Çözüldü TP-Link VC220-G3u Root Yetkisi Elde Etme

Recep Baltaş · 24 Kasım 2025

Bildiğiniz üzere geçtiğimiz günlerde TP-Link VC220-G3u'nun config anahtarını kırdırdık. Fakat şu anda takıldığımız bir nokta var: Cihaz şifrelenmiş config dosyasını sorunsuz okuyor, kabul ediyor ve uyguladığını belirtip sistemi yeniden başlatıyor ~~ama uygulamıyor.~~ Yine başa dönmüş oluyoruz.

Burada yaptığımız bir hata var ve onu bulmaya çalışıyoruz.

Öncelikle cihazdan aldığım config dosyası:

https://www.mediafire.com/file/gkutxd99ettt6f5/conf.bin/file

Bu dosyayı aşağıdaki script ile ayıklıyoruz:

Python:

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import argparse
import sys
import re
from struct import pack, pack_into, unpack_from
from hashlib import md5
from Cryptodome.Cipher import DES

# --- GLOBAL AYARLAR ---
packint = '>I'  # VC220-G3u Big Endian kullanır
XOR_MASK = [0x74, 0x8d, 0xa5, 0x0b, 0xf9, 0x3e, 0x2d, 0xcf]

# --- YARDIMCI FONKSİYONLAR ---

def derive_key(prod_id_str):
    """Product ID stringinden (örn: '4aa13401') DES anahtarı türetir."""
    if prod_id_str.startswith("0x"):
        prod_id_str = prod_id_str[2:]
 
    if len(prod_id_str) != 8:
        print(f"[!] UYARI: Product ID ({prod_id_str}) 8 karakter değil! Varsayılan anahtar riskli olabilir.")
        # Yine de devam etmeye çalışalım, belki kullanıcı kısa girmiştir.
        prod_id_str = prod_id_str.ljust(8, '0')

    key_bytes = bytearray()
    for i in range(8):
        char_code = ord(prod_id_str[i])
        mask_byte = XOR_MASK[i]
        key_bytes.append(char_code ^ mask_byte)
    return bytes(key_bytes)

def extract_product_id_from_xml(xml_content):
    """XML içinden X_TP_ProductID değerini bulur."""
    # Hedef: <X_TP_ProductID ... d=0x4aa13401 ... />
    # Regex ile d=0x........ kısmını yakalayalım.
    match = re.search(rb'X_TP_ProductID.*?d=0x([0-9a-fA-F]+)', xml_content)
    if match:
        return match.group(1).decode('utf-8')
    return None

# --- SIKIŞTIRMA (ALAIN DUCHARME) ---

def compress(src):
    '''TP-Link Özel Sıkıştırma Algoritması'''
    # Son baytın NULL olduğundan emin ol
    if src and src[-1] != 0:
        src += b'\0'
   
    size = len(src)
    buffer_countdown = size
    hash_table = [0] * 0x2000
    dst = bytearray(0x8000)    # max buffer
    block16_countdown = 0x10
    block16_dict_bits = 0
    d_p = 7 # Header (4 byte size + 1 byte first char + 2 byte dict bits)
    d_pb = 5 # Dictionary bits position

    def put_bit(bit):
        nonlocal block16_countdown, block16_dict_bits, d_p, d_pb, dst
        if block16_countdown:
            block16_countdown -= 1
        else:
            pack_into('H', dst, d_pb, block16_dict_bits)
            d_pb = d_p
            d_p += 2
            block16_countdown = 0xF
        block16_dict_bits = (bit + (block16_dict_bits << 1)) & 0xFFFF

    def put_dict_ld(bits):
        ldb = bits >> 1
        while True:
            lb = (ldb - 1) & ldb
            if not lb: break
            ldb = lb
        put_bit(int(ldb & bits > 0))
        ldb = ldb >> 1
        while ldb:
            put_bit(1); put_bit(int(ldb & bits > 0)); ldb = ldb >> 1
        put_bit(0)

    def hash_key(offset):
        b4 = src[offset:offset+4]
        hk = 0
        for b in b4[:3]: hk = (hk + b) * 0x13d
        return ((hk + b4[3]) & 0x1FFF)

    # Header Yaz: [SIZE (4 bytes)]
    pack_into(packint, dst, 0, size)
    dst[4] = src[0] # İlk karakteri kopyala
 
    buffer_countdown -= 1
    s_p = 1; s_ph = 0

    while buffer_countdown > 4:
        while s_ph < s_p:
            hash_table[hash_key(s_ph)] = s_ph; s_ph += 1
        hit = hash_table[hash_key(s_p)]
        count = 0
        if hit:
            while True:
                if src[hit + count] != src[s_p + count]: break
                count += 1
                if count == buffer_countdown: break
            if count >= 4 or count == buffer_countdown:
                hit = s_p - hit - 1
                put_bit(1)
                put_dict_ld(count - 2)
                put_dict_ld((hit >> 8) + 2)
                dst[d_p] = hit & 0xFF; d_p += 1
                buffer_countdown -= count; s_p += count
                continue
        put_bit(0)
        dst[d_p] = src[s_p]; s_p += 1; d_p += 1; buffer_countdown -= 1
   
    while buffer_countdown:
        put_bit(0)
        dst[d_p] = src[s_p]; s_p += 1; d_p += 1; buffer_countdown -= 1
   
    pack_into('H', dst, d_pb, (block16_dict_bits << block16_countdown) & 0xFFFF)
    return dst[:d_p]

# --- DECOMPRESS (ŞİFRE ÇÖZMEK İÇİN) ---

def uncompress(src):
    block16_countdown = 0; block16_dict_bits = 0; s_p = 4
    def get_bit():
        nonlocal block16_countdown, block16_dict_bits, s_p
        if block16_countdown: block16_countdown -= 1
        else:
            block16_dict_bits = unpack_from('H', src, s_p)[0]; s_p += 2; block16_countdown = 0xF
        block16_dict_bits = block16_dict_bits << 1
        return 1 if block16_dict_bits & 0x10000 else 0
    def get_dict_ld():
        bits = 1
        while True:
            bits = (bits << 1) + get_bit()
            if not get_bit(): break
        return bits
    try:
        size = unpack_from(packint, src, 0)[0]
        dst = bytearray(size)
    except: return None
    s_p = 4; d_p = 0
    if s_p < len(src): dst[d_p] = src[s_p]; s_p += 1; d_p += 1
    while d_p < size:
        if get_bit():
            num_chars = get_dict_ld() + 2; msB = (get_dict_ld() - 2) << 8
            if s_p >= len(src): break
            lsB = src[s_p]; s_p += 1
            offset = d_p - (lsB + 1 + msB)
            for i in range(num_chars):
                if d_p < size: dst[d_p] = dst[offset + i]; d_p += 1
        else:
            if s_p < len(src) and d_p < size: dst[d_p] = src[s_p]; s_p += 1; d_p += 1
            else: break
    return dst

# --- ANA FONKSİYONLAR ---

def encrypt_xml(input_file, output_file):
    """XML -> BIN"""
    print(f"[*] '{input_file}' okunuyor...")
    with open(input_file, 'rb') as f:
        xml_data = f.read()

    # 1. Product ID bul ve Anahtar Üret
    pid = extract_product_id_from_xml(xml_data)
    if not pid:
        print("[!] HATA: XML içinde 'X_TP_ProductID' bulunamadı. Manuel '4aa13401' kullanılıyor.")
        pid = "4aa13401"
 
    key = derive_key(pid)
    print(f"[*] Product ID: {pid}")
    print(f"[*] Türetilen Anahtar: {key.hex().upper()}")

    # 2. Sıkıştır
    print("[*] Veri sıkıştırılıyor...")
    compressed_data = compress(xml_data)

    # 3. MD5 Ekle
    # Yapı: [MD5 Hash (16 byte)] + [Compressed Data (ki bunun başında size var)]
    m = md5()
    m.update(compressed_data)
    md5_header = m.digest()
 
    payload = md5_header + compressed_data

    # 4. Padding (DES için 8'in katı olmalı)
    pad_len = 8 - (len(payload) % 8)
    if pad_len < 8:
        payload += b'\0' * pad_len
        print(f"[*] Padding eklendi: {pad_len} byte")

    # 5. Şifrele
    print("[*] Şifreleniyor...")
    cipher = DES.new(key, DES.MODE_ECB)
    encrypted_data = cipher.encrypt(payload)

    with open(output_file, 'wb') as f:
        f.write(encrypted_data)
    print(f"🎉 BAŞARILI! Şifreli dosya: {output_file}")


def decrypt_bin(input_file, output_file):
    """BIN -> XML"""
    # Daha önce çalışan mantık, buraya entegre edildi
    with open(input_file, 'rb') as f:
        data = f.read()

    # Bu kısım biraz manuel, çünkü Product ID şifreli dosyanın içinde.
    # Kullanıcıdan Product ID isteyebiliriz veya bilinen '4aa13401' kullanırız.
    # Senin durumunda 4aa13401 sabit gibi.
    pid = "4aa13401"
    key = derive_key(pid)
 
    print(f"[*] Şifre çözülüyor (PID: {pid}, Key: {key.hex().upper()})...")
    cipher = DES.new(key, DES.MODE_ECB)
    try:
        decrypted = cipher.decrypt(data)
    except Exception as e:
        print(f"[!] DES Hatası: {e}")
        return

    # Header Kontrol
    payload = decrypted[16:] # MD5'i atla
 
    global packint
    packint = '>I' # Big Endian
 
    print("[*] Decompress ediliyor...")
    xml_data = uncompress(payload)
 
    if xml_data and b'<?xml' in xml_data:
        # Sonda kalan paddingleri temizle
        while xml_data[-1] == 0:
            xml_data = xml_data[:-1]
       
        with open(output_file, 'wb') as f:
            f.write(xml_data)
        print(f"🎉 BAŞARILI! XML dosya: {output_file}")
    else:
        print("[!] HATA: Decompress başarısız veya XML geçerli değil.")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="TP-Link VC220-G3u Config Tool")
    parser.add_argument("infile", help="Giriş dosyası (conf.bin veya conf.xml)")
    parser.add_argument("-d", "--decrypt", action="store_true", help="Şifre Çöz (BIN -> XML)")
    parser.add_argument("-e", "--encrypt", action="store_true", help="Şifrele (XML -> BIN)")
 
    args = parser.parse_args()
 
    # Otomatik mod algılama
    mode = None
    if args.encrypt: mode = 'enc'
    elif args.decrypt: mode = 'dec'
    elif args.infile.endswith('.xml'): mode = 'enc'
    elif args.infile.endswith('.bin'): mode = 'dec'
 
    if mode == 'enc':
        outfile = args.infile.replace('.xml', '.bin')
        if outfile == args.infile: outfile += ".bin"
        encrypt_xml(args.infile, outfile)
    elif mode == 'dec':
        outfile = args.infile.replace('.bin', '.xml')
        if outfile == args.infile: outfile += ".xml"
        decrypt_bin(args.infile, outfile)
    else:
        print("[!] Mod belirlenemedi. Lütfen -e veya -d kullanın.")

Çıkan XML dosyasının sonunda uyumsuz bir karakter var:

https://www.mediafire.com/file/6ev7hqp2oba2798/conf.xml/file

Değişiklikleri yapıp root hesabını açıyoruz ama işe yaramıyor. İlk amacımız, XML'de bir değişiklik yapıp Router gerçekten bunu okuyor mu buna bakmak olacak.

@Majdev @SetoKaiba

Güncelleme: Cihazı sıfırlamadan önce config dosyaları bozuk çıkıyordu. Sıfırlama sonrası düzeldi. Sanırım bu defa olacak.
Güncelleme 2: Custom config dosyasını yedi modem. Sıra root hesabında

Şimdi cihaz config dosyasını uyguladı. Üçüncü denemede bunu ekleyip yüklüyorum, bakalım olacak mı?

XML:

      <Users>
        <UserNumberOfEntries val=2 />
        <User instance=1 >
          <Level val=1 />
          <Username val=admin />
          <Password val=admin />
          <RemoteAccessCapable val=1 />
          <Allowed_RA_Protocols val=HTTPS />
        </User>
        <User instance=2 >
          <Enable val=0 />
          <Level val=2 />
          <Username val=root />
          <Password val=wbQn09pp@G />
        </User>
        <User nextInstance=3 />
      </Users>

Güncelleme: Olumsuz. Root hesabını sildi.

