ee bright box 2.md

The Bright Box 2 is a combined VDSL modem and wireless router supplied to customers of EE (Orange). It is manufactured by Arcadyan and uses a Broadcom bcm63xx SoC

These instructions are based on the latest firmware at the time of writing: v0.04.05.0001-OT (Fri Mar 24 17:29:32 2017)

Put it in bridge mode

• This is for if you want to use the Bright Box as a VDSL modem only, and have a separate router act as the PPPoE client (e.g. ubiquiti edgerouter), avoiding double NAT
• There is lot of nonsense, not least from people on EE's own forum, about how this cannot be done
• If desired, change the Bright Box IP and subnet before doing this because the settings tab becomes inaccessible
• Connect your router to port 4 (GigE) on your BB
• On the router side, leave the port untagged (the BB takes care of the VLAN)

1. Bright Box web UI -> Advanced tab -> Broadband Settings
2. Press F12 to open Chrome DevTools -> Console tab
3. In the dropdown box at the top, select mainFrame (broadband.htm) IFrame
4. In the console execute this:

document.BRNTForm.protocol.value='1';
protocolChange();

5. Close DevTools
6. Click Save Settings in web UI

Getting a root shell

You can exploit a bug in the way the BB constructs its smb.conf config file to get a shell

1. Plug a USB stick into the side
2. Go to the Bright Box web UI -> Advanced -> USB File Sharing
3. Set 'Samba Function' to Enable and save
4. Under 'User account', create a new user and save
5. Under 'USB Device', click the Share link next to your USB stick
6. Use element inspector to turn the 'Share Name' textbox into a <textarea> and remove the maxlength attribute
7. Paste this into the new textarea - N.B. do not leave a trailing newline character

r]
path = /
read only = no
[u

8. In the developer tools Console tab, execute this: function isValidUsername(s) { return true; }
9. In the Bright Box web UI, tick the box next to the user you added in step 4
10. Click save settings
11. Repeat steps 5 to 10 but use this for the new Share Name (no trailing newline):

r]
force user = root
[u

12. Repeat steps 5 to 10 but use this for the new Share Name (no trailing newline):

u]
preexec = telnetd -l/bin/sh
#

13. On your computer, browse to the network share \\192.168.1.1\u, which pops a root shell
14. Telnet into your Bright Box

$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
/ #

15. You can also access the root filesystem via \\192.168.1.1\r

Notes

• The Share Name is truncated at 31 chars which is why we have to assemble our samba config in several goes
• Once you've got a shell you can remove the shares / disable Samba / unplug your USB stick
• You can stop the shell with pkill telnetd
• This doesn't persist across reboots because the newlines in the share names don't survive the config restore process on boot

Uses

• On ADSL (not VDSL) you can use bcm_xdslctl configure --snr XX to change your target SNR and potentially sync at a faster speed (e.g. 50 to go from 6dB to 3dB)
• You can disable TR-069 using util_sys_cli stopTR69