VRV9517 infodump

readme.md

Skinny/Spark/Arcadyan VRV9517/Experia Box V10a infodump

This is a guide/general infodump of things I've found while poking through the VRV9517 modem, as supplied by Spark/Skinny in New Zealand, and maybe also under other names in different countries. What you see here is the extent of what I've found, mostly concentrated on decrypting the exported config file.

Included third-party software

• Samba
• MiniUPnP
• MiniDLNA
• vsftpd

Decrypting exported config

I have created a Python script you can find here, which easily decrypts the exported config file to a .tar.gz archive. You will need the original WiFi password, which can be found on the back on the removable card that comes with the router. It requires OpenSSL to be installed. It appears most of the configuration is stored in the '.gblcfg' file, and most of the other files are dynamically generated from this.

Obtaining the firmware

The config file mentioned above contains the URL for the auto-update feature. For Skinny devices this is currently https://www.bigpipe.co.nz/assets/firmware/skinny/version.txt, which links to the latest version. Unfortunately the main image seems to be encrypted or obfuscated somehow, and I haven't had the time to go through and reverse engineer it.

Serial/SSH/Telnet

It has a Telnet server onboard that can be enabled but unfortunately requires a root password, which I don't know. Serial port can probably also be found by probing around on the board but I would imagine the same situation would occur.

At least for my box the credentials for logging in via telnet are the same as logging into the GUI (e.g. admin/password).
That's worth giving a go @svbnet

It gives us a root shell, and looking around it's a normal (if minimal, and low spec) Linux machine.

# id
uid=0(root) gid=0 groups=0
# sysinfo 
Number of processes: 168
  2:30am  up 14:30, 
load average: 1 min:0.47, 5 min:0.38, 15 min:0.36
              total         used         free       shared      buffers
  Mem:       441208       183168       258040            0            0
 Swap:            0            0            0
Total:       441208       183168       258040
# uname -a
Linux VRV9517 4.1.38 #1 SMP PREEMPT Thu Aug 12 02:32:30 UTC 2021 armv7l GNU/Linux

@importantblimp Thanks for the update. I don’t have the router and haven’t had service with Spark in ages, so I’ll quote your reply in the original gist.