XML:

<?xml version="1.0"?>
<DslCpeConfig>
  <InternetGatewayDevice>
    <DeviceSummary val="InternetGatewayDevice:1.1[](Baseline:1, EthernetLAN:1)" />
    <LANDeviceNumberOfEntries val=1 />
    <WANDeviceNumberOfEntries val=3 />
    <DeviceInfo>
      <ManufacturerOUI val=984827 />
      <SerialNumber val=5CA6E60DF4FE />
      <HardwareVersion val="VC220-G3u v2 00000001" />
      <SoftwareVersion val=VC220-G3u-v2.0_241120 />
      <UpTime val=26 />
      <X_TP_DevName val=VC220-G3u />
      <X_TTNET_SerialNumber val=5CA6E60DF4FE />
      <X_TTNET_MACAddress val=5C:A6:E6:0D:F4:FE />
      <X_TTNET_ConfigVersion val=3 />
    </DeviceInfo>
    <ManagementServer>
      <URL val=http://hdmacs-tr069.ttnet.com.tr/cwmpWeb/CPEMgt />
      <Username val=9848275CA6E60DF4FE />
      <Password val=1762039826691a />
      <PeriodicInformInterval val=99001 />
      <PeriodicInformTime val=2025-11-09T15:46:24 />
      <ParameterKey val=5241795360 />
      <X_TP_connReqPath val=/4284 />
      <ConnectionRequestURL val=http://10.183.104.92:7547/4284 />
      <ConnectionRequestUsername val=5CA6E60DF4FE-VC220-G3u-984827 />
      <ConnectionRequestPassword val=799bdf07ef897507c4cf159209c37ea5 />
      <X_TP_Flag val=1 />
      <X_TP_BoundIfName val=nas10_2 />
      <X_TTNET_ACS_IP_ETH val=127.0.0.1 />
      <Manual_uint32 val=2147483649 />
    </ManagementServer>
    <X_TP_EthSwitch>
      <EnableVirtualPorts val=1 />
      <NumberOfVirtualPorts val=4 />
      <IfName val=eth0 />
    </X_TP_EthSwitch>
    <X_TP_NetCfg>
      <DNSServers val=193.192.98.8,212.154.100.18 />
      <DNSifAliasName val=EWAN_INTERNET />
    </X_TP_NetCfg>
    <X_TP_Net6Cfg>
      <DNSv6Servers val=::,:: />
      <CurrDNSv6Server val=:: />
      <DNS6ifAliasName val=DSL_INTERNET />
    </X_TP_Net6Cfg>
    <X_TP_UserCfg>
      <AdminPwd val=wbQn09pp@G />
      <UserPwd val=admin />
      <DefaultAdminPwd val=wbQn09pp@G />
      <CurrentLanguage val=en />
    </X_TP_UserCfg>
    <X_TP_AppCfg>
      <HttpCfg>
        <HttpsRemot
jeeEnabled val=1 />
      </HttpCfg>
      <DynDnsCfg>
        <Server val=members.dyndns.org />
      </DynDnsCfg>
      <UPnPCfg>
        <Enable val=1 />
      </UPnPCfg>
      <SnmpCfg>
        <Enable val=1 />
        <SysName val=,VC220-G3u />
        <SysDescr val=VC220-G3u-v2.0_241120 />
      </SnmpCfg>
      <NoipDnsCfg>
        <State val=3 />
        <Server val=dynupdate.no-ip.com />
      </NoipDnsCfg>
      <ACL instance=1 >
        <Enable val=1 />
        <IPStart val=0.0.0.0 />
        <IPEnd val=0.0.0.0 />
        <Service val=Ping />
      </ACL>
      <ACL nextInstance=2 />
    </X_TP_AppCfg>
    <Time>
      <NTPServer1 val=0.tr.pool.ntp.org />
      <NTPServer2 val=1.tr.pool.ntp.org />
      <NTPServer3 val=2.tr.pool.ntp.org />
      <NTPServer4 val=3.tr.pool.ntp.org />
      <CurrentLocalTime val=2025-11-09T18:46:51+03:00 />
      <LocalTimeZone val=+03:00 />
      <DaylightSavingsStart val=2014-03-30T03:00:00 />
      <DaylightSavingsEnd val=2014-10-26T04:00:00 />
      <X_TP_DaylightSavingsStartWeekCount val=5 />
      <X_TP_DaylightSavingsEndWeekCount val=5 />
      <X_TP_Ifname val=ppp1 />
      <X_TP_DslIfName val=ppp0 />
      <X_TP_EwanIfName val=ppp1 />
    </Time>
    <Layer3Forwarding>
      <__defaultGateway val=172.17.1.250 />
      <__ifName val=ppp1 />
      <__ifAliasName val=EWAN_INTERNET />
      <DefaultConnectionService val=InternetGatewayDevice.WANDevice.2.WANConnectionDevice.1.WANPPPConnection.1. />
      <ForwardNumberOfEntries val=5 />
      <Forwarding instance=1 >
        <StaticRoute val=0 />
        <Type val=Network />
        <DestIPAddress val=192.168.1.0 />
        <DestSubnetMask val=255.255.255.0 />
        <SourceIPAddress val=192.168.1.1 />
        <SourceSubnetMask val=255.255.255.0 />
        <GatewayIPAddress val=0.0.0.0 />
        <Interface val=InternetGatewayDevice.LANDevice.1.LANHostConfigManagement.IPInterface.1. />
        <ForwardingMetric val=0 />
        <X_TP_SetFromUI val=0 />
        <X_TP_IfName val=br0 />
      </Forwarding>
      <Forwardi
ng instance=3 >
        <Enable val=1 />
        <Status val=Enabled />
        <StaticRoute val=0 />
        <Type val=Network />
        <DestIPAddress val=10.183.96.0 />
        <DestSubnetMask val=255.255.224.0 />
        <SourceIPAddress val=10.183.104.92 />
        <SourceSubnetMask val=255.255.224.0 />
        <GatewayIPAddress val=0.0.0.0 />
        <Interface val=InternetGatewayDevice.WANDevice.2.WANConnectionDevice.2.WANIPConnection.1. />
        <ForwardingMetric val=0 />
        <X_TP_SetFromUI val=0 />
        <X_TP_IfName val=nas10_2 />
      </Forwarding>
      <Forwarding instance=4 >
        <Enable val=1 />
        <Status val=Enabled />
        <StaticRoute val=0 />
        <Type val=Network />
        <DestIPAddress val=10.116.13.0 />
        <DestSubnetMask val=255.255.255.0 />
        <SourceIPAddress val=10.183.104.92 />
        <SourceSubnetMask val=255.255.224.0 />
        <GatewayIPAddress val=10.183.96.1 />
        <Interface val=InternetGatewayDevice.WANDevice.2.WANConnectionDevice.2.WANIPConnection.1. />
        <ForwardingMetric val=0 />
        <X_TP_SetFromUI val=0 />
        <X_TP_IfName val=nas10_2 />
      </Forwarding>
      <Forwarding instance=5 >
        <Enable val=1 />
        <Status val=Enabled />
        <StaticRoute val=0 />
        <Type val=Network />
        <DestIPAddress val=172.17.1.250 />
        <DestSubnetMask val=255.255.255.255 />
        <SourceIPAddress val=100.82.144.90 />
        <SourceSubnetMask val=255.255.255.255 />
        <GatewayIPAddress val=0.0.0.0 />
        <Interface val=InternetGatewayDevice.WANDevice.2.WANConnectionDevice.1.WANPPPConnection.1. />
        <ForwardingMetric val=0 />
        <X_TP_SetFromUI val=0 />
        <X_TP_IfName val=ppp1 />
      </Forwarding>
      <Forwarding instance=6 >
        <Enable val=1 />
        <Status val=Enabled />
        <StaticRoute val=0 />
        <Type val=Default />
        <DestIPAddress val=0.0.0.0 />
        <DestSubnetMask val=0.0.0.0 />
        <SourceIPAddress val=100.82.144.90 />
        <So
urceSubnetMask val=255.255.255.255 />
        <GatewayIPAddress val=172.17.1.250 />
        <Interface val=InternetGatewayDevice.WANDevice.2.WANConnectionDevice.1.WANPPPConnection.1. />
        <ForwardingMetric val=0 />
        <X_TP_SetFromUI val=0 />
        <X_TP_IfName val=ppp1 />
      </Forwarding>
      <Forwarding nextInstance=7 />
    </Layer3Forwarding>
    <X_TP_Layer3IPv6Forwarding>
      <__ifName val=ppp0 />
      <__ifAliasName val=DSL_INTERNET />
    </X_TP_Layer3IPv6Forwarding>
    <Layer2Bridging>
      <BridgeNumberOfEntries val=1 />
      <FilterNumberOfEntries val=16 />
      <AvailableInterfaceNumberOfEntries val=16 />
      <Bridge instance=1 >
        <BridgeEnable val=1 />
        <BridgeName val=Default />
      </Bridge>
      <Bridge nextInstance=2 />
      <Filter instance=1 >
        <FilterKey val=1 />
        <FilterEnable val=1 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=eth0.2 />
        <X_TP_BaseLanInterfaceKey val=1 />
        <X_TP_IfAliasName val=LAN1 />
      </Filter>
      <Filter instance=2 >
        <FilterKey val=2 />
        <FilterEnable val=1 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=eth0.3 />
        <X_TP_BaseLanInterfaceKey val=2 />
        <X_TP_IfAliasName val=LAN2 />
      </Filter>
      <Filter instance=3 >
        <FilterKey val=3 />
        <FilterEnable val=1 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=eth0.4 />
        <X_TP_BaseLanInterfaceKey val=3 />
        <X_TP_IfAliasName val=LAN3 />
      </Filter>
      <Filter instance=4 >
        <FilterKey val=4 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=eth0.5 />
        <X_TP_BaseLanInterfaceKey val=4 />
        <X_TP_IfAliasName val=LAN4 />
      </Filter>
      <Filter instance=5 >
        <FilterKey val=5 />
       <FilterEnable val=1 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=ra0 />
        <X_TP_BaseLanInterfaceKey val=5 />
        <X_TP_IfAliasName val=Wi-Fi_2.4G />
      </Filter>
      <Filter instance=6 >
        <FilterKey val=6 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=ra1 />
        <X_TP_BaseLanInterfaceKey val=6 />
        <X_TP_IfAliasName val=SSID_2.4G_01 />
      </Filter>
      <Filter instance=7 >
        <FilterKey val=7 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=ra2 />
        <X_TP_BaseLanInterfaceKey val=7 />
        <X_TP_IfAliasName val=SSID_2.4G_02 />
      </Filter>
      <Filter instance=8 >
        <FilterKey val=8 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=ra3 />
        <X_TP_BaseLanInterfaceKey val=8 />
        <X_TP_IfAliasName val=SSID_2.4G_03 />
      </Filter>
      <Filter instance=9 >
        <FilterKey val=9 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=ra4 />
        <X_TP_BaseLanInterfaceKey val=9 />
        <X_TP_IfAliasName val=SSID_2.4G_R1_BH />
      </Filter>
      <Filter instance=10 >
        <FilterKey val=10 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=ra5 />
        <X_TP_BaseLanInterfaceKey val=10 />
        <X_TP_IfAliasName val=SSID_2.4G_R2_BH />
      </Filter>
      <Filter instance=11 >
        <FilterKey val=11 />
        <FilterEnable val=1 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=rai0 />
        <X_TP_BaseLanInterfaceKey val=11 />
        <X_TP_IfAliasName val=Wi-Fi_5G />
      </Filter>
      <Filter instance=12 >
        <FilterKey val=12 />
  
    <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=rai1 />
        <X_TP_BaseLanInterfaceKey val=12 />
        <X_TP_IfAliasName val=SSID_5G_01 />
      </Filter>
      <Filter instance=13 >
        <FilterKey val=13 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=rai2 />
        <X_TP_BaseLanInterfaceKey val=13 />
        <X_TP_IfAliasName val=SSID_5G_02 />
      </Filter>
      <Filter instance=14 >
        <FilterKey val=14 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=rai3 />
        <X_TP_BaseLanInterfaceKey val=14 />
        <X_TP_IfAliasName val=SSID_5G_03 />
      </Filter>
      <Filter instance=15 >
        <FilterKey val=15 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=rai4 />
        <X_TP_BaseLanInterfaceKey val=15 />
        <X_TP_IfAliasName val=SSID_5G_R1_BH />
      </Filter>
      <Filter instance=16 >
        <FilterKey val=16 />
        <FilterBridgeReference val=0 />
        <__filterBridgeRefName val=Default />
        <FilterInterface val=rai5 />
        <X_TP_BaseLanInterfaceKey val=16 />
        <X_TP_IfAliasName val=SSID_5G_R2_BH />
      </Filter>
      <Filter nextInstance=17 />
      <AvailableInterface instance=1 >
        <AvailableInterfaceKey val=1 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_ETH_INTF#1,1 />
      </AvailableInterface>
      <AvailableInterface instance=2 >
        <AvailableInterfaceKey val=2 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_ETH_INTF#1,2 />
      </AvailableInterface>
      <AvailableInterface instance=3 >
        <AvailableInterfaceKey val=3 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_ETH_INTF#1,3 />
      </AvailableInterface>
      <AvailableInterface instance=4 >
   
