# Router & ISP Investigation Notes

Consolidated notes from analyzing `hw_ctree.xml` (Huawei ONT config export) and a live root shell session on the device.

---

## 1. Device Overview

| Item | Value |
|---|---|
| Device type | Huawei GPON ONT (fiber modem/router) |
| Model | HG8546M |
| Hardware | Single-band only (2.4GHz) — the "5GHz" radio in the config is a dead stub, no second physical radio exists |
| SoC | HiSilicon Hi A9, single-core ARMv7 (Cortex-A9 rev1) |
| RAM | ~244 MB total |
| Kernel | Linux 3.10.53-HULK2, built Oct 2017 by Huawei (Shenzhen CI) |
| Firmware/SDK | V500R019C00SPC050B051 / SDK V100R005C00SPC030B050 |
| OS | Dopra Linux (Huawei's embedded Linux distro), BusyBox 1.18.4 |
| LAN IP | 192.168.100.1/24, DHCP pool .2–.254 |

**Note:** Firmware dates to ~2017 and is very likely unpatched against years of known Linux kernel vulnerabilities — standard for ISP-leased ONTs that are provisioned once and left alone.

---

## 2. ISP: Badar Enterprises Cable Network (Private) Limited

| Item | Value |
|---|---|
| Legal name | Badar Enterprises Cable Network (Private) Limited |
| Website | badarnetworks.online |
| Address | Badar Plaza, Committee Chowk, Mianwali, Punjab, Pakistan — 42200 |
| Phone | 0306 1236555 |
| Helpline | 0459 232525 |
| Support email | noc@badarnetworks.online |
| Abuse/general email | info@badarnetworks.online, haroonniazi@badarnetworks.online |
| Billing portal | billing.badarnetworks.online/self |
| ASN | AS150387 ("BECNL-AS-AP"), registered with APNIC |
| Owned IPv4 ranges | 103.26.238.0/24, 103.26.239.0/24 (no IPv6 yet) |
| Governing law / jurisdiction | Pakistan; disputes go to courts of Mianwali, Punjab |

**Business profile:** Originally a cable TV provider, expanded into FTTH fiber internet, digital cable, and voice services. Small/regional scale (~1,000+ customers claimed). WordPress-based site — low-tech operation generally, matches the router's loose security defaults (open Telnet, default passwords, weak password hashing).

**Network infrastructure (confirmed from live device):**
- **ASN registration date:** 2022-10-20 (AS150387) — relatively recent, consistent with a small ISP formalizing its own routing identity.
- **Registry-listed upstream:** Pakistan Telecommunication Company Limited (PTCL) — per ASN "receiving from" records.
- **Actual live transit, confirmed via traceroute from the ONT's own shell:** **Wateen Telecom** (`wateen.net`) — hop 2 of `traceroute google.com` resolves to `GPONUser38178-1.wateen.net` (110.38.178.1), directly after the local PPPoE gateway. This is the real physical path traffic takes; the PTCL relationship may be secondary/registry-only.
- **This also explains the `110.38.178.4` IP** found earlier in the "admin" port-forward rule — it sits in the same `110.38.178.0/24` block Wateen assigns on this GPON segment, suggesting it was the user's own connection's IP at the time that rule was created, not an external third party.
- **Website hosting IP:** `badarnetworks.online` resolves to `212.1.210.162` (confirmed via `nslookup` from the user's own network). Hosting provider for this IP could not be confirmed through available lookups.

**Subdomain / infrastructure map** (user-provided DNS enumeration results):

*Self-hosted, on Badar's own IP block (103.26.238.0/24):*
| Subdomain | IP | Purpose |
|---|---|---|
| crm.badarnetworks.online | 103.26.238.5 | CRM |
| customer.badarnetworks.online | 103.26.238.5 | Customer portal (same server as CRM) |
| speedtest.badarnetworks.online | 103.26.238.3 | Self-hosted speed test |

*Shared external host — 212.1.210.162 (hosting provider unconfirmed):*
| Subdomain | Likely purpose |
|---|---|
| b1b.badarnetworks.online | Unclear |
| b4b.badarnetworks.online | Unclear |
| badarcrm.badarnetworks.online | Secondary CRM instance/mirror |
| oltdb.badarnetworks.online | OLT database — backend for SmartOLT/device-provisioning data |
| pay.badarnetworks.online | Payment processing |
| paytrack.badarnetworks.online | Payment tracking |
| portal.badarnetworks.online | General customer/staff portal |

*Billing — separate external host:*
| Subdomain | IP | Notes |
|---|---|---|
| billing.badarnetworks.online | 221.120.216.25 | Traces to Chunghwa Telecom (HiNet), Taiwan — likely a Taiwan-based VPS/hosting provider |

*Email — Google Cloud:*
| Subdomain | IP | Notes |
|---|---|---|
| autodiscover.badarnetworks.online | 34.120.251.119 | Confirmed Google Cloud Platform anycast range (AS396982) — likely Google Workspace or a GCP-hosted proxy for mail autodiscovery |

**Takeaway:** Badar Enterprises' back-office systems are split across at least four separate hosting environments (own network, one unidentified external VPS, a Taiwan-hosted billing box, and Google Cloud for mail) — consistent with a small ISP assembling infrastructure piecemeal rather than running one unified, professionally managed stack.

