Remotely obtaining router serial number

[lkzp]

Hello all

First post, didnt see a welcome section so Ill just dive right in!

Ive recently moved into a new place and just tried to log into my router using the usual default usernames and passwords but to no avail. After a quick google search it turns out the default router user and pass is "Administrator" and part of the serial number.
I was about to go upstairs and get the serial number but I thought itd be more fun to try and get it remotely.

Where should I start?

[limdis]

Can you give us some details on your router? I know for some cisco routers this isn't too difficult but with others it can be a task.

[lkzp]

Can you give us some details on your router? I know for some cisco routers this isn't too difficult but with others it can be a task.

Hi

Sorry I took a while to get back!

The router is the standard one supplied by plusnet and their patronising adverts about Yorkshire: A Thomson 585.

-- Wed May 16, 2012 7:01 pm --

Ok so I found this python script via a link on this page:

http://www.ziva-vatra.com/index.php?aid ... 9mdHdhcmU=

I ran it but nothing seems to be happening. Anyone know why?

# cd ../scripts
# python dumpinfo.py

Then just blank. I thought the script would print info in the terminal. Do I need to add parameters to the script?

Cheers

[LoGiCaL__]

I also moved it to programming since the python script has been added.

[lkzp]

Is there another way to do this? Im not a fan of using scripts, especially ones I dont really understand.


Anyway, this is the script so you dont have to donwload it:

Code: Select all

#! /usr/bin/python

import socket
import struct
import sys
import os
import string

#MADDX = '225.100.100.100'
MADDX = '224.0.0.103'
RAW = False


#! /usr/bin/python

import socket
import struct
import sys

MADDX = '224.0.0.103'
ADDR = '' #bind to address? leave blank for any
DATA="414e542d534541524348204d4441502f312e310d0a3436" #the Hello ID request

import binascii
SDATA = binascii.a2b_hex(DATA)  #convert to ASCII

##http://mail.python.org/pipermail/python-list/2005-December/358117.html
#bind((outgoing_if, tc_local_port))

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
sock.bind((ADDR,1103)) #bind to any address and local port 1103
sock.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_TTL, 2)
sock.sendto(SDATA, (MADDX, 3235)) # send to required DEST address and PORT
   




sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sock.bind(('',3235)) #port 3235 is the port the thomson software responds on
mreq = struct.pack('4sl', socket.inet_aton(MADDX), socket.INADDR_ANY)

sock.setsockopt(socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP, mreq)

if RAW == True:  #if we want the RAW datastream, we just loop until keyboard interrupt
    while True:
        print sock.recv(1024)
else:
    while True:
   Dkilobyte = sock.recv(1024)
   if string.find(Dkilobyte,'ANT-ID:') != -1:
      for line in string.split(Dkilobyte):
         if string.find(line,'ANT-ID:') != -1:
            print "serial: CP" + string.strip(line,"ANT-ID:") + "\n\n"
            sys.exit(0) #success! we quit



EDIT: This is not my script, all credit to: http://www.ziva-vatra.com/index.php?aid ... 9mdHdhcmU=