   <AvailableInterfaceKey val=4 />
        <InterfaceType val=WANInterface />
        <InterfaceReference val=LAN_ETH_INTF#1,4 />
      </AvailableInterface>
      <AvailableInterface instance=5 >
        <AvailableInterfaceKey val=5 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_WLAN#1,1 />
      </AvailableInterface>
      <AvailableInterface instance=6 >
        <AvailableInterfaceKey val=6 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_WLAN_MSSIDENTRY#1,1,1 />
      </AvailableInterface>
      <AvailableInterface instance=7 >
        <AvailableInterfaceKey val=7 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_WLAN_MSSIDENTRY#1,1,2 />
      </AvailableInterface>
      <AvailableInterface instance=8 >
        <AvailableInterfaceKey val=8 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_WLAN_MSSIDENTRY#1,1,3 />
      </AvailableInterface>
      <AvailableInterface instance=9 >
        <AvailableInterfaceKey val=9 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_WLAN_MSSIDENTRY#1,1,4 />
      </AvailableInterface>
      <AvailableInterface instance=10 >
        <AvailableInterfaceKey val=10 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_WLAN_MSSIDENTRY#1,1,5 />
      </AvailableInterface>
      <AvailableInterface instance=11 >
        <AvailableInterfaceKey val=11 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_WLAN#1,5 />
      </AvailableInterface>
      <AvailableInterface instance=12 >
        <AvailableInterfaceKey val=12 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_WLAN_MSSIDENTRY#1,5,1 />
      </AvailableInterface>
      <AvailableInterface instance=13 >
        <AvailableInterfaceKey val=13 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_WLAN_MSSIDENTRY#1,5,2 />
      </AvailableInterface>
      <Av
ailableInterface instance=14 >
        <AvailableInterfaceKey val=14 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_WLAN_MSSIDENTRY#1,5,3 />
      </AvailableInterface>
      <AvailableInterface instance=15 >
        <AvailableInterfaceKey val=15 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_WLAN_MSSIDENTRY#1,5,4 />
      </AvailableInterface>
      <AvailableInterface instance=16 >
        <AvailableInterfaceKey val=16 />
        <InterfaceType val=LANInterface />
        <InterfaceReference val=LAN_WLAN_MSSIDENTRY#1,5,5 />
      </AvailableInterface>
      <AvailableInterface nextInstance=17 />
    </Layer2Bridging>
    <LANDevice instance=1 >
      <LANEthernetInterfaceNumberOfEntries val=4 />
      <LANWLANConfigurationNumberOfEntries val=4 />
      <LANHostConfigManagement>
        <DHCPServerEnable val=1 />
        <MinAddress val=192.168.1.100 />
        <DNSServers val=192.168.1.1 />
        <IPRouters val=192.168.1.1 />
        <IPInterfaceNumberOfEntries val=1 />
        <X_TTNET_IPvX_LANMode val=1 />
        <IPInterface instance=1 >
          <Enable val=1 />
          <__ifName val=br0 />
        </IPInterface>
        <IPInterface nextInstance=2 />
      </LANHostConfigManagement>
      <X_TP_LANIPv6HostConfigManagement>
        <IPv6DNSWANConnection val=DSL_INTERNET />
        <RADVDEnable val=1 />
        <IPv6PDWANConnection val=EWAN_INTERNET />
        <PrefixDelegationWANConnection val=InternetGatewayDevice.WANDevice.2.WANConnectionDevice.1.WANPPPConnection.1. />
        <__ifName val=br0 />
        <IPv6InterfaceNumberOfEntries val=1 />
        <IPv6Interface instance=1 >
          <Enable val=1 />
          <__ifName val=br0 />
        </IPv6Interface>
        <IPv6Interface nextInstance=2 />
      </X_TP_LANIPv6HostConfigManagement>
      <LANEthernetInterfaceConfig instance=1 >
        <Enable val=1 />
        <Status val=NoLink />
        <Name val=eth0.2 />
        <__ifName val=eth0.2 />
      </LANEthernetInterfaceCo
nfig>
      <LANEthernetInterfaceConfig instance=2 >
        <Enable val=1 />
        <Status val=NoLink />
        <Name val=eth0.3 />
        <__ifName val=eth0.3 />
      </LANEthernetInterfaceConfig>
      <LANEthernetInterfaceConfig instance=3 >
        <Enable val=1 />
        <Status val=NoLink />
        <Name val=eth0.4 />
        <__ifName val=eth0.4 />
      </LANEthernetInterfaceConfig>
      <LANEthernetInterfaceConfig instance=4 >
        <Status val=Disabled />
        <Name val=eth0.5 />
        <__ifName val=eth0.5 />
      </LANEthernetInterfaceConfig>
      <LANEthernetInterfaceConfig nextInstance=17 />
      <WLANConfiguration instance=1 >
        <__apLastStatus val=1 />
        <Enable val=1 />
        <Name val=wlan0 />
        <AutoChannelEnable val=1 />
        <X_TP_PreSSID val=TP-Link_2.4GHz />
        <SSID val=Techolay />
        <BeaconType val=WPAand11i />
        <X_TP_MACAddressControlRule val=deny />
        <X_TP_Bandwidth val=Auto />
        <X_TP_OperationalBandwidth val=20M />
        <X_TP_MaxAssoc val=32 />
        <Standard val=b,g,n />
        <WPAEncryptionModes val=AESEncryption />
        <WPAAuthenticationMode val=PSKAuthentication />
        <IEEE11iEncryptionModes val=AESEncryption />
        <IEEE11iAuthenticationMode val=PSKAuthentication />
        <X_TP_PreSharedKey val=Tech0layTech0lay />
        <SSIDAdvertisementEnabled val=1 />
        <TransmitPower val=100 />
        <AutoRateFallBackEnabled val=1 />
        <DeviceOperationMode val=InfrastructureAccessPoint />
        <WMMEnable val=1 />
        <X_TP_ShortGIEnable val=1 />
        <VlanID val=4001 />
        <X_TP_APType val=Primary />
        <X_TTNET_PSS val=2 />
        <X_TP_DefaultPreSharedKey val=7w3yEVynz7yT />
        <WPS>
          <Enable val=1 />
          <DeviceName val="Turk Telekom VDSL2 Modem Router" />
          <DevicePassword val=42213895 />
          <UUID val=0x000102030405060708090a0b0c0d0ebb />
          <ConfigurationState val=Configured />
        </WPS>
        <WEPKey instance
=1 >
        </WEPKey>
        <WEPKey instance=2 >
        </WEPKey>
        <WEPKey instance=3 >
        </WEPKey>
        <WEPKey instance=4 >
        </WEPKey>
        <WEPKey nextInstance=5 />
        <PreSharedKey instance=1 >
        </PreSharedKey>
        <PreSharedKey nextInstance=2 />
        <X_TP_MultiSSID>
          <MultiSSIDEnable val=1 />
          <MultiSSIDEntry instance=1 >
            <Name val=wlan1 />
            <SSID val=Misafir1_F4FE_2.4GHz />
            <SSIDAdvertisementEnable val=1 />
            <BeaconType val=WPAand11i />
            <WPAEncryptionModes val=AESEncryption />
            <WPAAuthenticationMode val=PSKAuthentication />
            <IEEE11iEncryptionModes val=AESEncryption />
            <IEEE11iAuthenticationMode val=PSKAuthentication />
            <PreSharedKey val=zVcnvkUHvpt7 />
            <RadiusServerPort val=1812 />
            <MaxStaNum val=16 />
            <X_TP_APType val=Guest />
            <WEPKey instance=1 >
            </WEPKey>
            <WEPKey instance=2 >
            </WEPKey>
            <WEPKey instance=3 >
            </WEPKey>
            <WEPKey instance=4 >
            </WEPKey>
            <WEPKey nextInstance=5 />
          </MultiSSIDEntry>
          <MultiSSIDEntry instance=2 >
            <Name val=wlan2 />
            <SSID val=Misafir2_F4FE_2.4GHz />
            <SSIDAdvertisementEnable val=1 />
            <BeaconType val=WPAand11i />
            <WPAEncryptionModes val=AESEncryption />
            <WPAAuthenticationMode val=PSKAuthentication />
            <IEEE11iEncryptionModes val=AESEncryption />
            <IEEE11iAuthenticationMode val=PSKAuthentication />
            <PreSharedKey val=NyqwCtkFD7Na />
            <RadiusServerPort val=1812 />
            <MaxStaNum val=16 />
            <X_TP_APType val=Guest />
            <WEPKey instance=1 >
            </WEPKey>
            <WEPKey instance=2 >
            </WEPKey>
            <WEPKey instance=3 >
            </WEPKey>
            <WEPKey instance=4 >
            </
WEPKey>
            <WEPKey nextInstance=5 />
          </MultiSSIDEntry>
          <MultiSSIDEntry instance=3 >
            <Name val=wlan3 />
            <SSID val=Misafir3_F4FE_2.4GHz />
            <SSIDAdvertisementEnable val=1 />
            <BeaconType val=WPAand11i />
            <WPAEncryptionModes val=AESEncryption />
            <WPAAuthenticationMode val=PSKAuthentication />
            <IEEE11iEncryptionModes val=AESEncryption />
            <IEEE11iAuthenticationMode val=PSKAuthentication />
            <PreSharedKey val=Lpupkf9b7X4a />
            <RadiusServerPort val=1812 />
            <MaxStaNum val=16 />
            <X_TP_APType val=Guest />
            <WEPKey instance=1 >
            </WEPKey>
            <WEPKey instance=2 >
            </WEPKey>
            <WEPKey instance=3 >
            </WEPKey>
            <WEPKey instance=4 >
            </WEPKey>
            <WEPKey nextInstance=5 />
          </MultiSSIDEntry>
          <MultiSSIDEntry instance=4 >
            <Name val=wlan4 />
            <SSID val=LfMCLleK2lU2NueECKmOmzmNZOFQIL />
            <BeaconType val=11i />
            <WPAEncryptionModes val=AESEncryption />
            <WPAAuthenticationMode val=PSKAuthentication />
            <IEEE11iEncryptionModes val=AESEncryption />
            <IEEE11iAuthenticationMode val=PSKAuthentication />
            <PreSharedKey val=15NXCCJOpS9E7db2iAV9jbNcdaKuu />
            <RadiusServerPort val=1812 />
            <X_TP_APType val=Backhaul />
            <WEPKey instance=1 >
            </WEPKey>
            <WEPKey instance=2 >
            </WEPKey>
            <WEPKey instance=3 >
            </WEPKey>
            <WEPKey instance=4 >
            </WEPKey>
            <WEPKey nextInstance=5 />
          </MultiSSIDEntry>
          <MultiSSIDEntry instance=5 >
            <Name val=wlan10 />
            <SSID val=cUwksdkvPlDuRuh2BQ4nQcEFNH2uJK />
            <BeaconType val=11i />
            <WPAEncryptionModes val=AESEncryption />
            <WPAAuthenticationMode val=PSKAuthenti
cation />
            <IEEE11iEncryptionModes val=AESEncryption />
            <IEEE11iAuthenticationMode val=PSKAuthentication />
            <PreSharedKey val=yNZMfBVYqzKp0XhEAgx0Sx5wwOdAM />
            <RadiusServerPort val=1812 />
            <X_TP_APType val=Backhaul />
            <WEPKey instance=1 >
            </WEPKey>
            <WEPKey instance=2 >
            </WEPKey>
            <WEPKey instance=3 >
            </WEPKey>
            <WEPKey instance=4 >
            </WEPKey>
            <WEPKey nextInstance=5 />
          </MultiSSIDEntry>
          <MultiSSIDEntry nextInstance=6 />
        </X_TP_MultiSSID>
        <X_TP_WlBrName instance=1 >
          <IfName val=ra0 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName instance=2 >
          <IfName val=ra1 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName instance=3 >
          <IfName val=ra2 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName instance=4 >
          <IfName val=ra3 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName instance=5 >
          <IfName val=ra4 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName instance=6 >
          <IfName val=ra5 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName nextInstance=7 />
      </WLANConfiguration>
      <WLANConfiguration instance=2 >
        <Name val=wlan1 />
        <Channel val=8 />
        <AutoChannelEnable val=1 />
        <X_TP_PreSSID val=TP-Link_2.4GHz />
        <SSID val=Misafir1_F4FE_2.4GHz />
        <BeaconType val=WPAand11i />
        <X_TP_MACAddressControlRule val=deny />
        <Standard val=b,g,n />
        <BasicEncryptionModes val= />
        <WPAEncryptionModes val=AESEncryption />
        <WPAAuthenticationMode val=PSKAuthentication />
        <IEEE11iEncryptionModes val=AESEncryption />
        <IEEE11iAuthenticationMode val=PSKAuthentication />
        <X_TP_PreSharedK
ey val=zVcnvkUHvpt7 />
        <SSIDAdvertisementEnabled val=1 />
        <TransmitPower val=100 />
        <WMMEnable val=1 />
        <VlanID val=4002 />
        <X_TP_APType val=Guest />
        <X_TP_DefaultPreSharedKey val=zVcnvkUHvpt7 />
        <WPS>
          <DevicePassword val=42213895 />
        </WPS>
        <PreSharedKey instance=1 >
        </PreSharedKey>
        <PreSharedKey nextInstance=2 />
        <X_TP_MultiSSID>
        </X_TP_MultiSSID>
      </WLANConfiguration>
      <WLANConfiguration instance=3 >
        <Name val=wlan2 />
        <Channel val=8 />
        <AutoChannelEnable val=1 />
        <X_TP_PreSSID val=TP-Link_2.4GHz />
        <SSID val=Misafir2_F4FE_2.4GHz />
        <BeaconType val=WPAand11i />
        <X_TP_MACAddressControlRule val=deny />
        <Standard val=b,g,n />
        <BasicEncryptionModes val= />
        <WPAEncryptionModes val=AESEncryption />
        <WPAAuthenticationMode val=PSKAuthentication />
        <IEEE11iEncryptionModes val=AESEncryption />
        <IEEE11iAuthenticationMode val=PSKAuthentication />
        <X_TP_PreSharedKey val=NyqwCtkFD7Na />
        <SSIDAdvertisementEnabled val=1 />
        <TransmitPower val=100 />
        <WMMEnable val=1 />
        <VlanID val=4003 />
        <X_TP_APType val=Guest />
        <X_TP_DefaultPreSharedKey val=NyqwCtkFD7Na />
        <WPS>
          <DevicePassword val=42213895 />
        </WPS>
        <PreSharedKey instance=1 >
        </PreSharedKey>
        <PreSharedKey nextInstance=2 />
        <X_TP_MultiSSID>
        </X_TP_MultiSSID>
      </WLANConfiguration>
      <WLANConfiguration instance=4 >
        <Name val=wlan3 />
        <Channel val=8 />
        <AutoChannelEnable val=1 />
        <X_TP_PreSSID val=TP-Link_2.4GHz />
        <SSID val=Misafir3_F4FE_2.4GHz />
        <BeaconType val=WPAand11i />
        <X_TP_MACAddressControlRule val=deny />
        <Standard val=b,g,n />
        <BasicEncryptionModes val= />
        <WPAEncryptionModes val=AESEncryption />
        <WPAAuthenticationMode val=PSKA
uthentication />
        <IEEE11iEncryptionModes val=AESEncryption />
        <IEEE11iAuthenticationMode val=PSKAuthentication />
        <X_TP_PreSharedKey val=Lpupkf9b7X4a />
        <SSIDAdvertisementEnabled val=1 />
        <TransmitPower val=100 />
        <WMMEnable val=1 />
        <VlanID val=4004 />
        <X_TP_APType val=Guest />
        <X_TP_DefaultPreSharedKey val=Lpupkf9b7X4a />
        <WPS>
          <DevicePassword val=42213895 />
        </WPS>
        <PreSharedKey instance=1 >
        </PreSharedKey>
        <PreSharedKey nextInstance=2 />
        <X_TP_MultiSSID>
        </X_TP_MultiSSID>
      </WLANConfiguration>
      <WLANConfiguration instance=5 >
        <__apLastStatus val=2 />
        <Enable val=1 />
        <Name val=wlan5 />
        <AutoChannelEnable val=1 />
        <X_TP_PreSSID val=TP-Link_5GHz />
        <SSID val=Techolay_5GHz />
        <BeaconType val=WPAand11i />
        <X_TP_MACAddressControlRule val=deny />
        <X_TP_Band val=5GHz />
        <X_TP_Bandwidth val=Auto />
        <X_TP_OperationalBandwidth val=80M />
        <X_TP_MaxAssoc val=32 />
        <Standard val=a,n,ac />
        <WPAEncryptionModes val=AESEncryption />
        <WPAAuthenticationMode val=PSKAuthentication />
        <IEEE11iEncryptionModes val=AESEncryption />
        <IEEE11iAuthenticationMode val=PSKAuthentication />
        <X_TP_PreSharedKey val=Tech0layTech0lay />
        <SSIDAdvertisementEnabled val=1 />
        <TransmitPower val=100 />
        <AutoRateFallBackEnabled val=1 />
        <DeviceOperationMode val=InfrastructureAccessPoint />
        <WMMEnable val=1 />
        <X_TP_ShortGIEnable val=1 />
        <VlanID val=4001 />
        <X_TP_APType val=Primary />
        <X_TTNET_PSS val=2 />
        <X_TP_DefaultPreSharedKey val=7w3yEVynz7yT />
        <WPS>
          <Enable val=1 />
          <DeviceName val="Turk Telekom VDSL2 Modem Router" />
          <DevicePassword val=42213895 />
          <UUID val=0x000102030405060708090a0b0c0d0ebb />
          <ConfigurationState val=Co
nfigured />
        </WPS>
        <WEPKey instance=1 >
        </WEPKey>
        <WEPKey instance=2 >
        </WEPKey>
        <WEPKey instance=3 >
        </WEPKey>
        <WEPKey instance=4 >
        </WEPKey>
        <WEPKey nextInstance=5 />
        <PreSharedKey instance=1 >
        </PreSharedKey>
        <PreSharedKey nextInstance=2 />
        <X_TP_MultiSSID>
          <MultiSSIDEnable val=1 />
          <MultiSSIDEntry instance=1 >
            <Name val=wlan6 />
            <SSID val=Misafir1_F4FE_5GHz />
            <SSIDAdvertisementEnable val=1 />
            <BeaconType val=WPAand11i />
            <WPAEncryptionModes val=AESEncryption />
            <WPAAuthenticationMode val=PSKAuthentication />
            <IEEE11iEncryptionModes val=AESEncryption />
            <IEEE11iAuthenticationMode val=PSKAuthentication />
            <PreSharedKey val=RzhPHcUxCpT3 />
            <RadiusServerPort val=1812 />
            <MaxStaNum val=16 />
            <X_TP_APType val=Guest />
            <WEPKey instance=1 >
            </WEPKey>
            <WEPKey instance=2 >
            </WEPKey>
            <WEPKey instance=3 >
            </WEPKey>
            <WEPKey instance=4 >
            </WEPKey>
            <WEPKey nextInstance=5 />
          </MultiSSIDEntry>
          <MultiSSIDEntry instance=2 >
            <Name val=wlan7 />
            <SSID val=Misafir2_F4FE_5GHz />
            <SSIDAdvertisementEnable val=1 />
            <BeaconType val=WPAand11i />
            <WPAEncryptionModes val=AESEncryption />
            <WPAAuthenticationMode val=PSKAuthentication />
            <IEEE11iEncryptionModes val=AESEncryption />
            <IEEE11iAuthenticationMode val=PSKAuthentication />
            <PreSharedKey val=kJC7LenqgpjU />
            <RadiusServerPort val=1812 />
            <MaxStaNum val=16 />
            <X_TP_APType val=Guest />
            <WEPKey instance=1 >
            </WEPKey>
            <WEPKey instance=2 >
            </WEPKey>
            <WEPKey instance=3 >
            </WEPKey>
            <WEPKey instance=4 >
            </WEPKey>
            <WEPKey nextInstance=5 />
          </MultiSSIDEntry>
          <MultiSSIDEntry instance=3 >
            <Name val=wlan8 />
            <SSID val=Misafir3_F4FE_5GHz />
            <SSIDAdvertisementEnable val=1 />
            <BeaconType val=WPAand11i />
            <WPAEncryptionModes val=AESEncryption />
            <WPAAuthenticationMode val=PSKAuthentication />
            <IEEE11iEncryptionModes val=AESEncryption />
            <IEEE11iAuthenticationMode val=PSKAuthentication />
            <PreSharedKey val=wkDXcR4WgWxg />
            <RadiusServerPort val=1812 />
            <MaxStaNum val=16 />
            <X_TP_APType val=Guest />
            <WEPKey instance=1 >
            </WEPKey>
            <WEPKey instance=2 >
            </WEPKey>
            <WEPKey instance=3 >
            </WEPKey>
            <WEPKey instance=4 >
            </WEPKey>
            <WEPKey nextInstance=5 />
          </MultiSSIDEntry>
          <MultiSSIDEntry instance=4 >
            <Name val=wlan9 />
            <SSID val=yl3hov3sLrS2bapNoewrhWUZDK6O5K />
            <BeaconType val=11i />
            <WPAEncryptionModes val=AESEncryption />
            <WPAAuthenticationMode val=PSKAuthentication />
            <IEEE11iEncryptionModes val=AESEncryption />
            <IEEE11iAuthenticationMode val=PSKAuthentication />
            <PreSharedKey val=125whxSXbbDPFsXshAwBM6d8OFBYU />
            <RadiusServerPort val=1812 />
            <X_TP_APType val=Backhaul />
            <WEPKey instance=1 >
            </WEPKey>
            <WEPKey instance=2 >
            </WEPKey>
            <WEPKey instance=3 >
            </WEPKey>
            <WEPKey instance=4 >
            </WEPKey>
            <WEPKey nextInstance=5 />
          </MultiSSIDEntry>
          <MultiSSIDEntry instance=5 >
            <Name val=wlan11 />
            <SSID val=Zm50qgvTBEUyYAsm3OllL6Zu5N8pUZ />
            <BeaconType val=11i />
            <WPAEncryptionModes val=AESEncryption />
   
