Hacking Cable Modems

This post describes about the technique about hacking a cable modem to get speed from 64kbps to any speed you want to .

I think most of the users still might be using cable modems to access the mighty world of internet.But no one is satisfied with the bandwidth. One with 64 kbps wants 128 kbps and one with 256 want 512 kbps.

This tutorial will teach how you can do that.

What we will be doing is utilizing the exploit of loop holes of the ISP server to grab vital information. Mind that 100% success is not guaranteed , but thats' why we love tweaking.

Theory of cable modem working

All the cable modems when it boots up it will search for an "Image file" where in all configuration like your upload speed limit and download speed limit is defined. This "Image file" is stored in ISP`s TFTP server. Modem will be pre-configured with the ISP`s TFTP server IP address and the Image file name to be downloaded. When the modem boots up it query TFTP server and download Image file from TFTP server according to this this our speed limits will be set.

Our Mission
Get this Image file from ISP`s TFTP server, reconfigure it according to our need and force our modem to download this file from our Computer rather than downloading it from our ISP`s TFTP server.

Step 1 : Get cable modems MAC address
You can either look at the back of the modem to get this MAC Address or you can login to your Cable modem with your Web Browser http://192.168.100.1/ . This is internal HTML pages stored within your DOCsis cable modem that gives you even more vital information on configuration. Unless it is turned off by your ISP. This feature might be totally turned off by your ISP.

Step 2 : Get your ISPs TFTP server IP address and get name and path of the "configuration file" or Image file stored in the ISP`s TFTP server.

For getting this vital information you have to do an SNMP walk over your modem. For doing this you can use tool below:

Beginners can use SNMPWALK Tool
You can download this from:

http://www.bradford-sw.com/board/board.cgi...download&gul=13

use command "snmpwalk 192.168.100.1 public"

NOTE: Use modem's IP address as "192.168.100.1" when it asked to provide by any of the above tools. SNMP community is "Public"

Using the above tools you will get the information of your ISP`s TFTP server IP and the name of your "Image file" stored in that TFTP server
All your vital information is stored in this file, One of which is the MaxRateDown 2621440; MaxRateUp 393216;.

Among these, the one we need are:
Configuration TFTP Server = 194.*.*..90 (replace this with yours throughout in the doc)
Configuration filename = isrr.bin (replace this with yours throughout in the doc)
And
IP fragments created = 0
IP address.10.xxx.xxx.xxx = 10.xxx.xxx.xxx
IP address.192.168.100.1 = 192.168.100.1 (the IP address of the cable modem, (replace this with yours throughout in the doc)
IP-to-If-index.10.xxx.xxx.xxx = 2

Step 4: Download Image file from ISP`s TFTP server.
For doing this got to your command prompt and use below commands with out quotes and bracket.

"C:\tftp -i GET "

Okay now you got Image file from your ISP`s TFTP server.

Step 5: Decrypt the Image file which you downloaded from ISP`s TFTP server
Step 6: Modify the Image file
Step 7: Encrypt the modified Image file

Use docsis tool which you can download from

http://sourceforge.net/projects/docsis

using this program you can decrypt image file change the upload speed and download speed ,save it and encrypt back. Rename this newly created file same as your original image file.


Step 7: Change your computer's TCP configuration same as ISP`s TFTP server (i.e. IP address same as ISP`s TFTP server)

Go to my network place and right click ->properties
Select your LAN Card right click ->property->Internet Protocol (TCP-IP) double click on it and change it to as following values
Configure your TPC's TCP settings as below
IP: 194.*.*.90 (replace with the ISP's TFTP server)
Netmask: 255.255.255.0
Gateway: 192.168.100.1 (replace with your cable modem's IP address)

Note: Gateway should be 192.168.100.1 then only your modem can communicate with computer.

Step 9: Host TFTP server in your computer
Step 10: Put Image file in the base directory of your TFTP
Step 11: Restart your modem

Download TFTP Server software and host TFTP server in your computer
You can download TFTP server from:
ftp://ftp.ida.net/pub/wireless/tftpd32.exe

Start TFTPD32 server. Go to Settings and set the Security to None. Increase the timeout to 20secs and the Max Retransmit to 6. Choose to translate UNIX filenames. Make sure it's base directory point to where the isrr.bin is (i.e. the image file which you modified). If you need to replicate a directory pathname along with the image file, then make a directory from root that corresponds to the image file pathname.

Restart your modem, and AS SOON as the SEND light goes solid, you should see a receive on your TFTP server i.e. your PC

Step 12: Changer your PC's IP back as given by ISP
Step 13: Done. Start surfing with your new speed

Now you change your TCP settings of your PC back to normal as given by ISP. (I.e. Put your original IP address and gateway)

Oops you hacked your modem. Test out by downloading some files using DAP (Download accelerator plus)

Note: This speed will remain same until you restart your cable modem. So each time you reboot your modem you have to follow the steps 8,9,10,11 and 12