<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/">
  <channel>
    <title>NETWORK on Code is cheap, let&#39;s talk</title>
    <link>https://blog.ferstar.org/en/tags/network/</link>
    <description>Code is cheap, let&#39;s talk</description>
    <generator>Hugo -- gohugo.io</generator>
    <language>en</language>
    <copyright>Copyright 2026 ferstar</copyright>
    <lastBuildDate>Wed, 27 May 2026 18:30:00 +0800</lastBuildDate>
    <ttl>60</ttl><atom:link href="https://blog.ferstar.org/en/tags/network/index.xml" rel="self" type="application/rss+xml" /><image>
      <url>https://blog.ferstar.org/site-logo.png</url>
      <title>Code is cheap, let&#39;s talk</title>
      <link>https://blog.ferstar.org/</link>
    </image>
    
    <item>
      <title>HS8145C5/V5 ONT: One Command to Dump the telecomadmin Password</title>
      <link>https://blog.ferstar.org/en/posts/hs8145c5-v5-telnet-get-admin-password/</link>
      <pubDate>Wed, 27 May 2026 18:30:00 +0800</pubDate>
      
      <guid isPermaLink="true">https://blog.ferstar.org/en/posts/hs8145c5-v5-telnet-get-admin-password/</guid>
      <description>Stuck with useradmin on your ISP-provided ONT? No flashing, no config editing — one display command dumps the encrypted super-admin password, decrypt it, and log in as telecomadmin with full access.</description><content:encoded><![CDATA[<blockquote><p>I am not a native English speaker; this article was translated by AI.</p>
</blockquote><p>The HS8145C5 (or V5) ONT from China Telecom ships with only <code>useradmin</code> privileges by default — many settings are hidden. Most tutorials online tell you to modify config files or flash the Huawei firmware. But if all you need is the super-admin password, there is a more direct way.</p>

<h3 class="relative group">Prerequisite: Telnet already enabled
    <div id="prerequisite-telnet-already-enabled" class="anchor"></div>
    
    <span
        class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none">
        <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#prerequisite-telnet-already-enabled" aria-label="Anchor">#</a>
    </span>
    
</h3>
<p>Newer ONTs have Telnet disabled by default. You will need an <strong>ONT V3-V5 enablement tool</strong> once to turn it on:</p>
<ol>
<li>Unplug all cables from the ONT, only LAN1 connected to your computer</li>
<li>Set your computer IP to <code>192.168.1.x</code> (x ≠ 1)</li>
<li>Open the enablement tool, select V5 enable, pick your network interface, click start</li>
<li>Wait until a green <strong>success</strong> appears in the device list (all ONT LEDs stay lit), click stop, then power-cycle the ONT</li>
</ol>
<p>Telnet stays open after reboot. You only need to do this once — it persists unless the ONT is factory-reset.</p>

<h3 class="relative group">One command to retrieve the super-admin password
    <div id="one-command-to-retrieve-the-super-admin-password" class="anchor"></div>
    
    <span
        class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none">
        <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#one-command-to-retrieve-the-super-admin-password" aria-label="Anchor">#</a>
    </span>
    
</h3>
<p>Telnet into the ONT and run:</p>
<div class="highlight-wrapper"><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-shell" data-lang="shell"><span class="line"><span class="cl">telnet 192.168.1.1
</span></span><span class="line"><span class="cl">root
</span></span><span class="line"><span class="cl">adminHW
</span></span><span class="line"><span class="cl">su
</span></span><span class="line"><span class="cl">display current-configuration grep telecomadmin</span></span></code></pre></div></div>
<p>The output will show the line containing <code>telecomadmin</code>, something like:</p>
<div class="highlight-wrapper"><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl"><X_HW_WebUserInfoInstance InstanceID="2" ModifyPasswordFlag="1" UserName="telecomadmin" Password="$2;xxxxxxxxxxxxxxxxxx$" UserLevel="0" Enable="1" .../></span></span></code></pre></div></div>
<p>The portion between <code>$2;</code> and the trailing <code>$</code> in the <code>Password</code> field is the encrypted admin password.</p>

<h3 class="relative group">Decrypting the $2 ciphertext
    <div id="decrypting-the-2-ciphertext" class="anchor"></div>
    
    <span
        class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none">
        <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#decrypting-the-2-ciphertext" aria-label="Anchor">#</a>
    </span>
    
</h3>
<p>Copy the entire <code>$2;...$</code> string into a <strong>Huawei configuration decryption tool</strong> (easily found online), use the “decrypt” function, and the plaintext password will be revealed.</p>
<p>Alternatively, search for a local standalone version of the same tool.</p>

<h3 class="relative group">Log in as telecomadmin
    <div id="log-in-as-telecomadmin" class="anchor"></div>
    
    <span
        class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none">
        <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#log-in-as-telecomadmin" aria-label="Anchor">#</a>
    </span>
    
</h3>
<p>Open <code>192.168.1.1</code> in your browser, enter <code>telecomadmin</code> as the username and the decrypted plaintext as the password. You now have full admin access to the ONT — bridge mode, DMZ, TR069 deletion, any configuration you need.</p>
]]></content:encoded>
      
    </item>
    
  </channel>
</rss>