       <WPAAuthenticationMode val=PSKAuthentication />
            <IEEE11iEncryptionModes val=AESEncryption />
            <IEEE11iAuthenticationMode val=PSKAuthentication />
            <PreSharedKey val=ZvYsIxcwSEfyUKQq0wQBAi5h85VIz />
            <RadiusServerPort val=1812 />
            <X_TP_APType val=Backhaul />
            <WEPKey instance=1 >
            </WEPKey>
            <WEPKey instance=2 >
            </WEPKey>
            <WEPKey instance=3 >
            </WEPKey>
            <WEPKey instance=4 >
            </WEPKey>
            <WEPKey nextInstance=5 />
          </MultiSSIDEntry>
          <MultiSSIDEntry nextInstance=6 />
        </X_TP_MultiSSID>
        <X_TP_WlBrName instance=1 >
          <IfName val=rai0 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName instance=2 >
          <IfName val=rai1 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName instance=3 >
          <IfName val=rai2 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName instance=4 >
          <IfName val=rai3 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName instance=5 >
          <IfName val=rai4 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName instance=6 >
          <IfName val=rai5 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName nextInstance=7 />
      </WLANConfiguration>
      <WLANConfiguration instance=6 >
        <Name val=wlan6 />
        <Channel val=52 />
        <AutoChannelEnable val=1 />
        <X_TP_PreSSID val=TP-Link_5GHz />
        <SSID val=Misafir1_F4FE_5GHz />
        <BeaconType val=WPAand11i />
        <X_TP_MACAddressControlRule val=deny />
        <X_TP_Band val=5GHz />
        <Standard val=a,n,ac />
        <BasicEncryptionModes val= />
        <WPAEncryptionModes val=AESEncryption />
        <WPAAuthenticationMode val=PSKAuthentication />
        <IEEE11iEncryptionModes val=AESEncryption />
  
