[HowTo] Restore your lost broadband password ..

This tutorial has its origin on a thread at Digit forum where a member asked if we can restore lost password from router. I decided to put my CCNA skills to use. And indeed after some adventures with ATMOS commands, I figured it out. So here it goes.

The problem this guy had was this: He had an Airtel connection and Huawei MT880 Adsl router. His ISP username and password is saved on the router and it gets connected when he turn on the router. Now he forgot his password and wanted to change it. And couldn’t because it was saved in the router. Using those asterisk removing utilities didn’t work too. So he was stuck there. Now if you have the same story, you could try this too :

You will need your router password to reset your ISP password. This is different from your ISP acount’s password. On most routers, the default username / password combination is admin/admin or admin/1234 . If you have changed your router password and forgot it too, then I cant help you. You can though reset router password with Reset slot in your router.
I’ll be using HyperTerminal for Telnet as it has got some nice functions. You can use other telnet utils too… So lets start:

  • Run HyperTerminal by Start > Programs > Accesories> Communications > HyperTerminal.
  • Enter any name for the Connection. Click on OK.
  • In the Connect Using combo box, select TCP/IP (WinSock) and enter 192.168.1.1 as Host address. (192.168.1.1 is usually your router’s address ). If you have customized your router’s ip address then enter the customized address. The Port Number 23 is fine, no need to change it. Click on Connect.
  • You will get a login prompt. Enter your router username and password here. If all goes allright you will get a prompt saying “Login Successful”.
  • Now on the console, type this:
  •       console enable {Press Enter}
  • You’ll get a prompt like this:
  •       Quantum>
  • Now on the prompt, type this:
  •       Quantum> fm {Press Enter}
  • The prompt will change to Quantum fm>.
  • Now in HyperTerminal, click on Transfer > Capture Text. Enter a location to save the settings file. For example My Documents\mysettings.txt .
  • Click on Start. You will be back to the router prompt.
  • Now type this:
  •       Quantum fm> cat im.conf {Press Enter}
  • This is quite a big file and it will take a while to list. Just wait until the listing is complete and you get back to the prompt.
  •       Click on Transfer > Capture Text > Stop.
  • Now the tough part is over.
  • Type these commands on the console to quit telnet:
  •       Quantum fm>home {Press Enter}
  •       Quantum>exit {Press Enter}
  •       >user logout {Press Enter}
  • Now you can quit HyperTerminal .

Now open the file we saved in Notepad and press Ctrl F.
Enter weLogin in the string to find.
And here you can see your ISP login details in clear text. 😛 …

I have tested this on Huawei MT880 and MT 882 routers. I cannot guarantee that they work on other routers too. But Atmos commands are usually same on all devices so they should work on other routers too.. And finally, you shouldn’t try it if you aren’t comfortable with command line usage. Don’t hold me accountable if you screwup doing things you shouldn’t be doing. Hope this helped… !

94 thoughts on “[HowTo] Restore your lost broadband password ..”

  1. Hey Shahab, thanks for this.

    Can you make me a shell script or batch file for changing the username/paassword of bb and then reboot the MT880 router ?

  2. Hey nice stuff batty.
    I have got a Motorola SB5100 broadband router. I tried to telnet into it but didn’t work. So I ran namp on it and sawthat only tcp port was open. Is there other anyway to know more about my router?
    I am more of a noob at this but I’d like to learn more. Don’t mind messing around a bit.

  3. I have a router with a password which only the manufacturer knows, any idea how to extract the password from the router.

  4. Hey Thanks!
    But let me conform….My BSNL DATAOne Broadband modem is also a Router?

    Well then I tried….but was unable to login. I am Quite sure of the username & password of my modem.

  5. i am having BSNL Broadband in Ahmedabad in India,
    i lost my password of my user name

    could u help on the same.

  6. well shahab

    i think u need not do all this for finding the password in MT880
    just login thorugh web-console and go to the wan page on which u had saved ur password
    after that just view the source for that page, and there will be the password in plain text in the source page….

  7. i am using Aztech 600e router. there dun seems to be ‘console enable’ command. how do i proceed after logging into the router? i am helping a friend to retrive a forgotten password. thanks

  8. Hmm.. I cannot help without using that router .. Maybe you should try typing ? and press enter. The available commands will be shown. If that doesnt work try typing help and press enter.
    Tell me the output of the commands.

  9. These what i get from the router…

    ========================================================

    BusyBox v0.61.pre (2006.04.07-06:44 0000) Built-in shell (ash)
    Enter ‘help’ for a list of built-in commands.

    # help

    Built-in commands:
    ——————-
    . : bg break builtin cd chdir continue eval exec exit export
    false fc fg hash help jobs kill local pwd read readonly return
    set setvar shift times trap true type ulimit umask unset wait

    ========================================================

  10. actually, dats all i have after entering ‘root’… 🙁

    ======================================================

    BusyBox on localhost login: root
    Password:

    BusyBox v0.61.pre (2006.04.07-06:44 0000) Built-in shell (ash)
    Enter ‘help’ for a list of built-in commands.