**Note on scope:** This map was built entirely from passive, publicly-resolvable DNS data. Active probing (port scanning, service fingerprinting, etc.) of these third-party servers was intentionally not performed — that crosses from looking up public information into testing infrastructure Badar Enterprises operates, which is out of scope for this kind of research regardless of intent.

**Subscribed plan:** Student — 10 Mbps — PKR 1,600/month.

**Key Terms & Conditions clauses:**
- **CPE ownership:** the ONT/router remains Badar's property unless purchased outright; must be returned on disconnection.
- **Acceptable use:** must not "compromise network security" or violate PTA regulations — vague enough it *could* be stretched to cover disabling ISP remote management, though nothing explicitly bans local config changes.
- Service may be suspended/terminated for non-payment or misuse.
- Dual-band ONT only standard on 50 Mbps+ plans (irrelevant here since this unit is single-band hardware anyway).

---

## 3. Remote Management (TR-069 / CWMP)

- Protocol: TR-069 (CWMP) — industry standard for ISPs to remotely manage customer routers.
- Platform: **SmartOLT** (by NEXTLAN) — a cloud-hosted GPON/EPON provisioning platform. Lets ISP staff provision/activate ONTs, view optical signal + online status, and (when enabled) push config changes remotely.
- ACS username: `soltcpe`
- Connection-request username: `smartolt`
- Both passwords stored encrypted in the config (Huawei's fixed-key `$2...$` scheme — not user-specific, not safely decryptable here).
- Original ACS URL pointed to a real server (approx. `1.69.69.x`); **user changed it to `127.0.0.1` (localhost)** to disable outbound check-ins.
- `EnableCWMP` was already `0` in the original config.
- **Caveat:** GPON/OMCI provisioning (a separate channel from TR-069) still works regardless — the ONT still shows "online" on the ISP's OLT dashboard, and a config push from the OLT side could silently revert the ACS URL change.
- Dedicated WAN connection for management traffic: `OLT_C_TR069_Static_WAN`, VLAN 20, static IP `12.0.33.51`, gateway `12.0.0.1`.
- Live firewall confirms inbound TR-069 "connection request" port 7547 is still open on `12.0.33.51` (currently shielded by ISP's CGNAT).
- **Badar's SmartOLT instance:** `https://badarnetworks.smartolt.com/auth/login` — confirms the SmartOLT username-pattern convention (`<ispname>.smartolt.com`) applies here. This is their staff-facing OLT/ONT management and provisioning login, not something in scope to access beyond confirming it exists.

---

## 4. Credentials Found in Config (hashed/encrypted — not plaintext)

| Account | Where | Hash/Encryption type |
|---|---|---|
| `root` (CLI) | `X_HW_CLIUserInfoInstance` | Salted SHA-256-based scheme |
| `root` (Web UI) | `X_HW_WebUserInfoInstance` InstanceID 1 | Salted hash, UserLevel 1 |
| `telecomadmin` (Web UI) | `X_HW_WebUserInfoInstance` InstanceID 2 | Salted hash, UserLevel **0** (higher privilege than root) |
| WiFi PSK (2.4GHz) | `PreSharedKeyInstance` | Huawei `$2...$` fixed-key encryption |
| WiFi PSK (5GHz, inactive) | `PreSharedKeyInstance` | Same, but radio is non-functional |
| WPS PINs (x8) | `X_HW_WpsDefaultPinInstance` | Same encryption |
| TR-069 ACS/connection-request passwords | `ManagementServer` | Same encryption |
| SIP/VoIP auth password | `Service.VoiceService...SIP` | Same encryption |

**Root login confirmed to still be on the factory default password** (PuTTY session showed "Password is default value, please modify it!").

**`/etc/shadow` (live device, via root shell):**
```
root:aqnaBbVaP.9Zo:...        <- traditional DES crypt, weak (8-char truncation, no salt rounds, fast to crack)
osgi:$1$U6vz.JFk$...:...      <- MD5 crypt, stronger but still dated
nobody:!:...                  <- disabled
sshd:*:...                    <- disabled (system account)
```
Recommended fix: `passwd root` from the live shell to set a stronger password/hash.

