Archive

Posts Tagged ‘FRITZ!Box hack’

FRITZ!Box VoIP password extraction

July 9th, 2014 7 comments

Many providers send you the preconfigured FRITZ!Box containing all settings, whereas passwords are not visible in the webinterface. Some providers, such as Sunrise in Switzerland, argue they wont give you the password due to “safety reasons” when you call their helpdesk. m) – To extract your VoIP password from your FRITZ!Box follow these steps:

1.) Enable Telnet
Open the webinterface of your FRITZ!Box an choose > Telephony > Telephonebook
Add two new entries:
Name: Telnet On
Number: #96*7*

and
Name: Telnet Off
Number: #96*8*

FritzBox-telnet-phonebook

Dial #96*7* on your connected DECT phone to enable telnet on your FRITZ!Box. If you don’t have a phone connected to the Box, enable “click to dial” in telephony > calls > click to dial and dial the number by clicking on the number in the phonebook on the webinterface.

2.) Extract VoIP password in telnet
Access your router via telnet in the command line (aka Terminal). Use the IP of your router and your FRITZ!Box password.

user@host:~$ telnet 192.168.1.1
password: ***********

BusyBox v1.20.2 (2013-05-13 12:53:07 CEST) built-in shell (ash)
Enter ‘help’ for a list of built-in commands.

#

Then use the following two commands to extract the VoIP password:

# allcfgconv -C voip -o /var/tmp/temp -c
# cat /var/tmp/temp |grep passwd
passwd = “23f00b4R”;
passwd = “”;
#

Done 😎
Now disable telnet again, – for security reasons, – by dialing #96*8* on your DECT. – Have phun!

For further reading:

Update (11. November 2016):
AVM secret FritzBox Key