[paulo_andre]

now you can gain ssh access, as described in this webpage: http://stefans.datenbruch.de/lafonera/

or, if you don't want to read what's behind this hack, just run these commands on the webpage:
/usr/sbin/iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT
/etc/init.d/dropbear

now you have ssh access to the fonera, try to connect with putty. the default login is root/admin

if you want to make things permanent, just follow the instructions on this site:
http://jauzsi.hu/2006/10/13/inside-of-the-fonera

PS: by the way, I just copied information a few posts back, you could have easily found it.

[Honki]

[paulo_andre]

again, you could have easily found this information if you read the thread... it was created to try to convince BS to port dd-wrt to the fonera, since THERE IS NO OTHER COMPATIBLE FIRMWARE FOR IT OTHER THAN FON'S. About WDS, I haven't tried it but my guess is forget it until there is a compatible dd-wrt or openwrt firmware.

[lelem]

BS, what do you think about a version with activation like dd-wrt/x86
It will be avaiable only for people who donate...

PS: thank you for dd-wrt, it's great!

[bingobommel]

Hacking the La Fonera - PART II

How to hack "La Fonera" without using FONs webpage:

http://bingobommel.blogspot.com/

[murdockdj]

Hi, I'm working in to the WDS enabled fonera, actually my fonera is connected via WDS to a linksys dd-wrt router, the radio link is working, but i can't ping without cable.

I need some help, to configure the interfaces.

iwconfig:

ath0 IEEE 802.11g ESSID:"wds"
Mode:Master Frequency:2.437 GHz Access Point: 00:18:xx:xx:xx:C6
Bit Rate:0 kb/s Tx-Power:18 dBm Sensitivity=0/3
Retry:off RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality=65/98 Signal level=-30 dBm Noise level=-95 dBm
Rx invalid nwid:15 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

ath1 IEEE 802.11g Mode:Repeater Frequency:2.437 GHz
Access Point: 00:0F:xx:xx:xx:64 Bit Rate:0 kb/s Tx-Power:18 dBm
Sensitivity=0/3
Retry:off RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality=65/98 Signal level=-30 dBm Noise level=-95 dBm
Rx invalid nwid:1078 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

ifconfig:

ath0 Link encap:Ethernet HWaddr 00:18:xx:xx:xx:C6
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4 errors:0 dropped:0 overruns:0 frame:0
TX packets:503 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1368 (1.3 KiB) TX bytes:79101 (77.2 KiB)

ath1 Link encap:Ethernet HWaddr 00:18:xx:xx:xx:C5
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:519 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:1 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:83333 (81.3 KiB) TX bytes:1448 (1.4 KiB)

wlanconfig ath1 list:

ADDR AID CHAN RATE RSSI DBM IDLE TXSEQ RXSEQ CAPS ACAPS ERP STATE MODE
00:0f:xx:xx:x:64 1 6 36M 78 -17 0 232 18240 0 1 Normal

To enable the WDS radio link, i used this commands:

root@OpenWrt:~# wlanconfig ath0 destroy
root@OpenWrt:~# wlanconfig ath1 destroy
root@OpenWrt:~# wlanconfig ath0 create wlandev wifi0 wlanmode ap
ath0
root@OpenWrt:~# wlanconfig ath1 create wlandev wifi0 wlanmode wds
ath1
root@OpenWrt:~# iwconfig ath0 essid wds channel 6
root@OpenWrt:~# iwpriv ath1 wds_add 00:0F:xx:xx:xx:64
root@OpenWrt:~# iwpriv ath1 wds 1
root@OpenWrt:~# ifconfig ath1 up
root@OpenWrt:~# ifconfig ath0 up
root@OpenWrt:~# brctl addbr br0
root@OpenWrt:~# brctl addif br0 ath1
root@OpenWrt:~# brctl addif br0 ath0
root@OpenWrt:~# ifconfig br0 up

I need some help, someone is working on WDS at fonera ?

My SKYPE id is "murdockdj" and my msn "salva@murdockdj.com"

Thks.

[fosk]

So... it's possible to estabilish a WDS link between a BROADCOMM based AP (linksys dd-wrt router) and the ATHEROS fonera? /me can't figure this!