---

## 5. Network Exposure Findings

### Port forwarding rules (in config + confirmed live in iptables)
| Rule | External | Internal | Protocol | Notes |
|---|---|---|---|---|
| "admin" | Port 80, restricted to source `110.38.178.4` | `192.168.100.1:80` (router's own admin page) | TCP | User's own past attempt at remote admin access |
| "Website" | Port 80, open to all | `192.168.100.2:80` | TCP | Open to any source — purpose unconfirmed |

### Live `iptables -L -n` findings
- `INPUT_ACL` and `INPUT_ACL_WAN` chains both have an **unconditional ACCEPT on port 80** ahead of later DROP rules — meaning the admin web UI (`web` process) is technically reachable from WAN if not for CGNAT.
- Port 7547 (TR-069 connection-request) ACCEPT rule confirmed bound to `12.0.33.51`.
- A conditional backdoor-like rule set exists: telnet (23), SSH (22), and ICMP are ACCEPTed *only* when packets carry firewall mark `0x102001`; otherwise DROPped. This mark doesn't appear to be actively set under normal operation (debug mode off), so it's currently dormant.
- `netstat -tlnp` confirms:
  - `dropbear` (SSH) listening on `0.0.0.0:22` — globally bound at the socket level
  - `ssmp` (telnet) listening on `0.0.0.0:23` — globally bound
  - `web` listening on `:80` — globally bound
  - `cwmp` listening on `12.0.33.51:7547`

### Why none of this is currently a live external risk
**The user's ISP uses CGNAT (Carrier-Grade NAT)** on the actual internet-facing PPPoE connection. The router's `12.0.33.51` is not a real public-facing address reachable from the open internet — the ISP's own gateway sits in front of it. This means the open port-80/7547 rules above are **not currently exploitable from outside**, though this protection is incidental (controlled by the ISP's network architecture, not the user) and could change if the ISP ever assigns a real public/static IP.

**This does not apply to LAN/WiFi-based access** — anyone on the local network could still reach the default-password admin login and open Telnet/SSH ports regardless of CGNAT.

---

## 6. Website & Hosting Security Scan (via web-check.xyz, user-provided)

A full automated OSINT scan of `badarnetworks.online` was run through the web-check tool. Key findings:

**Hosting & registration (confirmed):**
| Item | Value |
|---|---|
| Registrar | HOSTINGER operations, UAB |
| Domain created | 2021-06-05 |
| Domain expires | 2027-06-05 |
| Nameservers | ns1/ns2.dns-parking.com (Hostinger default) |
| Main site IP (212.1.210.162) hosting | **Hostinger US**, ASN 47583, geolocated to Asheville, North Carolina |
| Web server | LiteSpeed |
| CMS | WordPress (confirmed via wp-json API link) |

**Mail:**
| Item | Value |
|---|---|
| MX records | mx1/mx2.hostinger.com — mail hosted on Hostinger, not Google Workspace |
| SPF | Present (`v=spf1 include:_spf.mail.hostinger.com ~all`) |
| DMARC | `p=none` — configured but not enforced; spoofed "from" emails using their domain would not be rejected/quarantined |
| DKIM | Not configured |

**Security posture:**
| Check | Result |
|---|---|
| WAF (web application firewall) | None detected |
| HSTS | Configured correctly, preload-ready |
| Content-Security-Policy | Not set |
| X-Frame-Options | Not set |
| Referrer-Policy | Not set |
| Permissions-Policy | Not set |
| CAA records | None (no restriction on which CAs can issue certs) |
| DNSSEC | Unsigned |
| security.txt | Not present |
| Known breaches (HIBP-style check) | None found |
| Blocklist status | Not flagged on any major DNS blocklist (AdGuard, CleanBrowsing, Cloudflare, Comodo, etc.) |

**Additional subdomains found (via certificate transparency logs, beyond manual enumeration):**
`ahmed.`, `badarpiplan.`, `p2psms.`, `school.`, `speedchak93.` — `p2psms` suggests an SMS notification integration (billing reminders); `school` is unexplained; `ahmed` and `speedchak93` look like personal/test subdomains.