    # help

    Built-in commands:
    ——————-
    . : bg break builtin cd chdir continue eval exec exit export
    false fc fg hash help jobs kill local pwd read readonly return
    set setvar shift times trap true type ulimit umask unset wait

    # root
    root: No such file or directory
    #

    ======================================================

  11. Is there a utility or away to reset NETGEAR broadband router? I wrote my pasword down and now can’t remember it or where I put the paper

    Thanks in advance for your help.

  12. Shahab,

    Great document, i’m saving it, can you tell me how to force an ip reload on that router.

    or, can you tell me where can i find a manual with the telnet commands

    Thanks

  13. Hi Shahab
    I tried it on BSNLS Dataone UT-300R2U.
    It worked only till “Login Suceesful”
    Then a “$” sign appeared .
    Then I wrote “Console enabled”
    But to my disappointment it said “Command Invalid”
    I tried all the different ways to enter command.
    But it did nit work.
    Those BSNL People are not ready they just say give an
    application. If you can find the command for this router
    I will be really thankful .
    Bye.

  14. As I also read your reply to “need help”.
    When I wrote help:
    I got the following commands :
    ——- ———–
    alias To Alias a command
    apply Apply configuration/image file
    commit Commit the active config to the flash
    create Create a new entry of specified type
    delete Delete the specified entry
    download Download a file on to the Device
    exit To exit the CLI shell
    get Display info for the search
    help Provides help
    list List files
    modify Modify information for specified entry
    passwd To modify user password
    ping The normal ping command
    prompt Change the user prompt
    reboot Reboot the device
    remove Remove file
    reset Reset info for the specified entry
    size ATM Sizing Information
    traceroute The normal traceroute command
    trigger To set trigger
    unalias To undefine previously defined alias
    verbose Switch ON/OFF the verbose mode
    $
    Hoope this helps in guiding me.
    Bi.

  15. One more thing as the technotree said
    to find the source of the page . Can you tell me how to find the source of a page .

  16. Hi Guddu ..
    Try these :
    enable
    OR
    root

    Although guessing the command will be tough job so it will help if you could tell me what operating system is on your router. That will be displayed when you login to the router as in my case it said Quantum or in NeedHelp’s case it was Busybee ..

    Find source of a page is available when you are in web mode. For that you’ll have to login to 192.168.1.1 and when you are on the page where your login details are visible, right click and select View Source. This wont work I tell you before hand.

  17. hey,Shahab..m using broadband from dataone (BSNL) n using huawei MT882 adsl router.while connecting i used the option “Save this user name n password for the following users”…for abt two months.Now i hv forgotten wat was my password n i want that in simple text without contacting ISP provider.PLZ HELP!! i need to change this urgently

  18. Hey Sausthab .. Do as I’ve written in the tutorial .. Easy job .. you can easily find the password with this method ..

  19. Hey Shahab, I tried all the steps as you have mentioned..

    apparently when I open the hyperterminal and give the user & pass as admin/admin it says invaid password. I also tried admin/1234.

    On more additional thing, when I try to open the admin of the modem using http://192.168.1.1 I’m able to login using admin/admin, any idea why I’m not able to logon using the hyperterminal.

    I use Huawei wa1003a modem, I want to identify the password for creating a new connect for the wireless

    thank you in advance for your reply.

  20. hi Shahab

    this is the OS
    BusyBox v0.61.pre (2005.08.01-10:08 0000) Built-in shell (ash)

    probably this helps.. i scanned all the directories and files.. but it didn’t help.. 🙁

  21. Are you sure you are trying to telnet your router and not some other address ?

    And what do you mean when you say “When I try to open the admin of modem … ” .. Do you mean web interface ..?

  22. Hi Shahab,

    I have a problem, that is when there is power fluctuation, my Huawei router gets disconnected from DSL. I can see the disconnected status in the Home page. When I restart the router from web-interface or using telnet, this DSL status is not getting into “connected” status. I am sitting in another room and so I normally had to go to the router and switch OFF and then ON the power of the router. Only this way it gets connected to DSL.

    So, my query is, Is there any other command in telnet other than “restart”, to restart the router fully?

    I appreciate your early help!!

    Walton

  23. anyone here know Modem/Router model ATMOS ? when i try login used web interface it fail

    The server 124.82.140.253 at ATMOS”Content-type: text/html requires a username and password.

    Warning: This server is requesting that your username and password be sent in an insecure manner (basic authentication without a secure connection).

    i have already try to login with username / password combination is admin/admin or admin/1234 but still dosent work…

    help me pls or send email to me [email protected]

  24. Haikal .. You have to telnet your router and not your ISP’s . I believe 124.82.140.253 is your ISP’s router.. Or have you got a static ip ..?

    Can you telnet to your router ..??

  25. I have the same problem as Need help getting this.

    BusyBox v0.61.pre (2006.04.07-06:44 0000) Built-in shell (ash)
    Enter ‘help’ for a list of built-in commands.

    # help

    Built-in commands:
    ——————-
    . : bg break builtin cd chdir continue eval exec exit export
    false fc fg hash help jobs kill local pwd read readonly return
    set setvar shift times trap true type ulimit umask unset wait

    Didd any1 find a solution for this at all.????

