierungsbox 2, I've identified the IP address of the module being 10.10.1.1/24 based on a SQL statement with a comment:

-- BS-6456: remove marker 'RESERVED' from static IP used to access the SFP module
UPDATE Ip SET Name="" WHERE IpAddress="10.10.1.2" AND Interface="eth1" AND LogicalInterface="eth1";

Digging a bit further in plaintext SQL statements reveals the credentials.

-- ...
INSERT INTO SshConfiguration VALUES ( 1, 0, 5, 22, 'Access only for authorized persons!', 0, '' );
INSERT INTO SshUser VALUES ( 1, 0, 'admin', 'admin', 0 );
-- ...
INSERT INTO GPONConfig VALUES ( 1, 1, '10.10.1.1', 'admin', '1234', '', '' );

Well, let's give it a try. SSH access sounds like a charm and is confirmed by nmap:

xvzf@e300 ~ % nmap 10.10.1.1
Starting Nmap 7.80 ( https://nmap.org ) at 2022-02-02 06:31 UTC
Nmap scan report for 10.10.1.1
Host is up (0.00079s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: <redacted> (Zyxel Communications)

Nmap done: 1 IP address (1 host up) scanned in 4.15 seconds

Let's give it a try with ssh [email protected]:

#######################################################
#                                                     #
# Please login to CLI mode. Then You can do commands. #
#                                                     #
#######################################################

Entering character mode
Escape character is '^]'.


Login: admin
Password: 
   
   
    
    
ZYXEL#
ZYXEL# 
    
    
     
     
  linuxshell  Enter linux shell
  show        show
  system
  manufactory
  config
  mib
  sf
  log
  timer
  bsp
  hal
  igmp
  omci
  ssp
ZYXEL# show version
Project Name:              TW2362H-CDEL
Client Product Name:       GTO100I_SFP_ZYXEL
Internal Product Name:     GTO100I_SFP_ZYXEL
Hardware Version:          PMG3000-D20B
Boot Version:              V1.0.0
Client Software Version:   V1.0.0
Internal Software Version: V1.0.0
Build User:                jiangyuanqi
Build Time:                2021-05-08 11:28:36
Build Method:              export ONU=gto100i_sfp_zyxel && cd ../drv && make install && cd .. && make rootfs && make install
GIT Info:                  TW2362H-CDEL_lantiq98035/customize/TW2362H-CDEL_lantiq98035_general_20150131:e057bd83
ZYXEL#

    
    
   
   

So, we can get a linux shell, nice. My SFP is running a (very old) release of OpenWrt:

ZYXEL# linuxshell
BusyBox v1.19.4 (2014-06-30 12:00:02 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 ATTITUDE ADJUSTMENT (Attitude Adjustment, 12.09_ltq)
 -----------------------------------------------------
  * 1/4 oz Vodka      Pour all ingredients into mixing
  * 1/4 oz Gin        tin with ice, strain into glass.
  * 1/4 oz Amaretto
  * 1/4 oz Triple sec
  * 1/4 oz Peach schnapps
  * 1/4 oz Sour mix
  * 1 splash Cranberry juice
 -----------------------------------------------------
admin@SFP:~# uname -a
Linux SFP 3.10.12 #2 Wed Jul 12 12:01:33 CST 2017 mips GNU/Linux
admin@SFP:~#

Changing GPON Serial Number / PLOAM Password

ZYXEL# hal
Hal#
  linuxshell  Enter linux shell
  show        show HAL configuration
  sn          change ont parameters
  password    change ont password
  set         set ont parameters
  to1         change ont to1 interval
  to2         change ont to2 interval
  berinterval change BER interval
  sfthreshold change SF threshold
  sdthreshold change SD threshold
  tcont       add tcont
  no          delete HAL item
  gemport     add HAL item
  reset       Reset all pon configurations
  get         get
  omci        omci
  stream      stream
  mvlanaction mvlanaction
  uni         PPTP UNI configuration
  mtu         MTU R/W
  multicast   multicast configartion
  iphost      iphost
  init        init
  deny        deny
  permit      permit
  monitor     monitor
  mac         mac
  storm       storm
  print       print
  igmp        igmp
  mcastfilt   McastFilt
Hal# sn
  
   
   
    
     change ont serial number
Hal# password
  
    
    
     
      Formate:XXXXXXXXXXXXXXXXXXXX

    
    
   
   

The password seems to consist of 10 bytes, entered hex encoded. This is likely the PLOAM password / SLID / Installationskennung / whatever you'd like to call it. The sn seems to change the serial number of the ONU (ONT) itself, I did not test that so far.

