Linksys PAP2 locked to Vonage, support people funny

Same exact reset code as the Sipura. When I left Broadvoice, I was able to reset my Sipura 1000 since they do not lock the hardware.

Enter IVR Menu * * * *

Ignore SIT or other tones until you hear, "Sipura configuration menu.Please enter option followed by the pound key or hang-up to exit."

Factory Reset of Unit 73738 Enter 1 to confirm

SPA will prompt for confirmation. After confirming, you will hear Option Successful. Hangup. Unit will reboot and all configuration parameters will be reset to factory default values.

Well I have the unlocked pap2-na so I can't try that mine works good very open for changes.. anyone have the locked one and willing to give it a try.. I can bet there are a ton of people dieing to know if it works and what you did. maybe do it before you go away someplace. and have anouther phone you can use so you can call vontage and tell them your rented box is messed up leaving time for them to send you anouther lol...

Some one hurry up and try this.. i wanna buy these things as gifts and send them setup with fwd numbers so I can call my LD buddies...

m.

pl wrote:

I knoticed alot of Ebay listings of PAP2 I personaly emailed almost all of them and they always reply with out answering the question weather its realy a pap2-na or just a pap2 I am extreamly clear too on the matter

So beware!

m wrote:

From what little has been written so far it looks like the -na variant is only available for new purchase through a voip service provider (other than Vonage). Also it's fairly apparent from the pricing that Linksys has/had no intention whatsoever of fielding 1st and 2nd level support calls from the actual end-user.

Now as far as eBay goes, don't waste your time pestering the seller asking them if theirs is the -NA model. It the listing doesn't specificaly say "NA" then take it safely on faith that it isn't one. They are in enough demand that anyone selling one would certainly be smart enough to differentiate that fact in his listing and the world would surely beat a path to his door.

If any one is intrested in the hardware specs, follow this link for

pics and specs.

Could you spoof ls.tftp.vonage.net to point to your tftp server and

provide

I downloaded that file with KugleSoft TFTP Server & Client, and

it's an encrypted file :x

I ordered 3 vonage-non-opened pap2, Hope I can get it work with

stanaphone :(

If any one is intrested in the hardware specs, follow this link for

pics and specs.

That URL doesn't work :(

I too want to know how to unlock a pap2 device.

Does the reset code work if you just get the pap2 out of the box and

DO NOT connect it to the internet so it cannot download the xml?

Most devices ask to download several config files. You will need to monitor the network traffic and see what the device trying to download from where. There is another file that is not encrypted that gets downloaded.

I use a different service that sent me a locked device and was able to unlock it by giving it a config file to download. The device specific file was encrypted but the device was also downloading a general config file which was not encrypted.

Yaser

not to kick a dead horse (assuming this discussion is still of interest to some ppl), i've had some success following the advice in this thread, but alas, i'm still far from freeing the pap2 from the vonage hegemony.

the pap2 successfully connects to the local tftpserver, downloads /tftpboot/spaXXXXXXXXXXXX.xml and /tftpboot/YYYYYYYYYY/spaXXXXXXXXXXXX.xml, self-installs the firmware, reboots, and connects to vonage via port 5060-5061.

now, i've tried replacing the spaXXXXXXXXXXXX.xml file with a spa2k-2.0.10e.bin file and renamed the tftpboot/YYYYYYYYYY directory to whatever the pap2 was asking for (obtained by tcpdump and ethereal), but the download stops abruptly when the pap2 returns an icmp packet with a "port unreachable" message. i think that in this case the spa2k-2.0.10e.bin (709K) much bigger than spaXXXXXXXXXXXX.xml (29K), so the device rejects the firmware upload (probably due to a max file size constraint).

i see two ways of getting around this problem:

let me know what you think.

Yaser Doleh wrote:

download

spa2k-2.0.10e.bin and spaXXXXXXXXXXXX.xml are completely 2 different files. The first is a firware upgrade and the second is a configuration. You don't need the firmware upgrade and if you did it once, you don't need to do it again.

