How to "jailbreak" a TP Link EX230v, VX230v, EX530v Router

TP-Link Jailbreak.md

How to "jailbreak" a TP Link EX230v, VX230v, EX530v Router

TP-Link have a special product range of routers designed for ISP-managed fleets, typically provided as the ISP-supplied router. This includes models like EX230v, VS230v, and EX530v, there may be more too.

It supports remote provisioning/configuring via a protocol called TR-069. The jist of it is, your ISP will host a server, and your router "phones home" to get the latest config.

Usually the Access Control Server (ACS) is baked into the router's firmware, so even a pinhole reset of your router won't give you freedom from their control.

Admin vs Superadmin

The EX530v has two admin pages. The "admin" page is accessed via $ROUTER_IP, and the "superadmin" page is accessed via $ROUTER_IP/superadmin.

The settings menus available to the "admin" user are configurable by your ISP. As you can imagine, many ISPs restrict the "admin" user's privileges, and lock users out of the "superadmin" page, mostly for their own convenience. For example, my ISP did not expose port forwarding settings.

I expect if you're reading this, you're technical enough to know how to use these poweruser features. You'll know how to do a factory reset if you mess up. You're not who your ISP is worried about.

Who is this guide for?

• If you have access to the admin page, but not the superadmin page, this guide is for you!
• If you have access to the superadmin page, you don't need this guide. (If you want to disable the Access Control Server, skip to I just want to disable my ISP's ACS)
• If you don't have access to the admin or superadmin pages, perhaps try a pinhole factory reset. This should gain you access to the regular admin page.
• If you're trying to get SSH or root terminal access, this guide isn't for you.

Objective

The objective of this "jailbreak" is to setup our own locally hosted ACS called GenieACS. We'll use inspect element magic to open the hidden ACS admin page. We'll use GenieACS to provision a new superadmin page password, which will get us the access we want. Once that's done, you can shut down that ACS, you don't need to keep it around.

Dependencies

• GenieACS
• Node.js: 12.3+
• MongoDB: 3.6+

Instructions

Part 1: GenieACS

First we'll deploy GenieACS to a device on the router's LAN, I ran it on my laptop that's connected to the router's WiFi.

1. Install NodeJS. Currently GenieACS supports 12.3+.
2. Start a MongoDB database. Let's just spin up a temporary mongo via docker: docker run -d -p 27017:27017 --name=mongo-genieacs mongo:8.0
3. Open the GenieACS repo's releases here and download the latest .tgz release and extract this to a useful location
4. Open two terminal windows in the location you extracted GenieACS to. Run the GenieACS CWMP server and Web management UI:
   1. ./bin/genieacs-cwmp
   2. ./bin/genieacs-ui --ui-jwt-secret secret
5. Observe the startup logs to ensure there are no errors.
6. Open the GenieACS UI via 127.0.0.1:3000 and hit ABRACADABRA!, then Open Sesame!. Login with the default credentials, admin:admin.

Part 2: Change ACS URL

1. Open the admin page at $ROUTER_IP and login.
2. Open inspect element in your browser and open the console. Enter this: $.loadMain("/cwmp.htm");. This will open the hidden CWMP Settings page.
3. ⚠️ Take a screenshot of all the options here before changing anything, including un-hiding the password fields, you may need to restore these settings back to how they were before! ⚠️
4. Set the relevant config
   1. Ensure CWMP and Inform are on
   2. For DataType, uncheck TR181 and check TR098
   3. Set Inform Interval to something fairly low, like 30
   4. Set ACS URL to $SERVER_IP:7547, replacing $SERVER_IP with the local IP of the device you are hosting the GenieACS server on.
   5. Empty ACS Username and ACS Password
   6. Set Interface used by TR-069 client to LAN
   7. Uncheck Connection Request Authentication
   8. Uncheck Simple Traversal of UDP over NATs

Your router should be setup to use your GenieACS server.

Part 3: Change superadmin password

At this point, click the Devices tab of the GenieACS admin UI. You should see your router. If it is not there, ensure your GenieACS server is accessible and try rebooting the router.

