How to Hack a Cable Modem

8/13/2019 How to Hack a Cable Modem

1/18

Cable Modem Hacking Guide With PicturesVersion VII

Disclaimer:

THIS SO TW!"# IS P"OVID#D $$!S IS%% !&D !&' #(P"#SS O" IMP)I#DW!""!&TI#S* I&C)+DI&G* ,+T &OT )IMIT#D TO* TH# IMP)I#D

W!""!&TI#S O M#"CH!&T!,I)IT' !&D ITSS O" ! P!"TIC+)!"P+"POS# !"# DISC)!IM#D- I& &O #V#&T SH!)) TH# !+THO" ,# )I!,)#

O" !&' DI"#CT* I&DI"#CT* I&CID#&T!)* SP#CI!)* #(#MP)!"'* O"CO&S#.+#&TI!) D!M!G#S /I&C)+DI&G* ,+T &OT )IMIT#D TO*P"OC+"#M#&T O S+,STIT+T# GOODS O" S#"VIC#S0 )OSS O +S#* D!T!*O" P"O ITS0 O" ,+SISS I&T#""+PTIO&1 HOW#V#" C!+S#D !&D O&!&' TH#O"' O )I!,I)IT'* WH#TH#" I& CO&T"!CT* ST"ICT )I!,I)IT'*O" TO"T /I&C)+DI&G G)IG#&C# O" OTH#"WIS#1 !"ISI&G I& !&' W!'O+T O TH# +S# O THIS SO TW!"#* #V#& I !DVIS#D O TH#POSSI,I)IT' O S+CH D!M!G#-

!.s "ead irst:2- What cable modem models can be modi3ied4

While other models ma5 be unca66ed Theor5share su66orts onl5 the Motorola Sur3boardS,7288 9 S, 288 Models e;cluding VOIP models and the S,are or

6er3orm an5 modi3ications-

=- Is this 6rocess illegal4

Generall5* modi35ing a de?ice that 5ou 6urchased is not illegal* or using our de?ices on anet>ork that 5ou o>n or ha?e 6ermission* is not illegal- There are man5 restrictions todoing so* and e?er5 countr5 is di33erent- Theor5share takes no res6onsibilt5 3or useractions-

7- Can I steal ser?ice >ith 5our 6roducts@so3t>are4

While under certain circumstances 6roducts sold or distributed through Theor5share ma5 be used to steal ser?ice* Theor5share does not condone cable the3t and no su66ort >ill begi?en to an5 user >ishing to steal ser?ice-

ith this 6rocess is there a easier >a5 to unca6 m5 connection4

Preamble:,asicall5 the 6oint o3 this 6rocess is to increase the s6eed o3 5our cable modem usingmodi3ied 3irm>are or b5 using a s6ecial 6rogram to change the con3ig 3ile 5our modem

boots >ith- The 6rior is the 6re3erred method* both methods >ill >ork onl5 on MotorolaSur3board cable modems S,are modi3ication is com6atible >ithS,e?er it reAuires 5ou make a s6ecial cable >hich 5ou solder to the modem%smotherboard- The schematics 3or this cable can be 3ound in the 3orums at


2/18

htt6:@@theor5share-comi3 5ou generall5 ha?e 6roblems >ith com6uters or 5ou Bust >ant aeas5 >a5 to get unca66ed ?isit the Theor5share store:htt6:@@>>>-theor5share-com@inde;-6h64o6tion com 6h6sho6E6age sho6-bro>seEcategor5 id 2Eo6tion com 6h6sho6EItemid 78

,elo> is a descri6tion >ritten b5 one user about unca66ing* 6remods and >hatmodi3ication its all about:

http://theoryshare.com/http://www.theoryshare.com/index.php?option=com_phpshop&page=shop.browse&category_id=1&option=com_phpshop&Itemid=30http://www.theoryshare.com/index.php?option=com_phpshop&page=shop.browse&category_id=1&option=com_phpshop&Itemid=30http://www.theoryshare.com/index.php?option=com_phpshop&page=shop.browse&category_id=1&option=com_phpshop&Itemid=30http://theoryshare.com/http://www.theoryshare.com/index.php?option=com_phpshop&page=shop.browse&category_id=1&option=com_phpshop&Itemid=30http://www.theoryshare.com/index.php?option=com_phpshop&page=shop.browse&category_id=1&option=com_phpshop&Itemid=30http://www.theoryshare.com/index.php?option=com_phpshop&page=shop.browse&category_id=1&option=com_phpshop&Itemid=30


