Before any exploitation, it helps to know how the device presents itself on the network, what the stock admin UI reveals, and where the less obvious interfaces live.
Network layout
The RG2100 exposes a USB network interface. In my setup the host and device sat on separate subnets from my normal Wi-Fi connection:
Host USB/RNDIS IP: 192.168.0.174
Device IP: 192.168.0.1
Host Wi-Fi IP: 192.168.5.71
The USB network and the host’s ordinary internet connection were independent. The hotspot admin UI was reachable over plain HTTP at:
http://192.168.0.1/
Throughout this series, replace the placeholder below with your actual admin password:
<ADMIN_PASSWORD>
Stock device information
Once logged in, the web UI reported firmware and status fields such as:
model=RG2100
brand=TMOBILE
carrier=TMOBILE
fw_ver=RG2100.TM.M1639
imei=490154203237518These values matter later for SIM unlock and FOTA checks. Note them down before changing anything.
Filesystem layout
After gaining shell access (covered in Parts 2 and 3), the root filesystem looked like this:
/
├── WEBSERVER
├── bin
├── boot
├── build.prop
├── cache
├── data
├── dev
├── etc
├── firmware
├── home
├── lib
├── media
├── mnt
├── overlay
├── persist
├── proc
├── run
├── sbin
├── sdcard
├── sys
├── system
├── systemrw
├── target
├── tmp
├── usr
├── var
└── www
That layout tells you immediately this is not a minimal web appliance. It is a full embedded Linux system with systemd, UBI volumes, a web stack, FOTA tooling, Qualcomm modem plumbing, and a large set of Franklin-specific scripts.
Hidden web interface bundles
An early clue sat in the web content archives under /usr:
/usr/www.tgz
/usr/www.hidden.tgz
/usr/www.webpst.tgz
/usr/www.eng.tgz
These map roughly to the public UI, hidden UI, webpst UI, and engineering UI. The webpst bundle is especially interesting: it exposes service and update pages that do not appear in the normal menu.
The password that unlocked the webpst pages was:
Dnpf#zjA_Xn@TnARuWls#@VnpDlWld_!
What the hidden menu exposes
The hidden menu is rough around the edges. Some pages render badly if the wrong bundle or path is active, and others appear to have been carried forward from older Franklin products. Even so, it surfaces areas such as:
Device Information
Cellular
Debug
Factory Reset
RTN
SCRTN
DATA
LTE
DSS
APN Setting
SIM Lock
MEID
BRAND
OMADM
UPDATE
OMANI
One lesson from exploring these pages: the archives exist on disk, but that does not mean every page is cleanly wired into the live web server on every firmware build. Some paths are protected, some are incomplete, and some assume a different product or an older JavaScript/CSS layout.
Where we go next
The first real foothold did not come from ADB or a hidden menu password. It came from the ordinary software-update page in the public web UI, specifically, how the server handles the uploaded firmware filename.
Continue to Part 2: Command Injection.