I assumed the CLI is using the configuration interface of OpenWRT under the hood; turns out I was right:

uci show gpon
gpon.ploam=gpon
gpon.ploam.nPassword=0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20 0x20
gpon.ploam.nT01=16000
gpon.ploam.nT02=100
gpon.ploam.nEmergencyStopState=0
gpon.ploam.nRogueMsgIdUpstreamReset=255
gpon.ploam.nRogueMsgRepeatUpstreamReset=3
gpon.ploam.nRogueMsgIdDeviceReset=255
gpon.ploam.nRogueMsgRepeatDeviceReset=3
gpon.ploam.nRogueEnable=0
gpon.gtc=gpon
gpon.gtc.bDlosEnable=0
gpon.gtc.bDlosInversion=0
gpon.gtc.nDlosWindowSize=0
gpon.gtc.nDlosTriggerThreshold=0
gpon.gtc.ePower=0
gpon.gtc.nLaserGap=0
gpon.gtc.nLaserOffset=0
gpon.gtc.nLaserEnEndExt=0
gpon.gtc.nLaserEnStartExt=0
gpon.gtc.nDyingGaspHyst=0
gpon.gtc.nDyingGaspMsg=0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
gpon.gtc.nDyingGaspEnable=0
gpon.ethernet=gpon
gpon.ethernet.bUNI_PortEnable0=1
gpon.ethernet.bUNI_PortEnable1=1
gpon.ethernet.bUNI_PortEnable2=1
gpon.ethernet.bUNI_PortEnable3=1
gpon.gpe=gpon
gpon.gpe.nPeNumber=6

Observing the GPON SN and Password in real time.

Serial and Password

The onu command helps debugging the system:

  • onu gtcpg: Retrieve password
  • onu gtcsng: Retrieve serial number

Connection state

Connected (curr_state=5)

admin@SFP:~# onu ploamsg
errorcode=0 curr_state=5

Disconnected (curr_state=1):

admin@SFP:~# onu ploamsg
errorcode=0 curr_state=1 previous_state=0 elapsed_msec=16907701

HTTP API

Only after getting SSH access I discovered the SFP comes with a WebUI and a sort of API. The CLI zyxel_gpon_sfp.py makes use of this API to remotely configure the PLOAM password and possibly SN (again, didn't check it).

TODO

  • Prometheus exporter
  • Integrate into OpenWRT
Comments
  • Is access to the web interface without fibre connection possible?

    Is access to the web interface without fibre connection possible?

    Hi, I'm currently trying to set up the module in my pcengines APU6. Since I cannot access the web interface: Is this only possible when the SFP is physically connected to the GPON link?

    ethtool reports the module correctly:

    # ethtool enp1s0
    Settings for enp1s0:
    	Supported ports: [ FIBRE ]
    	Supported link modes:   1000baseKX/Full
    	Supported pause frame use: Symmetric
    	Supports auto-negotiation: Yes
    	Supported FEC modes: Not reported
    	Advertised link modes:  1000baseKX/Full
    	Advertised pause frame use: Symmetric
    	Advertised auto-negotiation: Yes
    	Advertised FEC modes: Not reported
    	Speed: Unknown!
    	Duplex: Unknown! (255)
    	Auto-negotiation: on
    	Port: FIBRE
    	PHYAD: 0
    	Transceiver: internal
    	Supports Wake-on: pumbg
    	Wake-on: g
            Current message level: 0x00000007 (7)
                                   drv probe link
    	Link detected: no
    # ethtool -m enp1s0
    	Identifier                                : 0x03 (SFP)
    	Extended identifier                       : 0x04 (GBIC/SFP defined by 2-wire interface ID)
    	Connector                                 : 0x01 (SC)
    	Transceiver codes                         : 0x00 0x00 0x00 0x02 0x00 0x00 0x00 0x00 0x00
    	Transceiver type                          : Ethernet: 1000BASE-LX
    	Encoding                                  : 0x03 (NRZ)
    	BR, Nominal                               : 1200MBd
    	Rate identifier                           : 0x00 (unspecified)
    	Length (SMF,km)                           : 20km
    	Length (SMF)                              : 20000m
    	Length (50um)                             : 0m
    	Length (62.5um)                           : 0m
    	Length (Copper)                           : 0m
    	Length (OM3)                              : 0m
    	Laser wavelength                          : 1310nm
    	Vendor name                               : ZYXEL___________
    	Vendor OUI                                : 00:00:00
    	Vendor PN                                 : PMG3000-D20B____
    	Vendor rev                                : V1.0
    	Option values                             : 0x00 0x1a
    	Option                                    : RX_LOS implemented
    	Option                                    : TX_FAULT implemented
    	Option                                    : TX_DISABLE implemented
    	BR margin, max                            : 0%
    	BR margin, min                            : 0%
    

    But link is reported as DOWN:

    #ip addr
    1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
        link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
        inet 127.0.0.1/8 scope host lo
           valid_lft forever preferred_lft forever
        inet6 ::1/128 scope host
           valid_lft forever preferred_lft forever
    2: enp1s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
        link/ether 00:0d:b9:5d:d2:e0 brd ff:ff:ff:ff:ff:ff
        inet 10.10.1.2/24 scope global enp1s0
           valid_lft forever preferred_lft forever
    
    opened by frederictobiasc 9
  • Module into Switch or Firewall?