    <IEEE11iAuthenticationMode val=PSKAuthentication />
        <X_TP_PreSharedKey val=RzhPHcUxCpT3 />
        <SSIDAdvertisementEnabled val=1 />
        <TransmitPower val=100 />
        <WMMEnable val=1 />
        <VlanID val=4002 />
        <X_TP_APType val=Guest />
        <X_TP_DefaultPreSharedKey val=RzhPHcUxCpT3 />
        <WPS>
          <DevicePassword val=42213895 />
        </WPS>
        <PreSharedKey instance=1 >
        </PreSharedKey>
        <PreSharedKey nextInstance=2 />
        <X_TP_MultiSSID>
        </X_TP_MultiSSID>
      </WLANConfiguration>
      <WLANConfiguration instance=7 >
        <Name val=wlan7 />
        <Channel val=52 />
        <AutoChannelEnable val=1 />
        <X_TP_PreSSID val=TP-Link_5GHz />
        <SSID val=Misafir2_F4FE_5GHz />
        <BeaconType val=WPAand11i />
        <X_TP_MACAddressControlRule val=deny />
        <X_TP_Band val=5GHz />
        <Standard val=a,n,ac />
        <BasicEncryptionModes val= />
        <WPAEncryptionModes val=AESEncryption />
        <WPAAuthenticationMode val=PSKAuthentication />
        <IEEE11iEncryptionModes val=AESEncryption />
        <IEEE11iAuthenticationMode val=PSKAuthentication />
        <X_TP_PreSharedKey val=kJC7LenqgpjU />
        <SSIDAdvertisementEnabled val=1 />
        <TransmitPower val=100 />
        <WMMEnable val=1 />
        <VlanID val=4003 />
        <X_TP_APType val=Guest />
        <X_TP_DefaultPreSharedKey val=kJC7LenqgpjU />
        <WPS>
          <DevicePassword val=42213895 />
        </WPS>
        <PreSharedKey instance=1 >
        </PreSharedKey>
        <PreSharedKey nextInstance=2 />
        <X_TP_MultiSSID>
        </X_TP_MultiSSID>
      </WLANConfiguration>
      <WLANConfiguration instance=8 >
        <Name val=wlan8 />
        <Channel val=52 />
        <AutoChannelEnable val=1 />
        <X_TP_PreSSID val=TP-Link_5GHz />
        <SSID val=Misafir3_F4FE_5GHz />
        <BeaconType val=WPAand11i />
        <X_TP_MACAddressControlRule val=deny />
        <X_TP_Band val=5GHz />
        <Standard va
l=a,n,ac />
        <BasicEncryptionModes val= />
        <WPAEncryptionModes val=AESEncryption />
        <WPAAuthenticationMode val=PSKAuthentication />
        <IEEE11iEncryptionModes val=AESEncryption />
        <IEEE11iAuthenticationMode val=PSKAuthentication />
        <X_TP_PreSharedKey val=wkDXcR4WgWxg />
        <SSIDAdvertisementEnabled val=1 />
        <TransmitPower val=100 />
        <WMMEnable val=1 />
        <VlanID val=4004 />
        <X_TP_APType val=Guest />
        <X_TP_DefaultPreSharedKey val=wkDXcR4WgWxg />
        <WPS>
          <DevicePassword val=42213895 />
        </WPS>
        <PreSharedKey instance=1 >
        </PreSharedKey>
        <PreSharedKey nextInstance=2 />
        <X_TP_MultiSSID>
        </X_TP_MultiSSID>
      </WLANConfiguration>
      <WLANConfiguration nextInstance=9 />
    </LANDevice>
    <LANDevice nextInstance=2 />
    <WANDevice instance=1 >
      <WANConnectionNumberOfEntries val=2 />
      <WANCommonInterfaceConfig>
        <EnabledForInternet val=1 />
        <WANAccessType val=DSL />
      </WANCommonInterfaceConfig>
      <WANDSLInterfaceConfig>
        <Enable val=1 />
        <Status val=Up />
        <LinkEncapsulationUsed val=G.993.2_Annex_K_PTM />
        <INTLVDEPTH val=-1 />
        <ShowtimeStart val=112 />
        <X_TP_UpTime val=112 />
      </WANDSLInterfaceConfig>
      <WANConnectionDevice instance=1 >
        <WANPPPConnectionNumberOfEntries val=1 />
        <WANDSLLinkConfig>
          <Enable val=1 />
          <LinkType val=EoA />
          <DestinationAddress val=PVC:8/35 />
          <X_TP_IfName val=nas0 />
          <X_VDSL_VLANID val=35 />
        </WANDSLLinkConfig>
        <WANPTMLinkConfig>
          <X_TP_Used val=1 />
          <X_TP_VlanEnabled val=1 />
          <X_TP_VID val=35 />
          <X_TP_QosMark val=0 />
          <X_TP_MACVLANEnable val=1 />
          <X_TP_IfName val=nas8.35 />
        </WANPTMLinkConfig>
        <WANPPPConnection instance=1 >
          <Enable val=1 />
          <DefaultGateway val=0.0.0.0 />
    
    <Name val=DSL_INTERNET />
          <Username val= />
          <Password val= />
          <X_TP_IfName val=ppp0 />
          <X_TP_L2IfName val=nas8.35 />
          <X_TP_AtmL2IfName val=nas0_1 />
          <X_TP_PtmL2IfName val=nas8.35 />
          <X_TP_ConnectionId val=0 />
          <RemoteIPAddress val=0.0.0.0 />
          <X_TP_IPv6Enabled val=1 />
          <X_TTNET_IPv6_ExternalAddress val=:: />
          <X_TTNET_IPv6_DefaultGateway val=:: />
          <X_TTNET_IPv6_DNSServers val=::,:: />
          <X_TTNET_IPv6_PrefixDelegationEnabled val=1 />
          <X_TTNET_IPv6_SitePrefix val=:: />
          <X_TP_DefaultGateWayUsed val=1 />
          <X_TTNET_VLANID val=35 />
          <X_TTNET_IPVersion_WANMode val=1 />
          <X_TP_WANOrder val=0 />
        </WANPPPConnection>
        <WANPPPConnection nextInstance=2 />
      </WANConnectionDevice>
      <WANConnectionDevice instance=2 >
        <WANIPConnectionNumberOfEntries val=1 />
        <WANDSLLinkConfig>
          <Enable val=1 />
          <LinkType val=EoA />
          <DestinationAddress val=PVC:8/55 />
          <X_TP_IfName val=nas1 />
          <X_VDSL_VLANID val=55 />
        </WANDSLLinkConfig>
        <WANPTMLinkConfig>
          <X_TP_Used val=1 />
          <X_TP_VlanEnabled val=1 />
          <X_TP_VID val=55 />
          <X_TP_QosMark val=0 />
          <X_TP_MACVLANEnable val=1 />
          <X_TP_IfName val=nas8.55 />
        </WANPTMLinkConfig>
        <WANIPConnection instance=1 >
          <Enable val=1 />
          <Name val=DSL_IPTV />
          <X_TP_ConnectionId val=1 />
          <NATEnabled val=1 />
          <X_TP_Hostname val=VC220-G3u />
          <AddressingType val=DHCP />
          <ExternalIPAddress val=0.0.0.0 />
          <SubnetMask val=0.0.0.0 />
          <DefaultGateway val=0.0.0.0 />
          <DNSServers val=0.0.0.0,0.0.0.0 />
          <X_TP_IfName val=nas8.55 />
          <X_TP_AtmIfName val=nas1_1 />
          <X_TP_PtmIfName val=nas8.55 />
          <X_TP_IGMPProxyEnabled
val=1 />
          <X_TTNET_IPv6_AddressingType val=DHCPv6 />
          <X_TTNET_IPv6_ExternalAddress val=:: />
          <X_TTNET_IPv6_DefaultGateway val=:: />
          <X_TTNET_IPv6_DNSServers val=::,:: />
          <X_TTNET_VLANID val=55 />
          <X_TP_WANOrder val=1 />
        </WANIPConnection>
        <WANIPConnection nextInstance=2 />
      </WANConnectionDevice>
      <WANConnectionDevice nextInstance=3 />
    </WANDevice>
    <WANDevice instance=2 >
      <WANConnectionNumberOfEntries val=3 />
      <WANCommonInterfaceConfig>
        <EnabledForInternet val=1 />
        <WANAccessType val=Ethernet />
      </WANCommonInterfaceConfig>
      <WANEthernetInterfaceConfig>
        <Enable val=1 />
        <Status val=Up />
        <X_TP_IfName val=nas10 />
      </WANEthernetInterfaceConfig>
      <WANConnectionDevice instance=1 >
        <WANPPPConnectionNumberOfEntries val=1 />
        <WANEthernetLinkConfig>
          <Enable val=1 />
          <EthernetLinkStatus val=Up />
          <X_TP_VLanEnabled val=1 />
          <X_TP_VID val=35 />
          <X_TP_MACVLANEnable val=1 />
          <X_TP_IfName val=nas10_0 />
          <X_TP_QosMark val=0 />
          <X_ETH_VLANID val=35 />
        </WANEthernetLinkConfig>
        <WANPPPConnection instance=1 >
          <Enable val=1 />
          <DefaultGateway val=172.17.1.250 />
          <Name val=EWAN_INTERNET />
          <X_TP_IGMPProxyEnabled val=1 />
          <Username val= />
          <Password val= />
          <X_TP_IfName val=ppp1 />
          <X_TP_L2IfName val=nas10_0 />
          <X_TP_ConnectionId val=0 />
          <ExternalIPAddress val=100.82.144.90 />
          <RemoteIPAddress val=172.17.1.250 />
          <CurrentMRUSize val=1492 />
          <DNSServers val=193.192.98.8,212.154.100.18 />
          <X_TP_SessionID val=37940 />
          <X_TP_ServerMACAdress val=D4:C1:C8:92:06:90 />
          <X_TP_IPv6Enabled val=1 />
          <X_TTNET_IPv6_ExternalAddress val=:: />
          <X_TTNET_IPv6_DefaultGateway
 val=:: />
          <X_TTNET_IPv6_DNSServers val=::,:: />
          <X_TTNET_IPv6_PrefixDelegationEnabled val=1 />
          <X_TTNET_IPv6_SitePrefix val=:: />
          <X_TP_OriginalDNSServers val=193.192.98.8,212.154.100.18 />
          <X_TP_DefaultGateWayUsed val=1 />
          <X_TP_IPv4ReconnNumOfTimes val=1 />
          <X_TP_IPv4ReconnFlag val=1 />
          <X_TTNET_VLANID val=35 />
          <X_TTNET_IPVersion_WANMode val=1 />
          <X_TTNET_ReConnectTimes val=5 />
          <X_TP_WANOrder val=0 />
        </WANPPPConnection>
        <WANPPPConnection nextInstance=2 />
      </WANConnectionDevice>
      <WANConnectionDevice instance=2 >
        <WANIPConnectionNumberOfEntries val=1 />
        <WANEthernetLinkConfig>
          <Enable val=1 />
          <EthernetLinkStatus val=Up />
          <X_TP_MACVLANEnable val=1 />
          <X_TP_IfName val=nas10_2 />
        </WANEthernetLinkConfig>
        <WANIPConnection instance=1 >
          <Enable val=1 />
          <Name val=EWAN_MANAGEMENT />
          <X_TP_ConnectionId val=1 />
          <NATEnabled val=1 />
          <X_TP_Hostname val=,VC220-G3u />
          <AddressingType val=DHCP />
          <ExternalIPAddress val=10.183.104.92 />
          <SubnetMask val=255.255.224.0 />
          <DefaultGateway val=10.183.96.1 />
          <DNSServers val=10.98.153.234,10.98.153.226 />
          <X_TP_IfName val=nas10_2 />
          <X_TTNET_IPv6_AddressingType val=DHCPv6 />
          <X_TTNET_IPv6_ExternalAddress val=:: />
          <X_TTNET_IPv6_DefaultGateway val=:: />
          <X_TTNET_IPv6_DNSServers val=::,:: />
          <X_TP_OriginalDNSServers val=10.98.153.234,10.98.153.226 />
          <X_TP_IPv4ReconnFlag val=1 />
          <X_TTNET_Op60VendorID val="TPLINK DSLRouter dslforum.org" />
          <X_TTNET_VLANID val=0 />
          <X_TTNET_ReConnectTimes val=3 />
          <X_TP_WANOrder val=0 />
          <X_TP_BindingList>
            <FlowId val=1 />
            <ListBitmap val=32768 />
          </X_TP_BindingList>
        </WANIPConnectio
        <WANIPConnection nextInstance=2 />
      </WANConnectionDevice>
      <WANConnectionDevice instance=3 >
        <WANIPConnectionNumberOfEntries val=1 />
        <WANEthernetLinkConfig>
          <Enable val=1 />
          <EthernetLinkStatus val=Up />
          <X_TP_VLanEnabled val=1 />
          <X_TP_VID val=55 />
          <X_TP_MACVLANEnable val=1 />
          <X_TP_IfName val=nas10_1 />
          <X_TP_QosMark val=0 />
          <X_ETH_VLANID val=55 />
        </WANEthernetLinkConfig>
        <WANIPConnection instance=1 >
          <Name val=EWAN_IPTV />
          <X_TP_ConnectionId val=1 />
          <NATEnabled val=1 />
          <X_TP_Hostname val=VC220-G3u />
          <AddressingType val=DHCP />
          <ExternalIPAddress val=0.0.0.0 />
          <SubnetMask val=0.0.0.0 />
          <DefaultGateway val=0.0.0.0 />
          <DNSServers val=0.0.0.0,0.0.0.0 />
          <X_TP_IfName val=nas10_1 />
          <X_TP_IGMPProxyEnabled val=1 />
          <X_TTNET_IPv6_AddressingType val=DHCPv6 />
          <X_TTNET_IPv6_ExternalAddress val=:: />
          <X_TTNET_IPv6_DefaultGateway val=:: />
          <X_TTNET_IPv6_DNSServers val=::,:: />
          <X_TTNET_VLANID val=55 />
        </WANIPConnection>
        <WANIPConnection nextInstance=2 />
      </WANConnectionDevice>
      <WANConnectionDevice nextInstance=4 />
    </WANDevice>
    <WANDevice instance=3 >
      <WANConnectionNumberOfEntries val=1 />
      <WANCommonInterfaceConfig>
        <EnabledForInternet val=1 />
        <WANAccessType val=USB_3G />
      </WANCommonInterfaceConfig>
      <WANConnectionDevice instance=1 >
        <WANIPConnectionNumberOfEntries val=1 />
        <WANPPPConnectionNumberOfEntries val=1 />
        <X_TP_WANUSB3gLinkConfig>
          <Enable val=1 />
          <MainConnObjName val=DSL_INTERNET />
          <LocationIdx val=383 />
          <APN val=internet />
        </X_TP_WANUSB3gLinkConfig>
        <WANIPConnection instance=1 >
          <Name val=dhcp_USB_4G />
          <X_TP_ConnectionId val=0 />
   