If you have the firmware file, chances are the default passwords are stored on clear text in the file. Try to extract the strings from the file and see what you can find. On a UNIX type machine run

% strings spa2k-2.0.10e.bin

If you want just email me the file and I can try for you.

Yaser

snipped-for-privacy@mccamm> not to kick a dead horse (assuming this discussion is still of interest

Does anyone have a copy of the flash from an orinanally UNLOCKED PAP2 (PAP2-NA)? I would like to look at it.

MK

so, what you're saying is that i could theoretically create my own unsalted config file, upload it, reboot, and the pap2 would be unencumbered? how do i go about creating a realistic config to replace the salted one? what are the parameters?

thanks for clearing up my misconception. i didn't know what the spaXXXXXXXXXXXX.xml file was for. i thought it might be a combination of the firmware update and config. at any rate, it's salted/encrypted so i don't know its actual contents. i ran 'strings spaXXXXXXXXXXXX.xml > strings.out' and got a bunch of short one-liners that looked like gobbly gook to me. then i used the output file as the password file for hydra and pointed it at the pap2. no juice.

at this point, i'm stuck with the two choices that i posted previously. short of launching a full-blown brute force attack on the pap2 or it's config, i'm not sure of what to try next. any more ideas?

oh yea, forgot to mention that i also tried 'strings spa2k-2.0.10e.bin

OK since I've already wasted my Friday night, I might as well lay out

what I've found.

I've successfully changed the firmware to two other versions, a .10LSc

and a .13LSb.

It appears thought that the provider config is stored somewhere

outside of the main firmware, because despite flashing to different

versions, I am still prompted to enter a password for the admin

pages, and the device still makes requests to a vonage tftp server.

I tried a factory reset after loading each firmware, and it didn't

help.

I noticed that the device says it has a certificate installed. I'm

assuming this is what's used to authenticate/decrypt the .xml config

file the device is trying to load. If that's the case, then the

configs are likely signed with a key unique to vonage, and that

pretty much ends that direction. I think that will likely prevent

the loading of some generic, yet properly compiled config file, since

it won't be signed by vonage's key.

I read somewhere that older versions of the firmware had a particular

vulnerability that allowed config access - does anyone recall what

that was about?

PAP2-NA firmware is available. Getting it to load onto the PAP2 is

the challenge. It's apparently not as simple as renaming it to the

file requested by tftp. That results in the tftp session shutting

down before the transfer completes.

Would be nice if someone, with the adequate hardware, could

interrogate the NVRAM of a PAP2-NA and

and extract the firmware image.

can see the web interface), but it keeps asking me a password to the

Admin Area and once connected to the net, it starts to download

vonage firmware. :(

Could someone with access to a pap2-na send me the html source for

the

access the admin pages, the data that is "posted" via those pages

doesn't go through any sort of checking.

I thought the same, so searching some equivalent-sipura configs, I

found out that to upgrade the firmware via web interface, you have to

do it this way:

http://PAP2-IP/admin/upgrade?

Still asks me for the admin password.. :(

Could someone with access to a pap2-na send me the html source for the

admin page or post it here please?

My current thinking is that although authentication is required to

access the admin pages, the data that is "posted" via those pages

doesn't go through any sort of checking.

I've noticed that the field have numerical names. If I can find out

the names of the fields for various admin config stuff, I might be

able to inject those values somehow.

I'm not sure easy this will be though...

I wish the person who had the walk-though on linuxvoip.info would

speak up! =)

Would be nice if someone, with the adequate hardware, could

interrogate the NVRAM of a PAP2-NA and

and extract the firmware image.

I don't know how to do that though :(

I've tried resetting the pap2, it indeed come to factory defaults (I

can see the web interface), but it keeps asking me a password to the

Admin Area and once connected to the net, it starts to download

vonage firmware. :(

Could you please send me the PAP2-NA firmware? (.bin?)

thanks