    Module into Switch or Firewall?

    Hey, we are getting fiber internet and because I am already running a OPNsense firewall in a VM with Intel NICs connected to my switch, my question is, do I have to connect the moduel with a pci-e card (via passthrough) to the VM or could I (ideally) put the GPON module into the SFP port of my NETGEAR switch and have it via a VLAN connected to the NICs/VM/OPNsense interface?

    Great project btw.

    opened by aronmal 4
  • Add instructions to enable 2.5G

    Add instructions to enable 2.5G

    This PR adds an instruction how to enable 2.5G on the GPON-SFP in case it isn't enabled by default.

    The Zyxel PMG3000-D20B SFPs I bought directly from a distributor had a default port speed of 1G and wasn't able to use 2.5G until I configured the speed manually using the CLI.

    opened by SoerenBusse 0
  • README.md: Add link to jaseg's router configuration guid

    README.md: Add link to jaseg's router configuration guid

    I wrote up a short guide on how to configure an Ubiquiti EdgeRouter since the part where you first have to access the SFP module's web interface to set the SLID/PLOAM pw, then configure PPPoE on the same interface is not obvious.

    opened by neinseg 0
  • X520-da2 with Zyxel-gpon-sfp // Speed Issue

    X520-da2 with Zyxel-gpon-sfp // Speed Issue

    Hi, finally i was able to establish WAN with my X520-DA2, the Zyxel Modul in a pfsense box. So technically its works but....

    the speed isnt quiet good as expected. i will get only ~800 Mbits on my 1G from "Deutsche Telekom FTTH". The Telekom ONT gives me 1070 Mbits Downstream (thanks telekom for overprovisioning) out of the box. So not even the 940 Ethernet Cap. Is this a problem with my X520 card? Can the X520 handle 2,5 Gbit with this SFP ONT? Unfortunately i cant see if the sfp is running in 2,5G or in 1G Mode.

    any clue? experience?

    opened by bkay86 0
  • Broadcom 57810S based SFP+ NIC compatibility

    Broadcom 57810S based SFP+ NIC compatibility

    Anybody can confirm compatibility of this SFP module with server/desktop NIC based on Broadcom 57810S chipset?

    Dell 0Y40PH or N20KJ
    HP 530SFP+
    10Gtek 57810S-10G-2S-X8
    

    Is soldering mod needed to get it working in these type of cards?

    Is management working when fiber is not plugged in?

    1Gbps (SGMII) speed is working with unmodified driver? Anyone tested 2.5Gbps (HSGMII) with modified driver?

    opened by k0xak 9
  • Changing the serial number with the sn command is not persistent

    Changing the serial number with the sn command is not persistent

    Hello,

    I use the SFP on a Telekom FTTH connection. The Telekom OLT expects an ONT with the same serial number as the old one that Telekom installed when providing the connection. If I change the serial number of the SPF with the sn command to that of the old ONT, the connection works. However, with each restart of the SFP, the serial number is reset to the initial value at delivery. Does anyone know a way to store the serial number permanently in to the flash storage? Of course I could also initiate a rediscovery by Telekom but I would like to keep the old ONT as a backup and that would then no longer work with its serial number.

    opened by lrjn 2
  • different username/password

    different username/password

    Hello, i have the same zyxel gpon.. but the admin/1234 combo don't work as login. Can someone explain how they were discovered in the first place so i can replicate the same tecnique on my module ?

    thanks

    opened by gionag 6
  • ONU Kernel Sources

    ONU Kernel Sources

    Credits go to @neinseg

    https://github.com/kbridgers/VOLTE4GFAX/blob/master/dl/gpon_omci_onu-4.5.0.tar.gz https://github.com/kbridgers/VOLTE4GFAX/blob/master/dl/gpon_onu_drv-4.5.0.tar.gz

    opened by xvzf 0
  • Default credentials for other carriers

    Default credentials for other carriers

    Having a look around the firmware I found out that there other default credentials besides "admin"/"1234" in the firmware that are used depending on the "customer" "soft feature":

    0x12 -> "root"/"integral" 0x13 -> "carbon"/"C@rB1N0x@m1NE" others -> "admin"/"1234"

    I don't know which ISPs these two values correspond to, but this may be useful to someone acquiring a non-telekom branded version of the same Zyxel module.

    opened by neinseg 17
Owner
Matthias Riegler
I::IPv6; currently doing platform engineering @traefik
Matthias Riegler
Hacking and Learning consistently for 100 days straight af.