  26. on Sep 11th, 2006 at 7:28 pm
    technoteen wrote

    “well shahab

    i think u need not do all this for finding the password in MT880
    just login thorugh web-console and go to the wan page on which u had saved ur password
    after that just view the source for that page, and there will be the password in plain text in the source page….

    yes it works…

  27. I have a Huewei MT880, but the OS is… different.
    After I telnet to it, all I get is:
    ______________________
    **********
    Welcome
    **********
    Digitel Software V100R002B023
    Copyright (c) 2001-2004
    login:
    ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
    … and Digitel is my ISP. Did they manage to change the firmware to something they made? Anyway, when I login, the only commands available are ping, help, traceroute, passwd, reboot, and exit.

    Nothing else works. Not even root or enable. 🙁

  28. after “Login Successful”.

    $passwd admin
    Enter Old Password:
    Enter New Password:
    Confirm New Password:

    Set Done
    – – – – – – – – – – – – – – – – – – – –

  29. hey Shahab,
    I got all the text in the CAPTURE.txt file … but when i search for the ‘weLogin’ string, the editor tells me that it is unable to find any instance of that string in the document.. I have a MT841 router from Huawei… please help.. thanks..

  30. hmm .. i have exact Huawei MT882 but when i type “console enable” it says Invalid command .. so .. now what?
    login: admin
    password:
    Login Successful
    $console enable
    Error: Invalid command
    $

  31. Hey Gaurav .. Can you send me that Capture.txt ..? Upload it and send me the link using Contact Me page ..

    @Bojcha .. What happens when you type ? on the prompt …?

  32. as i say .. i;m loged into modem .. and i type console enabel .. but message appears “INVALID COMMAND” .. i assume .that my ISP flashed their firmware and disable all nessesery options..
    when i type “?” .. the list of commands appiears ..
    alias To Alias a command
    apply Apply configuration/image file
    commit Commit the active config to the flash
    create Create a new entry of specified type
    delete Delete the specified entry
    download Download a file on to the Device
    exit To exit the CLI shell
    get Display info for the search
    help Provides help
    list List files
    modify Modify information for specified entry
    passwd To modify user password
    ping The normal ping command
    prompt Change the user prompt
    reboot Reboot the device
    remove Remove file
    reset Reset info for the specified entry
    size ATM Sizing Information
    traceroute The normal traceroute command
    trigger To set trigger
    unalias To undefine previously defined alias
    verbose Switch ON/OFF the verbose mode

    so.. how i can get a user and psss from my modem ..

  33. Wow .. Thats completely different shell … How about trying modify or passwd commands ..? Please let me know what output comes when you try those commands ..
    You can use ? after any command .. Like :
    Modify ? {Press Enter} will show all modify options ..

    Good Luck ..

  34. i know for “?” .. i try almost all these commands .. but some commands are desabled totaly i assume by flashed firmware from my ISP.
    $modify ?
    Command Description
    ——- ———–
    8021x 8021X Commands
    ads ADS Commands
    atm ATM Commands
    autodetect AutoDetect Commands
    autoupdate Autoupdate Status
    bras BRAS Commands
    bridge Bridge Commands
    dhcp DHCP Commands
    dns DNS Commands
    dsl DSL Commands
    eoa EOA Commands
    ethernet Ethernet Configuration
    fwl Firewall Commands
    hdlceoc HDLCEOC Commands
    ilmi ILMI Commands
    image Image Commands
    ip IP Commands
    ipf IP Filter Commands
    ipoa IPoA Commands
    l2tp Layer 2 Tunneling Protocol
    l2wall L2Wall Commands
    mctl MCTL Commands
    nat NAT Commands
    nbsize Next Boot Size Params
    oam ATM OAM LoopBack Commands
    pfraw PFRAW Commands
    ppe PPPOE Commands
    ppp PPP Commands
    radius RADIUS Commands
    rip RIP Commands
    smtp SMTP Commands
    snmp SNMP Commands
    sntp SNTP Commands
    ssh SSH Commands
    stp Spanning Tree Protocol Commands
    system System Related Information
    trace Trace/Log Commands
    trapprints Trapprints Command
    upnp UPNP Commands
    usagectrl Usage Control Command
    usb USB commands
    voice VOICE Commands
    wlan WLAN Commands
    zipb ZipB Commands

    or,

    $get dsl?
    Command Description
    ——- ———–
    config DSL Configuration
    params DSL Parameters
    stats DSL Statistics
    delt DSL DELT command
    $get dsl stats
    Error: Invalid command
    $
    🙁

  35. If you have a dlink bb modem…when you log in with admin and i the password field it does not move…cursor remains fixed. What can be done

  36. Hi,
    you can have you username and password by putting a single line command usign telnet/hyperterm so it will hardly take 4-5 sec to know it( for mt880 and mt 882 dont know about other make).

  37. can u acess home ul 900 plan on ur phone line when u hv subscribed to home 250 plan. if yes can u give me one home ul 900 pass word or tell me how to get it.(my friends don’t hv it)

Comments are closed.