     <NATEnabled val=1 />
          <AddressingType val=DHCP />
          <ExternalIPAddress val=0.0.0.0 />
          <SubnetMask val=0.0.0.0 />
          <DefaultGateway val=0.0.0.0 />
          <DNSServers val=0.0.0.0,0.0.0.0 />
          <ConnectionTrigger val=AlwaysOn />
          <X_TP_IfName val=lte0 />
          <X_TTNET_IPv6_AddressingType val=DHCPv6 />
          <X_TTNET_IPv6_ExternalAddress val=:: />
          <X_TTNET_IPv6_DefaultGateway val=:: />
          <X_TTNET_IPv6_DNSServers val=::,:: />
          <X_TP_TransportType val=DHCP4G />
          <X_TP_DefaultGateWayUsed val=1 />
        </WANIPConnection>
        <WANIPConnection nextInstance=2 />
        <WANPPPConnection instance=1 >
          <DefaultGateway val=0.0.0.0 />
          <Name val=ppp_USB_3G />
          <X_TP_IfName val=ppp3 />
          <X_TP_L2IfName val=ttyNotReady />
          <X_TP_ConnectionId val=0 />
          <RemoteIPAddress val=0.0.0.0 />
          <DNSEnabled val=1 />
          <TransportType val=PPP3G />
          <X_TTNET_IPv6_ExternalAddress val=:: />
          <X_TTNET_IPv6_DefaultGateway val=:: />
          <X_TTNET_IPv6_DNSServers val=::,:: />
          <X_TP_DefaultGateWayUsed val=1 />
        </WANPPPConnection>
        <WANPPPConnection nextInstance=2 />
      </WANConnectionDevice>
      <WANConnectionDevice nextInstance=2 />
    </WANDevice>
    <WANDevice nextInstance=4 />
    <QueueManagement>
      <X_TP_Interface instance=1 >
        <InterfaceKey val=1 />
        <InterfaceName val=WAN />
        <SchedulerAlgorithm val=2 />
        <LinkType val=0 />
        <TotalBandwidth val=512 />
        <DscpMarkEnable val=0 />
        <EthernetPriorityMarkEnable val=0 />
      </X_TP_Interface>
      <X_TP_Interface instance=2 >
        <InterfaceKey val=2 />
        <InterfaceName val=LAN />
        <SchedulerAlgorithm val=3 />
        <LinkType val=0 />
        <TotalBandwidth val=1024 />
        <DscpMarkEnable val=0 />
        <EthernetPriorityMarkEnable val=0 />
      </X_TP_Interface>
      <X_TP_Interface nex
tInstance=3 />
    </QueueManagement>
    <X_TP_ShapeControl>
      <ShapeGroupNumberOfEntries val=18 />
      <ShapeGroup instance=1 >
        <Id val=1 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=2 >
        <Id val=2 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=3 >
        <Id val=3 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=4 >
        <Id val=4 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=5 >
        <Id val=5 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=6 >
        <Id val=6 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=7 >
        <Id val=7 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=8 >
        <Id val=8 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=9 >
        <Id val=9 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=10 >
        <Id val=10 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=11 >
        <Id val=11 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=12 >
        <Id val=12 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=13 >
        <Id val=13 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=14 >
        <Id val=14 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=15 >
        <Id val=15 />
        <UpMaxBW val=1024 />
      <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=16 >
        <Id val=16 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=17 >
        <Id val=17 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup instance=18 >
        <Id val=18 />
        <UpMaxBW val=1024 />
        <DownMaxBW val=1024 />
      </ShapeGroup>
      <ShapeGroup nextInstance=19 />
    </X_TP_ShapeControl>
    <X_TP_Firewall>
      <InternalHost instance=1 >
        <RefCnt val=1 />
        <Type val=1 />
        <EntryName val=childMac1 />
        <IsParentCtrl val=1 />
      </InternalHost>
      <InternalHost instance=2 >
        <RefCnt val=1 />
        <Type val=1 />
        <EntryName val=childMac2 />
        <IsParentCtrl val=1 />
      </InternalHost>
      <InternalHost instance=3 >
        <RefCnt val=1 />
        <Type val=1 />
        <EntryName val=childMac3 />
        <IsParentCtrl val=1 />
      </InternalHost>
      <InternalHost instance=4 >
        <RefCnt val=1 />
        <Type val=1 />
        <EntryName val=childMac4 />
        <IsParentCtrl val=1 />
      </InternalHost>
      <InternalHost nextInstance=5 />
      <ExternalHost instance=1 >
        <RefCnt val=4 />
        <Type val=2 />
        <EntryName val=childUrl1 />
        <IsParentCtrl val=1 />
        <PortStart val=80 />
      </ExternalHost>
      <ExternalHost nextInstance=2 />
      <TaskSchedule instance=1 >
        <RefCnt val=4 />
        <IsParentCtrl val=1 />
        <EntryName val=childSchedule1 />
      </TaskSchedule>
      <TaskSchedule nextInstance=2 />
      <Rule instance=1 >
        <Enable val=1 />
        <RuleName val=parentCtrl1 />
        <IsParentCtrl val=1 />
        <Direction val=1 />
        <InternalHostRef val=childMac1 />
        <ExternalHostRef val=childUrl1 />
        <ScheduleRef val=childSchedule1 />
      </Rule>
      <Rule instance=2 >
        <Enable val=1 />
        <RuleName val=parentCtrl2
        <IsParentCtrl val=1 />
        <Direction val=1 />
        <InternalHostRef val=childMac2 />
        <ExternalHostRef val=childUrl1 />
        <ScheduleRef val=childSchedule1 />
      </Rule>
      <Rule instance=3 >
        <Enable val=1 />
        <RuleName val=parentCtrl3 />
        <IsParentCtrl val=1 />
        <Direction val=1 />
        <InternalHostRef val=childMac3 />
        <ExternalHostRef val=childUrl1 />
        <ScheduleRef val=childSchedule1 />
      </Rule>
      <Rule instance=4 >
        <Enable val=1 />
        <RuleName val=parentCtrl4 />
        <IsParentCtrl val=1 />
        <Direction val=1 />
        <InternalHostRef val=childMac4 />
        <ExternalHostRef val=childUrl1 />
        <ScheduleRef val=childSchedule1 />
      </Rule>
      <Rule nextInstance=5 />
      <UrlList>
        <UrlCfg instance=1 >
        </UrlCfg>
        <UrlCfg instance=2 >
        </UrlCfg>
        <UrlCfg instance=3 >
        </UrlCfg>
        <UrlCfg instance=4 >
        </UrlCfg>
        <UrlCfg instance=5 >
        </UrlCfg>
        <UrlCfg instance=6 >
        </UrlCfg>
        <UrlCfg instance=7 >
        </UrlCfg>
        <UrlCfg instance=8 >
        </UrlCfg>
        <UrlCfg instance=9 >
        </UrlCfg>
        <UrlCfg instance=10 >
        </UrlCfg>
        <UrlCfg instance=11 >
        </UrlCfg>
        <UrlCfg instance=12 >
        </UrlCfg>
        <UrlCfg instance=13 >
        </UrlCfg>
        <UrlCfg instance=14 >
        </UrlCfg>
        <UrlCfg instance=15 >
        </UrlCfg>
        <UrlCfg instance=16 >
        </UrlCfg>
        <UrlCfg instance=17 >
        </UrlCfg>
        <UrlCfg instance=18 >
        </UrlCfg>
        <UrlCfg instance=19 >
        </UrlCfg>
        <UrlCfg instance=20 >
        </UrlCfg>
        <UrlCfg instance=21 >
        </UrlCfg>
        <UrlCfg instance=22 >
        </UrlCfg>
        <UrlCfg instance=23 >
        </UrlCfg>
        <UrlCfg instance=24 >
        </UrlCfg>
        <UrlCfg instance=25 >
        </UrlCfg>
        <UrlCfg instance=26 >
     </UrlCfg>
        <UrlCfg instance=27 >
        </UrlCfg>
        <UrlCfg instance=28 >
        </UrlCfg>
        <UrlCfg instance=29 >
        </UrlCfg>
        <UrlCfg instance=30 >
        </UrlCfg>
        <UrlCfg instance=31 >
        </UrlCfg>
        <UrlCfg instance=32 >
        </UrlCfg>
        <UrlCfg instance=33 >
        </UrlCfg>
        <UrlCfg instance=34 >
        </UrlCfg>
        <UrlCfg instance=35 >
        </UrlCfg>
        <UrlCfg instance=36 >
        </UrlCfg>
        <UrlCfg instance=37 >
        </UrlCfg>
        <UrlCfg instance=38 >
        </UrlCfg>
        <UrlCfg instance=39 >
        </UrlCfg>
        <UrlCfg instance=40 >
        </UrlCfg>
        <UrlCfg instance=41 >
        </UrlCfg>
        <UrlCfg instance=42 >
        </UrlCfg>
        <UrlCfg instance=43 >
        </UrlCfg>
        <UrlCfg instance=44 >
        </UrlCfg>
        <UrlCfg instance=45 >
        </UrlCfg>
        <UrlCfg instance=46 >
        </UrlCfg>
        <UrlCfg instance=47 >
        </UrlCfg>
        <UrlCfg instance=48 >
        </UrlCfg>
        <UrlCfg instance=49 >
        </UrlCfg>
        <UrlCfg instance=50 >
        </UrlCfg>
        <UrlCfg instance=51 >
        </UrlCfg>
        <UrlCfg instance=52 >
        </UrlCfg>
        <UrlCfg instance=53 >
        </UrlCfg>
        <UrlCfg instance=54 >
        </UrlCfg>
        <UrlCfg instance=55 >
        </UrlCfg>
        <UrlCfg instance=56 >
        </UrlCfg>
        <UrlCfg instance=57 >
        </UrlCfg>
        <UrlCfg instance=58 >
        </UrlCfg>
        <UrlCfg instance=59 >
        </UrlCfg>
        <UrlCfg instance=60 >
        </UrlCfg>
        <UrlCfg instance=61 >
        </UrlCfg>
        <UrlCfg instance=62 >
        </UrlCfg>
        <UrlCfg instance=63 >
        </UrlCfg>
        <UrlCfg instance=64 >
        </UrlCfg>
        <UrlCfg instance=65 >
        </UrlCfg>
        <UrlCfg instance=66 >
        </UrlCfg>
        <UrlCfg instance=67 >
        </UrlCfg>
        <UrlCfg instance=68 >
        </UrlCfg>
        <UrlCfg i
nstance=69 >
        </UrlCfg>
        <UrlCfg instance=70 >
        </UrlCfg>
        <UrlCfg instance=71 >
        </UrlCfg>
        <UrlCfg instance=72 >
        </UrlCfg>
        <UrlCfg instance=73 >
        </UrlCfg>
        <UrlCfg instance=74 >
        </UrlCfg>
        <UrlCfg instance=75 >
        </UrlCfg>
        <UrlCfg instance=76 >
        </UrlCfg>
        <UrlCfg instance=77 >
        </UrlCfg>
        <UrlCfg instance=78 >
        </UrlCfg>
        <UrlCfg instance=79 >
        </UrlCfg>
        <UrlCfg instance=80 >
        </UrlCfg>
        <UrlCfg instance=81 >
        </UrlCfg>
        <UrlCfg instance=82 >
        </UrlCfg>
        <UrlCfg instance=83 >
        </UrlCfg>
        <UrlCfg instance=84 >
        </UrlCfg>
        <UrlCfg instance=85 >
        </UrlCfg>
        <UrlCfg instance=86 >
        </UrlCfg>
        <UrlCfg instance=87 >
        </UrlCfg>
        <UrlCfg instance=88 >
        </UrlCfg>
        <UrlCfg instance=89 >
        </UrlCfg>
        <UrlCfg instance=90 >
        </UrlCfg>
        <UrlCfg instance=91 >
        </UrlCfg>
        <UrlCfg instance=92 >
        </UrlCfg>
        <UrlCfg instance=93 >
        </UrlCfg>
        <UrlCfg instance=94 >
        </UrlCfg>
        <UrlCfg instance=95 >
        </UrlCfg>
        <UrlCfg instance=96 >
        </UrlCfg>
        <UrlCfg instance=97 >
        </UrlCfg>
        <UrlCfg instance=98 >
        </UrlCfg>
        <UrlCfg instance=99 >
        </UrlCfg>
        <UrlCfg instance=100 >
        </UrlCfg>
        <UrlCfg instance=101 >
        </UrlCfg>
        <UrlCfg instance=102 >
        </UrlCfg>
        <UrlCfg instance=103 >
        </UrlCfg>
        <UrlCfg instance=104 >
        </UrlCfg>
        <UrlCfg instance=105 >
        </UrlCfg>
        <UrlCfg instance=106 >
        </UrlCfg>
        <UrlCfg instance=107 >
        </UrlCfg>
        <UrlCfg instance=108 >
        </UrlCfg>
        <UrlCfg instance=109 >
        </UrlCfg>
        <UrlCfg instance=110 >
        </UrlCfg>
        <UrlCfg instance=111 >
     