[murdockdj]

Hi,

I have the fonera connected via WDS to a linksys ddwrt router, the fonera don't response to pings, but the link to internet is working perfectly.

Now the fonera is working as a WDS repeater, and only work as a wireless bridge.

I'm connected with my notebook to the Fonera SSID, and internet browsing, without any ethernet cable on the fonera ;)

Now, I need some help to configure the br0. now my fonera is a passive wds repeater.

Thanks

[aLeX]

Has someone tried to flash the fonera with the original firmware from SMC using SCP and MDT?. Would it be possible?

[wildblue]

i am also interrested in flashing a smc firmware.

the smc webt-g and the la fonera are originally the same devices. the only difference is that webt-g has 2 antennas. one inside the device and one external.
the fonera has only one external antenna. i think it must also be possible to integrate a second antenna into the la fonera.

i sent an email to smc because i want to view the source-code, but i did not get an answer, yet.

i saw a log of the redbootloader of smc and la fonera on another site.
there must be a linux-firmware on the smc-device.

i also think that smc has to publish the source-code of the webt-g, because of the gpl-thing!
whats about gpl-violations.org? they care about such violations.
could anybody take care about that?

or does anybody know where to get the source of webt-g?
i didnt find it on their website nor on search engines.

[Krasny]

I seriously doubt that smc will answer you, and if they do it, you will get an automated reply without the source code.

A lot of routers violates the GPL, even those that supply the source code usually don't give the entire code or publish an obsolete source code.

please keep us update with any news.

[wildblue]

attention - new firmware fixes the bug to get shell access!

as i found the bug on 16.11.2006, nobody thought it would work.
but it did work for many foneros in the world.

some stupid idiot was putting my hack on his blog and now the newspapers and every blogger in the world is beliving that he was the one.

(http://bingobommel.blogspot.com)
...
Montag, 20. November 2006
Inspired by Michaels and Stefans Hack...

if he (the bommel!) could only give the real inspiration of "his" hack...
anyway! i hope many users could get around with his howto.

but now the firmware of lafonera is fixed. when you connect your router to the net and a firmwareupdate is done, the posted hack will not work anymore.

you can read the details on:
http://blog.fon.com/de/archive/technology/fonfirmware-v0711.html

...
+ [Web interface] Corrected bug that caused a security problem when using strange characters on the forms.
...

so, lets try it once again!
for those who had no chance to get access to their fonera.

[wildblue]

posted on
http://bingobommel.blogspot.com/2006/11/hacking-la-fonera-part-ii.html

wildblue Hat gesagt…

yes, wonderful copy+paste, mr bommel.
as everybody can see here:
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=5083&postdays=0&postorder=asc&start=90
is, that mr bommel joined our forum on 13.11.06

bingobommel
DD-WRT Novice
Joined: 13 Nov 2006


the hack you are willing to have found was posted on 16 Nov 2006 in the same forum.
the idea for hacking the webinterface was there on 15 Nov 2006.

but anyway! Good Copy+Paste Mr. Bommel!
Thankyou for your howto.

at least one point.
if you want to disable the homephoning-thing:
visit our forum at:
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=5083&postdays=0&postorder=asc&start=105

greetings to everyone!
wildblue
23. November 2006 15:32:00 PST

[aLeX]

La Fonera is using an Atheros 2136, which is very similar to the Atheros 2135 (except for the turbo G mode). Basically is the same chip.

http://www.atheros.com/pt/AR5006AP-G.htm
http://www.atheros.com/pt/AR5006AP-GS.htm

There is a small router (Meraki Mini) based on Atheros 2135 and OpenWRT ( http://www.meraki.net/linux/ ). The source code is public so anyone can download and play with it.

So, would it be possible to download the Meraki firmware, compile, send via SCP and flash the fonera using MTD?

[bingobommel]

@wildblue:
as you can read on my blog i never said that i found the way to "hack" the fonera on my own. i just collected all the ideas, made the necessary html-files and some screenshots and put all together to a tutorial for everyone. see the first part my original post:

"Inspired by Michaels and Stefans Hack the FON-Community found the following way to inject inject Shell code into the system without using FONs Website." (see bingobommel.blogspot.com)

so if you feel bad about this blog i am sorry. but this is the way way a community works...