3/18

Im6ro?ing 5our s6eed is a de3inite gi?en- "ight no>* I%m subscribed to the hat I%m running at rightno>- There are lots o3 hard to 3ind con3igs out there* but a 7rd 6art5 sni33er or the built insni33er can 3ind them i3 5ou let it go 3or a>hile- De6ending on 5our is6* 5ou could sni33out 2 888@=888- It all comes do>n to >hat the is6 has to o33er- Some 6eo6le are luck5

enough to still be able to get their modem to b56ass the t3t6 ser?er and take a modi3iedcon3ig 3ile 3rom a s6oo3ed ser?er set u6 on their s5stem- That is ?er5 rare toda5* butthose that can do it are able to set their u6load@do>nload to custom ?alues-

!s 3ar as getting caught* 5our is6 has >a5s o3 3inding out >ho%s using their band>idth* but it costs more mone5 and takes time to do so- In most cases* and because 5ou are notdisru6ting the net>ork * it%s not >orth their time@mone5- Plus* 5ou are 3l5ing under theradar-

In the 3e>* 6ublic cases that indi?iduals ha?e been caught* the5 >ere totall5 abusing the band>idth- )ike lea?ing ,it Torrent or other 3ile sharing 6rograms running at 3ull s6eedinde3initel5- "ed 3lags >ill 3l5 i3 an unkno>n source is do>nloading se?eral Tera,5tes amonth as >ell as u6loading countless Gigab5tes- &ot to mention the ser?er t56e* TPsetu6s that >ere being utili ed- The entire situation >as ugl5-

Cable internet is a shared connection. Killing the bandwidth causes problems forother users on the node.

I%?e 5et to read a 6ost 3rom someone here at Theor5share regarding their is6 >atchingthem or sending out an5 letters- That%s because >e go about our internet business asusual- These 6eo6le* m5sel3 included* enBo5 the 3aster s6eeds and use close to the sameamount o3 band>idth as be3ore- It%s not 6lanned or an5thing- I Bust continue >ith m5normal acti?ities-

M5 s6eeds are Bust 3aster-

Currentl5* the Sur3board series modems /S,7288 9 S,ithout an5 need o3 cables- ust do>nload the +nca66ing Jit and 3ollo> the ste6s-That%s it-

The S, 288 took Auite some time to e;6loit- inall5* this 5ear* it became an o6tion- Inorder to unca6 the S, 288* 5ou >ill need a blackcat cable- This cable >ill need to besoldered on to s6eci3ic 6oints inside the modem- 'ou >ill then need the 3lash so3t>are toget it going-

Written b5 Shi3ter

or more in3ormation* hel6 and u6dates* ?isit htt6:@@theor5share-com i3 5ou do not ha?e aSur3board Modem* or 3ind this 6rocess is too hard 3or 5ou to com6lete0 6re9modi3iedmodems are 3or sale at htt6:@@theor5share-com >hich include the modem 6re9modi3ied>ith 3irm>are and su66ort- !lso su66ort 3orums !.s and P=P su66ort are a?ailable-

http://theoryshare.com/http://theoryshare.com/http://theoryshare.com/http://theoryshare.com/http://theoryshare.com/


4/18

,e3ore Continuing "ead the ollo>ing:Some things to kno> be3ore using this guide K Make sure 5ou understand these:

2- This 6rocess is real and can increase the s6eeds 5ou get 3rom 5our cable ser?ice-

=- This guide ma5 not >ork >ith all modems it is currentl5 onl5 kno>n to >ork >ith

sur3board modems but should >ork >ith others-7- &o matter ho> much 5ou unca6 5ou can be caught +ST !S #!SI)' use at 5our o>nrisk-

ork 3or 5ou certain con3igurations >ith 5ourmodem or is6 ma5 6re?ent 5ou 3rom 6ro6erl5 6er3orming this 6rocess-

- I C!&&OT hel6 5ou i3 5ou do &OT ha?e a Sur3board modem-

- inall5 6lease read through all o3 the documentation be3ore asking me or an5one else3or su66ort thank 5ou-

7. Every Step must be followed exactly as stated, in exact order. Deviation will

result in !"#$%E.