 </UrlCfg>
        <UrlCfg instance=112 >
        </UrlCfg>
        <UrlCfg instance=113 >
        </UrlCfg>
        <UrlCfg instance=114 >
        </UrlCfg>
        <UrlCfg instance=115 >
        </UrlCfg>
        <UrlCfg instance=116 >
        </UrlCfg>
        <UrlCfg instance=117 >
        </UrlCfg>
        <UrlCfg instance=118 >
        </UrlCfg>
        <UrlCfg instance=119 >
        </UrlCfg>
        <UrlCfg instance=120 >
        </UrlCfg>
        <UrlCfg instance=121 >
        </UrlCfg>
        <UrlCfg instance=122 >
        </UrlCfg>
        <UrlCfg instance=123 >
        </UrlCfg>
        <UrlCfg instance=124 >
        </UrlCfg>
        <UrlCfg instance=125 >
        </UrlCfg>
        <UrlCfg instance=126 >
        </UrlCfg>
        <UrlCfg instance=127 >
        </UrlCfg>
        <UrlCfg instance=128 >
        </UrlCfg>
        <UrlCfg instance=129 >
        </UrlCfg>
        <UrlCfg instance=130 >
        </UrlCfg>
        <UrlCfg instance=131 >
        </UrlCfg>
        <UrlCfg instance=132 >
        </UrlCfg>
        <UrlCfg instance=133 >
        </UrlCfg>
        <UrlCfg instance=134 >
        </UrlCfg>
        <UrlCfg instance=135 >
        </UrlCfg>
        <UrlCfg instance=136 >
        </UrlCfg>
        <UrlCfg instance=137 >
        </UrlCfg>
        <UrlCfg instance=138 >
        </UrlCfg>
        <UrlCfg instance=139 >
        </UrlCfg>
        <UrlCfg instance=140 >
        </UrlCfg>
        <UrlCfg instance=141 >
        </UrlCfg>
        <UrlCfg instance=142 >
        </UrlCfg>
        <UrlCfg instance=143 >
        </UrlCfg>
        <UrlCfg instance=144 >
        </UrlCfg>
        <UrlCfg instance=145 >
        </UrlCfg>
        <UrlCfg instance=146 >
        </UrlCfg>
        <UrlCfg instance=147 >
        </UrlCfg>
        <UrlCfg instance=148 >
        </UrlCfg>
        <UrlCfg instance=149 >
        </UrlCfg>
        <UrlCfg instance=150 >
        </UrlCfg>
        <UrlCfg instance=151 >
        </UrlCfg>
        <UrlCfg instance=152 >
        </UrlCfg>
        <UrlCfg instance=153
        </UrlCfg>
        <UrlCfg instance=154 >
        </UrlCfg>
        <UrlCfg instance=155 >
        </UrlCfg>
        <UrlCfg instance=156 >
        </UrlCfg>
        <UrlCfg instance=157 >
        </UrlCfg>
        <UrlCfg instance=158 >
        </UrlCfg>
        <UrlCfg instance=159 >
        </UrlCfg>
        <UrlCfg instance=160 >
        </UrlCfg>
        <UrlCfg instance=161 >
        </UrlCfg>
        <UrlCfg instance=162 >
        </UrlCfg>
        <UrlCfg instance=163 >
        </UrlCfg>
        <UrlCfg instance=164 >
        </UrlCfg>
        <UrlCfg instance=165 >
        </UrlCfg>
        <UrlCfg instance=166 >
        </UrlCfg>
        <UrlCfg instance=167 >
        </UrlCfg>
        <UrlCfg instance=168 >
        </UrlCfg>
        <UrlCfg instance=169 >
        </UrlCfg>
        <UrlCfg instance=170 >
        </UrlCfg>
        <UrlCfg instance=171 >
        </UrlCfg>
        <UrlCfg instance=172 >
        </UrlCfg>
        <UrlCfg instance=173 >
        </UrlCfg>
        <UrlCfg instance=174 >
        </UrlCfg>
        <UrlCfg instance=175 >
        </UrlCfg>
        <UrlCfg instance=176 >
        </UrlCfg>
        <UrlCfg instance=177 >
        </UrlCfg>
        <UrlCfg instance=178 >
        </UrlCfg>
        <UrlCfg instance=179 >
        </UrlCfg>
        <UrlCfg instance=180 >
        </UrlCfg>
        <UrlCfg instance=181 >
        </UrlCfg>
        <UrlCfg instance=182 >
        </UrlCfg>
        <UrlCfg instance=183 >
        </UrlCfg>
        <UrlCfg instance=184 >
        </UrlCfg>
        <UrlCfg instance=185 >
        </UrlCfg>
        <UrlCfg instance=186 >
        </UrlCfg>
        <UrlCfg instance=187 >
        </UrlCfg>
        <UrlCfg instance=188 >
        </UrlCfg>
        <UrlCfg instance=189 >
        </UrlCfg>
        <UrlCfg instance=190 >
        </UrlCfg>
        <UrlCfg instance=191 >
        </UrlCfg>
        <UrlCfg instance=192 >
        </UrlCfg>
        <UrlCfg instance=193 >
        </UrlCfg>
        <UrlCfg instance=194 >
        </UrlCfg>
        <UrlCfg in
stance=195 >
        </UrlCfg>
        <UrlCfg instance=196 >
        </UrlCfg>
        <UrlCfg instance=197 >
        </UrlCfg>
        <UrlCfg instance=198 >
        </UrlCfg>
        <UrlCfg instance=199 >
        </UrlCfg>
        <UrlCfg instance=200 >
        </UrlCfg>
        <UrlCfg nextInstance=201 />
      </UrlList>
    </X_TP_Firewall>
    <X_TP_IPv6Tunnel>
      <AssociatedLanIfName val=br0 />
      <DSLite>
        <Enabled val=1 />
      </DSLite>
    </X_TP_IPv6Tunnel>
    <Services>
      <StorageService instance=1 >
        <UserAccount instance=1 >
          <Enable val=1 />
          <Username val=admin />
          <Password val=admin />
          <X_TP_SupperUser val=1 />
        </UserAccount>
        <UserAccount instance=2 >
        </UserAccount>
        <UserAccount instance=3 >
        </UserAccount>
        <UserAccount instance=4 >
        </UserAccount>
        <UserAccount instance=5 >
        </UserAccount>
        <UserAccount nextInstance=6 />
        <X_TP_DLNAMediaServer>
          <ServerState val=1 />
        </X_TP_DLNAMediaServer>
        <X_TP_SMBService>
          <Anonymous val=1 />
          <SMB_FOLDER instance=1 >
            <Alias val=volume />
            <Name val=/ />
            <Enable val=1 />
          </SMB_FOLDER>
          <SMB_FOLDER nextInstance=2 />
        </X_TP_SMBService>
        <FTPServer>
          <FTP_FOLDER instance=1 >
            <Alias val=volume />
            <Name val=/ />
            <Enable val=1 />
          </FTP_FOLDER>
          <FTP_FOLDER nextInstance=2 />
        </FTPServer>
      </StorageService>
      <StorageService nextInstance=2 />
    </Services>
    <X_TP_SysMode>
      <Mode val=ETH />
      <DSLL3ForwardingName val=DSL_INTERNET />
      <DSLL3IPv6ForwardingName val=DSL_INTERNET />
      <AutoEnable val=0 />
    </X_TP_SysMode>
    <X_TP_EWAN>
      <Enable val=1 />
      <IfName val=nas10 />
    </X_TP_EWAN>
    <X_TTNET>
      <Configuration>
        <QuantWiFiAgent>
          <Enable val=1 />
          <URL val=htt
ps://acs-fileserver.turktelekom.com.tr/fileserver/QuantWiFi/TP-LINK_VC220-G3u/wifiSpeed-G3U-TT-prod-20230411 />
          <State val=RUNNING />
          <KEY val=wV86gqaW!yFtv-st_g-YL!w />
        </QuantWiFiAgent>
        <NTP>
          <Interface val=InternetGatewayDevice.WANDevice.2.WANConnectionDevice.1.WANPPPConnection.1. />
        </NTP>
        <Icmp>
          <Enable val=3 />
          <RemoteEnable val=1 />
        </Icmp>
        <IGMPv3>
          <Enable val=0 />
        </IGMPv3>
        <ReservedMAC>
          <Enable val=0 />
        </ReservedMAC>
        <BandSteering>
          <Status val=Disabled />
        </BandSteering>
      </Configuration>
      <Users>
        <UserNumberOfEntries val=2 />
        <User instance=1 >
          <Level val=1 />
          <Username val=admin />
          <Password val=admin />
          <RemoteAccessCapable val=1 />
          <Allowed_RA_Protocols val=HTTPS />
        </User>
        <User instance=2 >
          <Enable val=0 />
          <Level val=2 />
          <Username val=root />
          <Password val=wbQn09pp@G />
        </User>
        <User nextInstance=3 />
      </Users>
      <UserInterface>
        <X_TP_LocalDomainName val=modem.local />
        <RemoteAccess>
          <Enable val=1 />
          <Protocol val=HTTPS, />
        </RemoteAccess>
        <LocalAccess>
          <Protocol val=HTTP,HTTPS, />
        </LocalAccess>
      </UserInterface>
      <PacketCapture>
        <FileName val=5CA6E60DF4FE.pcap />
        <X_TP_History instance=1 >
        </X_TP_History>
        <X_TP_History instance=2 >
        </X_TP_History>
        <X_TP_History instance=3 >
        </X_TP_History>
        <X_TP_History instance=4 >
        </X_TP_History>
        <X_TP_History instance=5 >
        </X_TP_History>
        <X_TP_History instance=6 >
        </X_TP_History>
        <X_TP_History instance=7 >
        </X_TP_History>
        <X_TP_History instance=8 >
        </X_TP_History>
        <X_TP_History instance=9 >
        </X_TP_Histor
        <X_TP_History instance=10 >
        </X_TP_History>
        <X_TP_History nextInstance=11 />
      </PacketCapture>
      <PortMirroring>
        <X_TP_History instance=1 >
        </X_TP_History>
        <X_TP_History instance=2 >
        </X_TP_History>
        <X_TP_History instance=3 >
        </X_TP_History>
        <X_TP_History instance=4 >
        </X_TP_History>
        <X_TP_History instance=5 >
        </X_TP_History>
        <X_TP_History instance=6 >
        </X_TP_History>
        <X_TP_History instance=7 >
        </X_TP_History>
        <X_TP_History instance=8 >
        </X_TP_History>
        <X_TP_History instance=9 >
        </X_TP_History>
        <X_TP_History instance=10 >
        </X_TP_History>
        <X_TP_History nextInstance=11 />
      </PortMirroring>
    </X_TTNET>
  </InternetGatewayDevice>
</DslCpeConfig>

Mangolin · 26 Kasım 2025

Arayüzü kurcalarken böyle bir şey buldum belki işine yarayabilir.

$.loadMain("vtlServEdit.htm");

Majdev · 26 Kasım 2025

Sözüne güvendiğim birinin söylediğine göre, Türk Telekom yakın zamanda routerlarda root erişimini engellemek için tüm Türk Telekom logolu cihazlara bir güncelleme göndermiş. Bu yüzden ne kadar konfigürasyonu düzeltsek de cihazın bunları silmesinin nedeni, konfigürasyonu okurken belirli satırları atlamasıymış. Böyle cihazlar için artık tek çözümün EEPROM üzerinden orijinal firmware yazmak olduğunu düşünüyorum; ancak bu da son kullanıcının kolaylıkla uygulayabileceği bir yöntem değil.

Recep Baltaş · 26 Kasım 2025

Türk Telekom'a selam, oyuna devam!

Şimdi bunu nasıl elde ettiğimi yazayım:

Öncelikle Foulab'deki arkadaş şu kodu bana attı:

C:

err = dm_getObj(OID_X_TTNET_USERS_USER,abStack_25c0,0xcc,&user);
if (err == 0) {
found = strstr(user.Allowed_LA_Protocols,"HTTP");
if (found != (char *)0x0) {
strcpy(new_la_protos,"HTTP");
}
found = strstr(user.Allowed_LA_Protocols,"HTTPS");
if (found != (char *)0x0) {
sVar6 = strlen(new_la_protos);
sprintf(new_la_protos + sVar6,",%s","HTTPS");
}
if (((devInfo.X_TP_IsManufacture != 0) &&
(cmp = strcmp(user.Password,"admin_test"), cmp == 0)) &&
(cmp_ = strcmp(user.Username,"admin_test"), cmp_ == 0)) {
cdbg_printf(8,"rsl_sys_restoreCfg",0x8b0,"this config just for factory test!!!!");
cstr_strncpy(user.Password,"admin",0x40);
sVar6 = strlen(new_la_protos);
strcpy(new_la_protos + sVar6,",TELNET");
}
user.Level = 1;
cstr_strncpy(user.Username,"admin",0x20);
cstr_strncpy(user.Allowed_LA_Protocols,new_la_protos,0x20);
cstr_strncpy(&user.LocalAccessCapable,"HTTPS",0x20);
dm_setObj(OID_X_TTNET_USERS_USER,abStack_25c0,(byte *)&user);
}

Ben de bunu Gemini'a verdim ve Gemini da bana bunları dedi:

Bu kod parçası altın vuruş niteliğinde. Modemin neden inatla ayarlarını sıfırladığını, neden Telnet'i kapattığını ve admin yetkini neden düşürdüğünü satır satır açıklıyor.

