Turkcell Superbox 5G ZTE MC8520B modem geliştirici seçenekleri ve DNS değiştirme

(async () => {
  const ZERO = "00000000000000000000000000000000";
  const adminSid = sessionStorage.getItem("ct");

  if (!adminSid) {
    throw new Error("Önce normal admin hesabıyla WebUI'a giriş yap.");
  }

  let id = Date.now();

  async function ubus(
    session,
    object,
    method,
    args = {},
    tag = method,
    mode = "0"
  ) {
    const request = [{
      jsonrpc: "2.0",
      id: ++id,
      method: "call",
      params: [session, object, method, args]
    }];

    const response = await fetch(`/ubus/?t=${Date.now()}`, {
      method: "POST",
      credentials: "same-origin",
      headers: {
        "Accept": "application/json, text/javascript, */*; q=0.01",
        "Content-Type": "application/json",
        "X-Requested-With": "XMLHttpRequest",
        "Z-Mode": mode,
        "Z-Tag": tag
      },
      body: JSON.stringify(request)
    });

    const body = await response.json();
    const item = body?.[0];

    if (item?.error) {
      throw new Error(
        `${object}.${method}: ${JSON.stringify(item.error)}`
      );
    }

    return {
      raw: body,
      result: item?.result
    };
  }

  // Hashi mevcut admin oturumu sona ermeden al.
  const configReply = await ubus(
    adminSid,
    "uci",
    "get",
    {config: "zwrt_web"},
    "zwrt_web"
  );

  const superUser =
    configReply.result?.[1]?.values?.user2;

  if (
    superUser?.username !== "sUser" ||
    superUser?.usergroup !== "superadmin" ||
    !/^[0-9A-F]{64}$/i.test(superUser?.password || "")
  ) {
    throw new Error("sUser/superadmin iç hash kaydı bulunamadı.");
  }

  const innerHash = superUser.password;

  // Yalnız mevcut modem WebUI oturumunu kapat.
  await ubus(
    adminSid,
    "zwrt_web",
    "web_logout",
    {},
    "web_logout",
    "1"
  );

  // sUser normal giriş challenge'ı.
  const loginInfo = await ubus(
    ZERO,
    "zwrt_web",
    "web_login_info",
    {},
    "web_login_info"
  );

  const loginSalt =
    loginInfo.result?.[1]?.zte_web_sault;

  const loginChallenge =
    paswordAlgorithmsCookie(innerHash + loginSalt);

  const loginReply = await ubus(
    ZERO,
    "zwrt_web",
    "web_login",
    {
      username: superUser.username,
      password: loginChallenge
    },
    "web_login",
    "0"
  );

  const loginResult = loginReply.result?.[1];
  const sUserSid = loginResult?.ubus_rpc_session;

  if (
    String(loginResult?.result) !== "0" ||
    !sUserSid
  ) {
    console.error("sUser giriş yanıtı:", loginReply.raw);
    throw new Error(
      `sUser girişi başarısız: ${JSON.stringify(loginResult)}`
    );
  }

  // Yeni sUser oturumu için güncel developer salt'ı.
  const developerInfo = await ubus(
    sUserSid,
    "zwrt_web",
    "web_login_info",
    {},
    "web_login_info"
  );

  const developerSalt =
    developerInfo.result?.[1]?.zte_web_sault;

  const developerChallenge =
    paswordAlgorithmsCookie(innerHash + developerSalt);

  const developerReply = await ubus(
    sUserSid,
    "zwrt_web",
    "web_developer_option_login",
    {
      username: superUser.username,
      password: developerChallenge
    },
    "web_developer_option_login",
    "1"
  );

  const finalInfo = await ubus(
    sUserSid,
    "zwrt_web",
    "web_info",
    {},
    "web_info"
  );

  const state = finalInfo.result?.[1];

  console.table([{
    login_current_user: state?.login_current_user,
    developer_option_loginfo:
      state?.developer_option_loginfo,
    developerResult:
      developerReply.result?.[1]?.result,
    success:
      state?.login_current_user === "sUser" &&
      String(state?.developer_option_loginfo) === "1"
  }]);

  if (
    state?.login_current_user !== "sUser" ||
    String(state?.developer_option_loginfo) !== "1"
  ) {
    sessionStorage.setItem("ct", sUserSid);
    throw new Error(
      "sUser oturumu açıldı fakat developer durumu doğrulanamadı."
    );
  }

  // Uygulamanın yeni oturumu tanıması için kaydet ve tam yenile.
  sessionStorage.setItem("ct", sUserSid);

  const destination = new URL(location.href);
  destination.searchParams.set("_su", Date.now());
  destination.hash = "#developer_options";
  location.replace(destination.href);
})();