There are = good >a5s to +nca6 the 3irst is to use hacked 3irm>are the second is usingDHCP orce- ,oth methods >ill >ork on Sur3board 7288@as designed onl5 3orMotorolas so i3 this doesn%t >ork it 6robabl5 can%t be done >ith 5our modem-

$ncapping &ith 'ac(ed irmware"f you have not read all the information prior to this please do so now. "f you ignore

this warning you will most li(ely have problems when you continue.I"ST THIS WI)) O&)' WO"J WITH S+ ,O!"D S,ith an5 other modems- or the S,7288 5ou must use the!lternate method 3or loading 3irm>are- I 'O+ !"# O& ! #+"ODOCSIS S'ST#MTHIS P"OC#SS WI)) WO"J WITH O&)' TH# 7288*


5/18


6/18

ST#P = :

Go to net>ork settings in control 6anel and change 5our net>ork settings-

Change 5our net>ork settings to the 3ollo>ing:

IP !DD"#SS: 2L=-2 F-288-28

S+,T: = -= -= -8

G!T#W!': 2L=-2 F-288-2

D&S: )ea?e blank

Once 3inished Disable then #nable 5our net>ork inter3ace-


7/18


8/18

ST#P 7:O6en &et,oot and ?eri35 the bo;es %#nable TP Ser?er%* "eset Modem ,e3ore ,ootingNand !uto IPN are checked- &o> 6lug 5our modem in to POW#" O&)'- Then a3terabout 2 minute* 6ress boot o?er net>ork- 'our modem should reset then begin a 6o>eru6 DO &OT reset 5our modem this ma5 take a minute or t>o- Once &etboot sho>s thatthe TP Client has been disconnected 5our modem is 3inished net booting and 5ou ma5go on to the ne;t ste6- DO &OT C)OS# S,"ID#"

)"C*$%ES +E# &

+efore -et +oot


9/18


10/18

!fter Successful -et +oot


11/18


12/18

ST#P n to +6grade irm>areN Proceedto u6grade 5our 3irm>are >ith the 3irm>are corres6onding to 5our cable modem in the

irm>are 3older- iber>are 3irm>are is 3or ad?anced users onl5 and is not recommended3or general use- !t this 6oint 5our modem >ill begin u6grading DO &OT un6lug 5ourmodem or change 6ages on 5our bro>ser until 5our modem reboots this in rare cases ma5take u6 to minutes- Once 5our modem has rebooted return to the con3ig 6age and ?eri35that the 3irm>are has been u6dated b5 seeing i3 the hack tab is a?ailable- I3 so 5ou ma5

6lug 5our modem back into coa; and go on at this stage the 3irm>are is 6ermanentl5loaded and no 3urther action is reAuired to make it sta5 on the modem-

http://192.168.100.1/http://192.168.100.1/


13/18

Once this u6grade is 3inished 5ou ma5 change 5our IP back to normal and 5ou can accessthe internet and the hacked 3irm>are-

Ste6


14/18

Ste6


15/18

Ste6 :"eboot the modem and go to: htt6:@@2L=-2 F-288-2@con3igdata-htmlI3 5ou did e?er5thing right /and the shell did not crash1 it should be changed- I3 the shelldid crash* un6lug the modem 3or 78 seconds and tr5 it again

ST#P :

!ll Cable Modems use con3ig 3iles that control 5our modem s s6eed* im6ortance and a3e> other 6arameters- #ach time 5our modem boots it automaticall5 do>nloads a con3ig3ile chosen b5 5our is6- To unca6 5ou must identi35 a con3ig 3ile >hich has 3aster s6eedsthan the one 5ou are currentl5 using-