Bu bir "Sanitasyon" (Temizleme) fonksiyonu. Config dosyasını yüklediğinde çalışıyor ve senin yaptığın değişiklikleri "düzeltiyor".

Kodun Analizi (Neden Başarısız Olduk?)

Protokol Filtresi (Whitelist):

Kod şu mantıkla çalışıyor: Senin XML'e ne yazdığına bakmaksızın, Allowed_LA_Protocolsiçinde sadece "HTTP" ve "HTTPS" kelimelerini arıyor.
- Eğer "TELNET" yazdıysan, kod bunu new_la_protos değişkenine kopyalamıyor.
- En sonda cstr_strncpy(user.Allowed_LA_Protocols,new_la_protos,0x20); satırı ile senin ayarını, kendi oluşturduğu (sadece HTTP/HTTPS içeren) temiz liste ile eziyor.
Yetki Düşürme:

user.Level = 1;

Bu satır çok acımasız. Ne yaparsan yap, kodun sonunda kullanıcı yetkisini 1'e (Normal Kullanıcı) sabitliyor.
Kullanıcı Adı Sabitleme:

cstr_strncpy(user.Username,"admin",0x20);

Kullanıcı adını zorla "admin" yapıyor.

ARKA KAPIYI BULDUN: "Factory Test Mode"

Ancak, kodun ortasında muazzam bir güvenlik açığı (veya fabrika testi için bırakılmış bir arka kapı) var:

C:

if (((devInfo.X_TP_IsManufacture != 0) &&
    (cmp = strcmp(user.Password,"admin_test"), cmp == 0)) &&
    (cmp_ = strcmp(user.Username,"admin_test"), cmp_ == 0)) {
        // ...
        strcpy(new_la_protos + sVar6,",TELNET");
}

Bu şu demek:

Eğer şu 3 şart aynı anda sağlanırsa, modem kendi kendine TELNET'i açıyor:

X_TP_IsManufacture değeri 0'dan farklı (yani 1) olacak.
Kullanıcı adı: admin_test olacak.
Şifre: admin_test olacak.

Bu şartlar sağlanırsa kod, TELNET protokolünü listeye ekliyor!

YENİ PLAN: XML'i Bu Arka Kapıya Göre Düzenle

XML dosyanı şu şekilde modifiye etmelisin:

Adım 1: DeviceInfo Kısmına "Manufacture Mode" Ekle

XML dosyasının en başındaki <DeviceInfo> bloğunu bul. Oraya X_TP_IsManufacture satırını ekleyeceğiz. Orijinal dosyada bu satır yoktu, biz ekleyerek sistemi kandırmaya çalışacağız.

XML:

<DeviceInfo>
      <ManufacturerOUI val=984827 />
      <Description val="300Mbps Wireless N USB VDSL/ADSL Modem Router" />
      <SerialNumber val=5CA6E60DF4FE />
      <HardwareVersion val="VC220-G3u v2 00000001" />
      <SoftwareVersion val=VC220-G3u-v2.0_241120 />
      <UpTime val=26 />
      <X_TP_DevName val=VC220-G3u />
      <X_TP_IsManufacture val=1 />
      <X_TTNET_SerialNumber val=5CA6E60DF4FE />
      <X_TTNET_MACAddress val=5C:A6:E6:0D:F4:FE />
      <X_TTNET_ConfigVersion val=3 />
    </DeviceInfo>

Adım 2: Admin Kullanıcısını "admin_test" Yap

Kodun tetiklenmesi için kullanıcı adı ve şifrenin admin_test olması şart. <Users> bloğunu bul ve değiştir:

XML:

        <User instance=1 >
          <Level val=3 />
          <Username val=admin_test />
          <Password val=admin_test />
          <RemoteAccessCapable val=1 />
          <Allowed_LA_Protocols val=HTTP,HTTPS,TELNET />
          <Allowed_RA_Protocols val=HTTP,HTTPS,TELNET />
        </User>

Sonuç

Bu XML'i yüklediğinde:

Modem açılırken X_TP_IsManufacture değerini 1 görecek.
Kullanıcı adı ve şifrenin admin_test olduğunu doğrulayacak.
Debug mesajı olarak "this config just for factory test!!!!" basacak (bunu göremeyeceğiz).
Ve en önemlisi: new_la_protos listesine ,TELNET ekleyecek.
Sonra kullanıcı adını tekrar zorla "admin" yapacak (cstr_strncpy(user.Username,"admin",0x20).

Yükledikten Sonra:

Modem açılınca şu komutla bağlanmayı dene:

telnet 192.168.2.1
Kullanıcı: admin
Şifre: admin

Şimdi herkes için çalışan bir yöntem lazım. Ne yapalım @SetoKaiba @Dümdüz @Majdev

Cihazda artık root yetkisi ile shell erişimimiz var. Firmware modifiye edip geri yazdırabiliriz. Ya da aklınıza gelen daha kolay bir yöntem varsa bekliyorum.

SetoKaiba · 26 Kasım 2025

Elinize sağlık. Arkadaşın değişkenleri (local_90) nasıl bulduğunu merak ettiğimi söylemeden edemeyeceğim. PM den detay gönderirseniz sevinirim

Firmware açıp oobsiyle uğraşıp kapatmak vs. bunlara gerenk yok hocam bence, güzel bir klavuzla göstermek en kolayı, elimde modem olmadığından, normal kullanıcı arayüzden upgrade yapabiliyor mu bilmiyorum.

Python scriptini bin açıldıktan sonra ek komut ile otomatik modifiye eden bir hale getirip (*telnet dahil) karıştırılabilecek unsurlarını ortadan kaldırarak paylaşmak mantıklı geldi bana.

Recep Baltaş · 26 Kasım 2025

Sordum kendisine ve şöyle cevap verdi:

cool_recep
- BTW, can you share information about the recovery process? Was it in the heap?
eigma
- No, it was based on the libcmm reversing and rootfs only
- Like I posted on github

Bahsettiği GitHub linki:

https://github.com/sta-c0000/tpconf_bin_xml/issues/53

Normal kullanıcı arayüzünden upgrade maalesef olmuyor ama USB takılabiliyor cihaza ve USB'den Firmware güncelleme yapabiliriz. Tabi biraz zor olur bazı kullanıcılar için.

Aslında yapmak lazım zira TTNET bir sonraki uzaktan FW güncellemesi ile cihazı daha da kapatacak. Yani bizim mevcut kullanıcılara şu iki şeyi sağlamamız lazım:

Web arayüzünde root yetkisi
Uzaktan güncellemeyi kapatma

SetoKaiba · 26 Kasım 2025

Telnet CLI üzerinden yapılandırmayı modifiye edebiliyor olmanız lazım. Buradan root hesabını etkinleştirilebilmeli ve cwmp (TR069) kapatılabilmeli, eski zamanlarda hatırladığım kadarıyla kullandığım bir TP-Link modemde (hala geçerlimi bilmiyorum), Güncellenmesin diye, cwmp sunucusunu cli üzerinden değiştirerek bağlantısını kesmiştim.

Hasan Merkit · 26 Kasım 2025

Operatörlerin İsveç seviyesinde ücret alıp Hindistan kalitesinde iş çıkarması yetmiyormuş gibi bir de sansürleriyle uğraşıyoruz. Buna rağmen gösterdiğiniz emek ve çaba gerçekten takdire değer.

Recep Baltaş · 26 Kasım 2025

Seçenekler bunlar:

Kod:

TP-Link(conf)#help
normal mode commands:
        clear           ---     clear screen
        exit            ---     leave to the privious mode
        help            ---     help info
        history         ---     show histroy commands
        logout          ---     logout cli model
config mode commands:
        config          ---     enter config mode
        shell           ---     force to cli
        adsl            ---     config adsl
        wan             ---     wan config
        wlctl           ---     wireless config
        lan             ---     lan config
        dev             ---     device control
        debug           ---     debug cmd
        cpuinfo         ---     cpu info
        meminfo         ---     memory info
        processnumber   ---     number of processes
        route           ---     route config
        ping            ---     ping test
        traceroute      ---     traceroute test
        nslookup        ---     nslookup test

shell komutu bizi doğrudan root yetkisi ile shell'e atıyor.

QEMU ile bir sanal makine yapıp orada kendiniz de bakabilirsiniz. Bu iş için 100 USD bütçe ayırdım. Herkesin uygulayabileceği kalıcı bir yöntem iletene bütçeyi aktaracağım. Benden bir şey isteniyorsa ben de cihazı hazır tutuyorum yanımda.

SetoKaiba · 26 Kasım 2025

Hasan Merkit dedi:
Operatörlerin İsveç seviyesinde ücret alıp Hindistan kalitesinde iş çıkarması yetmiyormuş gibi bir de sansürleriyle uğraşıyoruz. Buna rağmen gösterdiğiniz emek ve çaba gerçekten takdire değer.

++ Btk ya göre fiberi sonlandırmakla yükümlüler ancak, dağıtıcıya eklenen saçma sapan protokoller ile, benim yerel ağımı izleme yetkileri yok. Trafik wan portundan gidene kadar yerel ağı izlemelerini kabul edilemez buluyorum. Ondan sonrası onların sorunu, paketlerimi sunuculara ulaştırdıkları sürece ne yaparlarsa yapsınlar, beni ilgilendirmiyor.

Dümdüz · 26 Kasım 2025

Kod:

cp /etc/config/user_config.xml /tmp/ayar.xml

Kod:

sed -i 's/<Password>.*<\/Password>/<Password>21232f297a57a5a743894a0e4a801fc3<\/Password>/g' /tmp/ayar.xml

Kod:

tp_conf -s /tmp/ayar.xml

Default olarak root kullanıcı adı: admin şifre: admin

IPtables ile de TR-069 kesilebilir bence.

ACS adresi biliniyorsa, ben araştıramayacağım şu an:

Kod:

iptables -I INPUT -p tcp --dport 7547 -j DROP

Kod:

iptables -I OUTPUT -d <acsturktelekomcomtr> -j DROP

Burada adresi tamamen tahmine dayalı yazdım, bilmiyorum.
Crontab gerekir bir de buna.

Standart kullanıcı için nasıl basitleştirilebilir bilmiyorum...

Konfigürasyonu bozalım desek brick riski yüksek ama:

Kod:

sys set cwmp status 0

sys set cwmp url "cartcurt.kom"

sys commit

Çözüldü TP-Link VC220-G3u Root Yetkisi Elde Etme

Detaylar

Recep Baltaş

Techolay

Ferdi Burak

Mangolin

Çalışkan

Majdev

Yetkin

Recep Baltaş

Techolay

Kodun Analizi (Neden Başarısız Olduk?)

ARKA KAPIYI BULDUN: "Factory Test Mode"

YENİ PLAN: XML'i Bu Arka Kapıya Göre Düzenle

Adım 1: DeviceInfo Kısmına "Manufacture Mode" Ekle

Adım 2: Admin Kullanıcısını "admin_test" Yap

Sonuç

SetoKaiba

Çalışkan

Recep Baltaş

Techolay

SetoKaiba

Çalışkan

Hasan Merkit

Moderasyon Üyesi

Recep Baltaş

Techolay

SetoKaiba

Çalışkan

Dümdüz

Başarılı

Benzer konular

Yeni konular

Yeni mesajlar

Çözüldü TP-Link VC220-G3u Root Yetkisi Elde Etme

Techolay

Çalışkan

Yetkin

Techolay

Kodun Analizi (Neden Başarısız Olduk?)​

ARKA KAPIYI BULDUN: "Factory Test Mode"​

YENİ PLAN: XML'i Bu Arka Kapıya Göre Düzenle​

Adım 1: DeviceInfo Kısmına "Manufacture Mode" Ekle​

Adım 2: Admin Kullanıcısını "admin_test" Yap​

Sonuç​

Çalışkan

Techolay

Çalışkan

Moderasyon Üyesi

Techolay

Çalışkan

Başarılı

Benzer konular

Kodun Analizi (Neden Başarısız Olduk?)

ARKA KAPIYI BULDUN: "Factory Test Mode"

YENİ PLAN: XML'i Bu Arka Kapıya Göre Düzenle

Adım 1: DeviceInfo Kısmına "Manufacture Mode" Ekle

Adım 2: Admin Kullanıcısını "admin_test" Yap

Sonuç