Instanet Router Hacking

19 April 2013

I am using Instanet as my ISP here in Spain. Instanet makes use of WiMAX internet
technology, which allows you to have a mobile broadband connection much like WiFi
without renting expensive telephone lines. The modem itself is a ZTE IX350, which
essentially functions as a router combining WiFi and 4-port 100Mbps ethernet connection.
My flat rental manager gave me two modems in exchange for reactivating the usual
broadband connection as the previous tenant didnt pay his/her last bill.
Since I have two modems, it is only natural for one to want to combine the bandwidth into a
single connection; for this purpose, my other OpenWrt-based router will come in handy. Alas,
the device settings on the modem are protected by a password. Worse still, it is not the usual
or default username and password (admin:admin) combination but in fact different with each
modem that is given to the consumer. Fortunately though, there is a way to obtain the
password! We can do so by accessing the serial port of the modem using a USB-Serial
adapter.
However, in order to perform this hack, it is necessary to have a basic electronic skill such as
soldering and making connections to the PCB.
First, open up the router by removing the front black plastic cover. On each corner there will
be 4 ordinary phillips screw. Be careful not to damage the internal WiMAX antenna
connections. Access to the serial port is provided by unpopulated jumper connector indicated
by X17. Pin 2 is TX, pin 3 is RX and pin 4 is GND. See the image below as a reference.

Serial port on the ZTE-IX350 WiMAX modem

After youve done it, connect to the port using a USB-Serial adapter and fire up your serial
terminal, for example Putty, and set the connection setting for the serial port to be 115200 N8.
Turn on the modem, and youll see typical Linux kernel initialisations and stuff. After the
messages finished updating, press Enter and voila! You are given a root [!] shell.
To get the admin password for the web interface, type this command into the shell:
1cat /etc_rw/param/inic_param

Et voila! Theres your admin password! Now you will able to enter the web interface on
192.168.0.1 (the default IP of the modem) using it.