The Hack>are 3irm>are that 5ou ha?e Bust loaded includes a con3ig 3ile sni33er under thesni33er tab- !t this 6oint the easiest route to take is to lea?e the modem on 3or a 3e> hoursthen check back to see i3 5our con3ig list has been u6dated- O3ten con3ig names are Auite

http://192.168.100.1/configdata.htmlhttp://192.168.100.1/configdata.html


16/18

ob?ious as to >hat s6eed the5 >ill gi?e 5ou because o3 their name- I3 the con3ig 3ilenames 5ou ha?e are not eas5 to understand 5ou ma5 ha?e to tr5 a 3e>- I3 the con3igs donot ha?e an5thing in common and there are a large number o3 them 5ou are on a d5namiccon3ig s5stem and 6er3orm a method kno>n as mac cloning ?isit htt6:@@theor5share-com 3or more details- I3 5ou 3ind a con3ig 5ou >ant to tr5 sim6l5 go back to the hack 6age andenter the name o3 the con3ig 5ou >ant to load and sa?e the change- "eboot the modemand look at the ma; do>nload@u6load s6eed listed in the hack 6age this tells 5ou ho> 3astthe con3ig is i3 5ou do not kno>-

I3 5ou ha?e Trouble inding Con3igs or Sim6l5 >ant to 3ind more use the method belo>:

O6en the S&MPC3g !dmin Program locate the i6 address range near the bottom- Then3or the 3irst Q in the range 6ut 5our h3c i6 address listed in the DHCP orce !66lication-

or the second ?alue 6ut a address considerabl5 higher but no to much higher- #(-28-2hich con3ig is the 3astestin man5 cases this is not necessar5 ho>e?er because the con3igs are named like,!&D-cm* ,"O& #-cm* GO)D-cm* P)!TI&+M-cm in >hich case kno>ing >hichis the 3astest does not reAuire a technical solution-

I3 the con3igs do not list 5ou >ill need to retrie?e 5our current con3ig an e;6lanation 3orthis can be 3ound in the archi?e this >as distributed in-

!3ter 5ou ha?e retrie?ed the con3ig o6en it >ith Con3ig #dit and locate 5our communit5string- It should be a line something like this

snm6 mib obBect 2-7- -2-7-F7-2-=-2-nload it >hen it boots using the con3ig bootcommand- I3 5our is6 uses d5namic con3igs /each modem gets a uniAue con3ig1 5ou >illneed to use the 3ollo>ing oids Do>nload: 2-7- -2-=-2-28-2= -2-2-7-2- -2 or +6load:2-7- -2-=-2-28-2= -2-2-7-2-7-2 in S&MPc3g then once 5ou 3ind a 3aster modem 3ind itsmac address and clone it- This is not di33icult and there are man5 7 rd 6art5 6rograms thatcan hel6 5ou >ith this- "e3er to the 3irm>are command list 3or all 3unctions-

&ote that the S,7288 uses a di33erent hacked 3irm>are than the S,are can be used on the S,


17/18

-he;-bin-

I3 the u6date >ill not go through it is because o3 2 o3 = things either 5our 3irm>are?ersion is higher than S,728897-=-2 9SCM889&OSH#)) 3or the S,7288 orS,hich case kno>ing>hich is the 3astest does not reAuire a technical solution- I3 the con3igs do not list 5ou>ill need to retrie?e 5our current con3ig an e;6lanation 3or this can be 3ound in the

archi?e this >as distributed in- !3ter 5ou ha?e retrie?ed the con3ig o6en it >ith Con3ig#dit and locate 5our communit5 string- #nter this string into S&MPC3g to 3ind thecon3ig names and then later also modi35 this 6arameter in DHCP orce-

7- O6en the DHCP orce !66lication* be3ore 5ou can tr5 to unca6 5ou must 3irst disablethe media sense o6tion- This can be 3ound under the DHCP menu- Once media senseis disabled 5ou >ill most likel5 ha?e to restart 5our com6uter- !3ter 5our com6uter isrestarted o6en the DHCP orce a66lication again enter 5our modem%s M!C !ddressand use the disco?er 3unction- This time a3ter the disco?er 3inishes change the con3ig

http://192.168.100.1/http://192.168.100.1/


18/18

Documents

How to Hack a Cable Modem