**Open ports on main site IP (212.1.210.162)** — from the third-party scan, not independently verified:
- **Open:** 21 (FTP), 80 (HTTP), 110 (POP3), 143 (IMAP), 443 (HTTPS), 587 (SMTP submission), 993 (IMAPS), 995 (POP3S), **3306 (MySQL)**
- **Closed/filtered:** 20, 22, 23, 25, 53, 67-69, 119, 123, 156, 161-162, 179, 194, 389, 3000, 3389, 5060, 5900, 8000, 8080, 8888

Note: port 3306 (MySQL) being reachable from the internet is unusual and generally discouraged — though on shared hosting platforms like Hostinger this can be an artifact of the hosting provider's own architecture (e.g., remote DB management tooling) rather than a mistake specific to Badar Enterprises.

---

## 7. Live Network Map (from root shell session)

### Actual connected devices (via `arp -a`) — 5 devices, not 271
```
192.168.100.31  - d2:0f:9b:6e:66:12
192.168.100.227 - dc:4a:3e:68:06:ce
192.168.100.62  - be:53:32:9b:ad:1d
192.168.100.120 - 8e:2d:02:e0:af:e2
192.168.100.9   - (incomplete / not responding)
```
The 271 "remembered" hosts in the XML config are historical/stale entries, not current connections.

### Interfaces (via `ifconfig`)
| Interface | Role |
|---|---|
| `br0` | LAN bridge (192.168.100.1) |
| `eth0`, `gem1` | Physical GPON WAN-facing hardware paths |
| `lan4` | Physical Ethernet LAN port |
| `ra0` | 2.4GHz WiFi radio driver (4,543 RX errors noted — possible interference, worth monitoring) |
| `ssid0` | `WirelessNet` SSID virtual interface, bridged into `br0` |
| `wan1` | TR-069/management WAN — `12.0.33.51` |
| `wan2` | Second physical WAN path, high traffic volume — likely shared VLAN-tagged uplink |
| `ppp258` | **Actual internet connection** (PPPoE) — `172.16.47.184` ↔ ISP server `10.10.0.1`. Confirms ISP uses CGNAT/private addressing here too. |
| `vnni1-5`, `vuni1-5` | Huawei internal GPON service-multiplexing interfaces (voice/IPTV separation) — mostly idle, confirms those services aren't in active use |
| `lo:0` (169.254.62.9) | Internal link-local loopback alias used by a Huawei service daemon |

### Key running services (via `ps`)
- `cfg_cwmp` — TR-069 client (running, pointed at localhost per user's edit)
- `srv_wifi` — WiFi daemon
- `cfg_omci` — GPON/OMCI provisioning agent (ISP-side visibility, independent of CWMP)
- `web` — admin web UI server
- `bbsp` — core broadband service provisioning daemon (largest process, ~189MB)
- `dropbear` — lightweight SSH server (Huawei internal/maintenance use, separate from customer-facing SSH toggle)
- `voice_h248sip` — SIP/voice service (configured but disabled)
- `udm`, `apm`, `app_m`, `ssmp` — Huawei internal management/orchestration daemons

---

## 8. Open / Unresolved Items

- [ ] Run `passwd root` to replace the weak DES-crypt hash and factory-default password
- [ ] Run `displaywificonfig.sh` to retrieve the actual WiFi password in plaintext for safekeeping
- [ ] Decide whether to remove the "admin" and "Website" port-forward rules (currently inert due to CGNAT, but not real security — just luck of ISP architecture)
- [ ] Identify purpose of `wan2` interface's unexpectedly high traffic (541MB RX) — likely shared VLAN uplink, not independently confirmed
- [ ] Consider a config backup via `cfgtool clone deftree InternetGatewayDevice /mnt/jffs2/full_backup.xml` before further changes
- [ ] Monitor `ra0` RX errors if WiFi performance ever degrades

---

## 9. Useful CLI Commands Reference (Dopra Linux shell)

```sh
# Diagnostics
ontinfo                          # GPON optical signal levels (Rx/Tx power)
displaychannelstatus.sh          # WiFi channel congestion
displaywifistatus.sh             # connected WiFi clients, signal strength
speeddiag                        # built-in speed test
displaywificonfig.sh             # view WiFi config incl. plaintext password

# Network visibility
arp -a                           # live LAN device list
netstat -tlnp                    # listening ports + owning process
iptables -L -n                   # live firewall rules
ifconfig / ip addr               # interface details
cat /var/dhcp*.leases            # live DHCP leases

# Config management
cfgtool get deftree <path>       # read a live config value
cfgtool clone deftree <path> <file>   # backup a config subtree to flash

# Security
passwd root                      # change root password (recommended)
cat /etc/shadow                  # view password hashes (read-only recon)

# Logs
dmesg | tail -50
kmsgread
```

---

*Compiled from a Huawei HG8546M config export (`hw_ctree.xml`) and an interactive root shell session on the live device, both provided by the user.*