#100DaysOfHacking Hacking and Learning consistently for 100 days straight af. [yes, no breaks except mental-break ones, Obviously.] This Repo is one s

FENIL SHAH 17 Sep 9, 2022
Transform your boring distro into a hacking powerhouse.

Pentizer Transform your boring distro into a hacking powerhouse. Pentizer is a personal project that imports Kali and Parrot repositories in any Debia

Michail Tsimpliarakis 2 Nov 5, 2021
Meilleur outil de hacking Zapp en 2021 pour Termux

WhatsApp-Tool Meilleur outil de hacking Zapp en 2021 pour Termux Cet outil est le seul prennant en compte les dernières mises à jour de WhatsApp. FONC

null 2 Aug 17, 2022
This repo will have a small amount of Chrome tools that can be used for DFIR, Hacking, Deception, whatever your heart desires.

Chrome-Tools Overview Welcome to the repo. This repo will have a small amount of Chrome tools that can be used for DFIR, Hacking, Deception, whatever

null 5 Jun 8, 2022
Module for remote in-memory Python package/module loading through HTTP/S

httpimport Python's missing feature! The feature has been suggested in Python Mailing List Remote, in-memory Python package/module importing through H

John Torakis 220 Dec 17, 2022
LAPS module for CrackMapExec

Crackmapexec-LAPS LAPS module for CrackMapExec Make sure to point to the DC Specify the full domain name Be careful the rid 500 might not be "Administ

null 28 Oct 5, 2022
A Python module for decorators, wrappers and monkey patching.

wrapt The aim of the wrapt module is to provide a transparent object proxy for Python, which can be used as the basis for the construction of function

Graham Dumpleton 1.8k Jan 6, 2023
Python screenshot library, replacement for the Pillow ImageGrab module on Linux.

tldr: Use Pillow The pyscreenshot module is obsolete in most cases. It was created because PIL ImageGrab module worked on Windows only, but now Linux

null 455 Dec 24, 2022
An ultra fast cross-platform multiple screenshots module in pure Python using ctypes.

Python MSS from mss import mss # The simplest use, save a screen shot of the 1st monitor with mss() as sct: sct.shot() An ultra fast cross-platfo

Mickaël Schoentgen 799 Dec 30, 2022
One Ansible Module for using LINE notify API to send notification. It can be required in the collection list.

Ansible Collection - hazel_shen.line_notify Documentation for the collection. ansible-galaxy collection install hazel_shen.line_notify --ignore-certs

Hazel Shen 4 Jul 19, 2021
An OrpheusDL Tidal module

OrpheusDL - Tidal A Tidal module for the OrpheusDL modular archival music program Report Bug · Request Feature Table of content About OrpheusDL - Tida

Daniel 54 Dec 29, 2022
Is a polybar module that will show you your progress in Hack The Box

HTB-Status for Polybar Is a polybar module that will show you your progress in Hack The Box indicating your current rank, global rank, points and resp

bitc0de 8 Jan 14, 2022
This module is for finding the execution time of a whole python program

exetime 3.8 This module is for finding the execution time of a whole program How to install $ pip install exetime Contents: General Information Instru

Saikat Das 4 Oct 18, 2021
Python module to work with Magneto Database directly without using broken Magento 2 core

Python module to work with Magneto Database directly without using broken Magento 2 core

Egor Shitikov 13 Nov 10, 2022
This module extends twarc to allow you to print out tweets as text for easy testing on the command line

twarc-text This module extends twarc to allow you to print out tweets as text for easy testing on the command line. Maybe it's useful for spot checkin

Documenting the Now 2 Oct 12, 2021
A module comment generator for python

Module Comment Generator The comment style is as a tribute to the comment from the RA . The comment generator can parse the ast tree from the python s

飘尘 1 Oct 21, 2021
This python module allows to extract data from the RAW-file-format produces by devices from Thermo Fisher Scientific.

fisher_py This Python module allows access to Thermo Orbitrap raw mass spectrometer files. Using this library makes it possible to automate the analys

null 8 Oct 14, 2022
Module for working with the site dnevnik.ru with python

dnevnikru Module for working with the site dnevnik.ru with python Dnevnik object accepts login and password from the dnevnik.ru account Methods: homew

Aleksandr 21 Nov 21, 2022
Python module for creating the circuit simulation definitions for Elmer FEM

elmer_circuitbuilder Python module for creating the circuit simulation definitions for Elmer FEM. The circuit definitions enable easy setup of coils (

null 5 Oct 3, 2022