_{^{While trying to figure this all out, I frequently found that my router simply stopped making ACS requests sometimes, maybe it's a router bug.}}

1. Click Show on your router.

2. You should see the Last inform date being somewhat recent, the device should show Online now. If you click Summon and then Commit, you should see a green result rather than a red one.

   _{^{If it goes red, this probably means the router has registered to the ACS server, but the ACS server can't reach the router. Double check the CWMP Setting Set Interface used by TR-069 client is to LAN.}}

3. Under the All parameters page, scroll down to find these parameters:

   InternetGatewayDevice.User.1	
   InternetGatewayDevice.User.2
   

4. At the right-side, you should see a 🔄 refresh button. Click this for both InternetGatewayDevice.User.1 and InternetGatewayDevice.User.2, then press Commit at the top of the page.

5. This will load several more parameters:

   InternetGatewayDevice.User.1	
   InternetGatewayDevice.User.1.Enable			true
   InternetGatewayDevice.User.1.Password	
   InternetGatewayDevice.User.1.RemoteAccessCapable	true
   InternetGatewayDevice.User.1.Username			admin
   InternetGatewayDevice.User.2	
   InternetGatewayDevice.User.2.Enable			true
   InternetGatewayDevice.User.2.Password	
   InternetGatewayDevice.User.2.RemoteAccessCapable	true
   InternetGatewayDevice.User.2.Username 			user
   

6. The user with Username admin is the "superadmin" user. The user with Username user is the "admin" user.

7. Click the edit ✏️ symbol on the Password field for the superadmin user (called Username admin). For me this was the InternetGatewayDevice.User.1.Password parameter.

8. Enter the password you want for the superadmin page. This must be at least six characters long, including two different types of characters (letters, numbers, or special characters). Press Queue and then Commit.

9. Try logging into the $ROUTER_IP/superadmin page, it should work now! (You may need to log out of the regular admin page first.)

Part 4: Cleanup

1. Stop the GenieACS CWMP server and web management UI.

2. Shut down the local MongoDB server:

   docker stop mongo-genieacs
   docker remove mongo-genieacs
   

3. (OPTIONAL) Manually check for firmware updates on the superadmin page. It's quite likely your router has a firmware update that your ISP has not bothered to provide you.

4. Return to your router's CWMP Settings page. At this point you have two options:

   • Turn off the CWMP and Inform settings and leave your router "unmanaged".
   • Restore the ISP-supplied settings you previously took a screenshot of. It's quite likely you might not want to do this step. It's possible that the ISP's ACS server will restore the superadmin password back to something unknown and lock you out again. Additionally, it is possible for them to remotely do some pretty scary stuff from their ACS server, so you might prefer not having an ISP backdoor!

I just want to disable my ISP's ACS

⚠️ Take a screenshot of all the options here before changing anything, including un-hiding the password fields, you may need to restore these settings back to how they were before! ⚠️

If you already have superuser access and simply want to disable your ISP's ACS, this is super easy. Simply open the $ROUTER_IP/superuser page, click Advanced > System Tools > CWMP Settings and turn off CWMP and Inform at the top of the page.

Thanks, that worked great! Just a quick suggestion for your instructions, the password needs to be at least six characters long and must include at least two different types of characters (letters, numbers, or a special character) otherwise the update will fail.

Also, you can update user account permissions under the Account Management section on the administration page, so you don’t have to log in as super admin any longer to make changes.

Lastly, you may also want to disable TR-369 to prevent your ISP from making changes to the router remotely.

Glad to hear it worked. Thanks for the tips, I’ll make some enhancements.

Very nice. I just got an EX530v from my ISP, and I was able to set a new superadmin password and turn off the CWMP and Inform fucntions.

I also turned off the TR369 function, and made a few other changes.

What we need now is an OpenWRT image, so I can set up proper secure DNS, and other fancy stuff ...

... anyways, many thanks for your outstanding work.