[HowTo] Extract hidden SIP-password from Zyxel router?

[Desitv]

Hi sorry only in english
Is there a way to extract the hidden SIP-password from a ZyXEL P-2602HW-D1A
router ?
My ISP/ Fullrate.dk will not let me have it, only my username, which I
can see for myself through the webinterface. http://www.fritzbox.dk/index.php/beskrivelse/opstaetning/fullratevoip
But the password is only marked by a string of *********.
So I can´t switch the Zyxel and use my favorite Fritzbox 7390
unless I get the damned password out of the box.
Any working solution warmly welcomed !

Regards
Desitv

 

[VoIP-seufz]

not sure that it helps in your specific case - try to retrieve the password from source of the router web page

This was successful with a Zyxel 2602 D7A here

 

[Desitv]

Please can u give me more details . How to ..
Thanks

 

[informerex]

from google - i don´t now if it help

http://192.168.0.1/wzVoIP_2.html

http://192.168.1.1/ admin 1234

Device: Zyxel P-2602HW-D1A - Description: All-in-one ADSL2+ VoIP IAD for SOHO
Once you log in your IP is whitelisted for 5 minutes (default value, see below).
There is no CSRF protection.Examples: http://192.168.1.254/Forms/RemMagWWW_1?serverWebPort=80&WWWAccessInterface=00000000
will open up the admin web interface to the internet.

http://192.168.1.254/Forms/rpSysAdmin_1?StdioTimout=0 will set the IP whitelisting timeout to unlimited.
When someone is logged in to the interface, requesting an admin url from a different IP in the LAN produces a
message stating that the object is Protected. When no-one is logged in you get the login page. Thus it is possible
to tell when someone is logged in.

Protection:
- Set the Maintenance > System > General > Administrator Inactivity Timer very low.
- Make sure you do not access any web resource while administering the device and for x minutes afterwards.

http://packetstormsecurity.org/papers/attack/Hacking_ZyXEL_Gateways.pdf