Part 1 - Telia SE Router Sagemcom F@st 5370E Mod

As told in earlier post, I was annoyed by limitation set by the ISP to modify the router. All I wanted to tweak DNS to OpenDNS or Pi Hole as I trust them more rather than ISP DNS. They are fast, they are secure enough, they are for people. But, when logged into the router, saw this.

Software Version: SG4T1E000446C ( 7th Feb, 2020 )

Yes, there is no option to modify the DNS of the router. Neither in DHCP for LAN section:

It is terrible. I understand they did it for easy remote support purpose, but hey - if I am getting the modem completely ( buying it ?! ) , atleast give me an option to set my things up.

So, started digging around about the router specification from Sagemcom, and seems there are very limited documentation available on that router. Then found a very helpful thread in a forum ( https://forums.whirlpool.net.au/archive/2746904 ) but for different router. Another one, by wuseman, which is old and lots of previous hacks are not working anymore. But, thanks to their effort and documentation, a very basic thing was clear - I can use my existing knowledge of xpath which I learnt for XPATH injection techniques though never successful to get a bounty. 👻

1st target was to modify the DNS for LAN clients. I don't want to set my DNS to the router, which is using ISP DNS by default and without any option for modification.

Now, how to start with this  ? Easy Peasy. Open Firefox or Chrome, open your router IP and login with the details. Then for Firefox, press CRTL+SHIFT+K or for Chrome CTRL+SHIFT+J . In my case, I like Chrome console for XPATH more, for mostly autocomplete feature ( being proudly lazy ) .

Now you have a console to type. Start with

$.config

It will show configuration for the router internal in advance mode. You will see there are enormous number of features available which is not displayed on WebUI.

Do dig more into it, you can use following commands.

Feature Hunting

$.config
$.xpaths
$.xmo.getValuesTree("*")
$.xmo.getValuesTree("*/*")
$.xmo.getValuesTree("*/*/*")
$.xmo.getValuesTree("*/*/*/*")
$.xmo.getValuesTree("*/*/*/*/*")
$.xmo.getValuesTree("*/*/*/*/*/*")
$.xmo.getValuesTree("*/*/*/*/*/*/*")
$.xmo.getCapability("*")
$.xmo.getCapability("*/*")
$.xmo.getCapability("*/*/*")
$.xmo.getValuesTree($.xpaths.mySagemcomBox);

Now directly coming to the point, editing DNS for LAN DHCP on Wireless, Guest Wireless. Try following, modify DNS IP to your preffered.

Modify DNS and Guest DNS for LAN Clients

$.xmo.setValuesTree("false", $.xpaths.mySagemcomBox.dns.notEditable);
$.xmo.getValuesTree("Device/DNS/Client/Servers/Server[1]/DNSServer");
$.xmo.setValuesTree("8.8.8.8", $.xpaths.mySagemcomBox.dns.server);
$.xmo.setValuesTree("208.67.222.222", $.xpaths.mySagemcomBox.dns.server2);
$.xmo.setValuesTree("8.8.8.8,208.67.222.222","Device/DNS/Client/Servers/Server[1]/DNSServer");
$.xmo.setValuesTree("8.8.8.8,208.67.222.222", $.xpaths.mySagemcomBox.dhcp.dnsServer);

$.xmo.getValuesTree($.xpaths.mySagemcomBox.dhcp.guestDnsServer);
$.xmo.setValuesTree("208.67.222.222,8.8.8.8", $.xpaths.mySagemcomBox.dhcp.guestDnsServer);

Then save the settings using following command.

$.xmo.setValuesTree('true', "maintenance.saveRestore.save");

And reboot your router. Once it is back again, voila  . 🕺🏻 . all your DHCP client will be using your preffered DNS, not the forced one by  your ISP.

PS: If you want to go back to previous setting anytime, just factory reset your router from GUI or by other method by pressing reset key back of the router for few seconds.

Click Here to Read Part 2 Telia SE Router Sagemcom F@st 5370E Mod