How to find PPPoE password for Actiontec PK5000

A friend of mine was wondering how to obtain his PPPoE username and password for his connection to centurylink / qwest.

There’re two different routes, you can do a complete router reset by holding down the reset button on the back of the device, and then after your modem reboots you can open up a web browser and it should take you through an automated setup, with how they currently have the system in place.  There’s a point in the setup that will show you your PPPoE username and password, I simply saved this document to my dropbox so I could reference it for later use.

The other method is to use telnet.  I was inspired by this post: http://www.muchtall.com/2009/03/11/4-2/ and even more so by this comment left to that post: http://www.muchtall.com/2013/05/23/recovering-the-ppp-username-and-password-from-a-centurylink-actiontec-c1000a/.

So if you have a different modem than the PK5000 and you are trying to get / recover the PPPoE username and password to your centurylink / qwest modem / router, those posts above  might be of help for you, especially if you have an Actiontec C1000A.

Lets Begin

To start you will need to enable telnet on your modem.  You can do so by opening up your gateway page often: 192.168.0.1 or 192.168.1.1 – I would explain how to do / find this, but if you’re looking to obtain your PPPoE username and password you hopefully know about your gateway address :P.  Under “Advanced Setup –> Remote Management –> Remote Telnet” you can enable telnet and set a username and password, and as always remember that stuff, it’s going to be important and required for the upcoming steps.

You will need telnet for the next step. If telnet is not found in your cmd here’s an article about enabling it on Windows 8: http://www.sysprobs.com/install-and-enable-telnet-in-windows-8-use-as-telnet-client

If you have issues getting telnet to work through Windows you can always try Putty

You’ll use the command: telnet 192.168.0.1 (whatever your gateway IP is)
It will then ask you for the username and password that you set up in the settings.

Next you’ll need to type the command: ps
This will display all the running processes for the modem.

You’ll need to find the line that has “/usr/sbin/pppd plugin pppoe nas0 user qwestUsername@qwest.net”
It will be cut off since they only display 80 characters or so.

Then look at the leftmost column, it should be some random number, which is the process ID.
Write this down somewhere for the next step.

Now enter: cat proc/(PROCESS_ID)/cmdline
ie: cat proc/742/cmdline

This should spit something out like:

/usr/sbin/pppdpluginpppoenas0userQWEST_USERNAME@qwest.netpasswordPASSWORDnodetach
pppoe_ses_id0defaultrouteusepeerdnsmru1492maxfail10lcp-echo-failure4lcp-echo-int
erval30#

And there you have it, it will display your PPPoE username and password, which the password will be found between “password” and “nodetach”

This entry was posted in Interesting Finds and tagged , , , , , , , , , . Bookmark the permalink. Post a comment or leave a trackback: Trackback URL.

8 Comments

  1. Cody Swartz cyberowl
    Posted February 5, 2014 at 7:04 pm | Permalink

    you rock!

  2. Posted February 24, 2014 at 9:12 am | Permalink

    I’ve found that on my Actiontec C1000A, telnet or ssh with putty results in having to use the format ‘sh -c’. I would suppose there is no way to default to sh shell? sh -c doesn’t appear to take a usermod command.

    • Cody Swartz Cody Swartz
      Posted March 8, 2014 at 12:19 pm | Permalink

      Kind of confused what you’re trying to do Joseph.

      Just got a C1000A myself and started playing around after seeing a few comments on this post : )

      Thanks for the sh command, now I can start running around ls’ing this thing apart. What just made me super excited besides that is that there’s a wget command on this box 😉 I’m thinking about if I can inject a web page/script that allows me to fully control my modem…

      Seems there’s a few other backdoors to our modem such as SSH and possibly rLogin? Will poke around and see if I can’t just get access to those instead.

      Sucks you can’t see your current directory on the command line w/o typing pwd.

      Edit
      Kind of scary to see this: http://puu.sh/7nOKT/165a5e10b7.png
      But also understandable since I know centurylink/qwest have a backdoor to check your system.

  3. Cody Swartz Chris
    Posted March 5, 2014 at 10:16 am | Permalink

    Great help thanks! Do you know where the gui login info is stored? I setup telnet and can now telnet in but can not login to the GUI.

    • Cody Swartz Cody Swartz
      Posted March 8, 2014 at 12:20 pm | Permalink

      Looking around this box right now, did you have any luck your self?
      Which model do you have?

  4. Cody Swartz lauren
    Posted July 20, 2016 at 5:54 am | Permalink

    Super helpful Thank this worked for aztech routers

  5. Cody Swartz TJ
    Posted October 11, 2016 at 11:10 am | Permalink

    I am not finding any lines with ppp in them when i run the ps command. Tried using the process numbers of all the lines that seemed even remotely similar, and I’ve had no luck. Any suggestions?

One Trackback

  • […] Long story short, after a round of questions with no answers, it was obvious I would get no information from them. So I pulled out an old Netgear DGND3700 DSL modem/router that I had and started setting it up. Our CenturyLink router was an Actiontec PK5001A and I needed the PPPoE username and password; I found a very helpful website that walks you through the steps, How to find PPPoE password for Actiontec PK5000. […]

Post a Reply to TJ Cancel reply

You must be logged in to post a comment.