Sky D-Link DSL-2640S Router Password Extractor

This application will only work on the D-link router provided by Sky, and is quite likely to stop working in future versions of the firmware.

Passwords for other sky routers can be obtained from here.

Please be aware that using a router, other than the one provided to you by Sky is in breach of Sky's Terms and Conditions.

If you decide to use a non-sky router, please do not ask Sky customer services to assist in configuring it, and do not dispose of the one they supplied, as Sky do not provide support to customers using non-sky routers. If you need any help, I'd recommend the public forums at www.ispreview.co.uk and skyuser.co.uk

Your use of this app, and the information it provides, is entirely at your own risk!

You can download it from here Authenticity.jar version 1.6 The front end is written in Java. I've tested it on Windows XP, a live Linux CD and I'm told it will work on Macs.

If you don't have Java installed, it can be downloaded from here:- Java Downloads for All Operating Systems.

To extract the password, the router must have an ADSL sync - (doesn't have to be a sky connection). If it fails to extract the password, but reports the adsl stats ok, then it is probably being blocked by your PC's firewall. If the router is blocked by a firewall (Windows Firewall seems to be a common culprit), its user interface will stop responding until the blocked request times out (about 2 minutes). Temporarily set the firewall running on your PC to allow inbound access on port 8888, or disable it while you extract your password. Then, once the router's UI starts responding again, my app should work ok. You should remove the firewall rule once you've extracted the password, it is not required to access your detailed stats.

V1.1 I've added an option to change the port it uses (you can ignore this, unless you run a server on port 8888), improved the error reporting, and fixed a minor bug.

V1.3 Partially fixed a problem with it selecting the wrong network device, on some PCs, made the local IP address configurable in case it still picks the wrong one.

V1.4 Reconstructed the source from backups after a hardware failure, fixed a few bugs, and got the spinny busy indicator working.

V1.5 Added an option for those that want to tweak the snr margin (or execute any shell command) - enable "advanced" in the options menu to use it, but if you've just joined, then do not fiddle with the snr margin before the 10 day DLM process is over as it will affect the DLM process, and likely result in your connection speed being limited below what you're line is capable of. It will now also check the current directory for utelnetd and enable the Telnet button if it is found. If you need telnet access a suitable daemon can be found here http://rapidshare.com/files/428158541/utelnetd

V1.6 Improved the noise margin tweaking options. Note that the noise margin dB adjustments shown on the slider are only approximate, and adjustments of more than -6db might not work with this router's xdslctl command.[source]

 33 comments: 

dig412 said...

Fantastic work! Thanks so much for building this. I've got a couple of notes: This tool binds to local port 80, if you're running a web server (Apache, IIS, etc), you'll get this error: java.net.BindException: Address already in use: bind Just disable your server whilst you run the tool! I couldn't get this to run on my Win7 x64 machine, even with the firewall disabled I got timeout errors. However, it ran perfectly on an old WinXP machine. I'm not sure if this is a common problem, or if my machine just has some strange configuration. Hope this helps someone else with these issues!

17 October 2010 15:01

dig412 said...

I've found the cause of the 2nd issue: My PC has multiple network adaptors, and the program bound to the wrong one. I.e. the router was connected to: Belkin 54g Wireless on 192.168.0.2 but the tool bound to: VMWare Virtual Network on 192.168.253.1 To get past this, disable all network adaptors except the one the router is connected to!

17 October 2010 15:46

Adam said...

Doesnt work on linux, Exception in thread "main" java.lang.NoClassDefFoundError: Authenticity/jar Caused by: java.lang.ClassNotFoundException: Authenticity.jar at java.net.URLClassLoader$1.run(URLClassLoader.java:217) at java.security.AccessController.doPrivileged(Native Method) at java.net.URLClassLoader.findClass(URLClassLoader.java:205) at java.lang.ClassLoader.loadClass(ClassLoader.java:321) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:294) at java.lang.ClassLoader.loadClass(ClassLoader.java:266) Could not find the main class: Authenticity.jar. Program will exit. Could you please tell us how you start the telnet daemon.

18 October 2010 18:18

Mel said...

"Doesnt work on linux," Sorry, I'm currently suffering from a lousy cold, and only just found enough time to test it on Linux. I had to dig up an old Live CD, as I've recently deleted my linux partition, to make a bit of space. It ran ok for me, when I launched it from a shell, with the "java -jar " option. I got telnet running by hacking my own daemon onto the router.

18 October 2010 23:23

Mel said...

dig412, Thank's very much for your very helpful comments. I've now added an option to select another port other than the default port 80, and it should now bind to an adaptor, based on the IP shown in the "Local Address" field , which I've made editable in case it selects the wrong one.

18 October 2010 23:56

Gavin said...

Huge thanks. It works like a charm. :-D

19 October 2010 09:27

Darfyddi said...

I am a complete noob to this, new sky router doubling my ping and want to go back to belkin N1 Can anyone explain if this Authenticity_v1.41 gives me the password or just ** and how do I use it? Sorry to be a pain. Darf

24 October 2010 21:56

Mel said...

"gives me the password or just **" That's odd, can you tell me the router's firmware version, shown on the status page when you log into the router's user interface. Had my program worked correctly, the password it extracts should be 15 characters, and the username should be the router's LAN Port MAC address (in lower case)@skydsl.

25 October 2010 00:16

thar said...

I took Darfyddi's comment to mean, do you get the actual password or just asterisks...I could be wrong though :? Will be testing it out myself later. Thanks for going to the trouble :)

25 October 2010 18:34

Mel said...

Ah! I think you're right - I guess I've had too many late night recently :o, sorry Darfyddi Yeah, it extracts the actual password and user name from the sky dlink router. Providing you've got Sun Java (JRE) installed, my application will run by double clicking its icon - there's no install.

25 October 2010 21:09

Darfyddi said...

As what thar said, I am a little nervous to try this as I am not sure what I am doing. Being a .jar programme has thrown me a bit too but I will look later or tomorrow.

25 October 2010 21:10

thar said...

@Darfyddi - I didn't have Java when I first downloaded the program so was a little confused as to what I had to do...my fault...but once I downloaded it, it was just a case of syncing the Sky router and double-clicking the app icon as Mel has said. The app is very easy to use, it's just a case of clicking on Get ADSL password as in the screengrab. Thanks again Mel, it worked a treat!

26 October 2010 20:02

Darfyddi said...

hi, thanks all. I had java for something a while ago so I just turned off the firewall and dbl clicked it. It seemed to give me something so hopefully that will work. I will try my belkin friday to see what happens :) Thank you.

26 October 2010 20:56

Mel said...

The higher ping is probably more to do with sky using interleaving, than Sky's somewhat indifferent router. If you want a lower ping for gaming, then I think you'll need to contact Sky's support, to get the interleave depth reduced. Doing so will probably also result in a slightly lower sync speed, as interleaving is used to improve error correction.

27 October 2010 15:24

Adam said...

Will you be enabling the telnet button?

28 October 2010 00:59

Mel said...

I had intended to make it, so that you can add a suitable telnet daemon and get it working, as I'm not sure if including an open source one would infringe the gnu licence, and most people wouldn't want it anyway. The built in one would only display blanks when I tried it, and didn't execute anything, possibly because the login app is missing. If you need telnet access, I'll create a version when I get a few minutes, so you'll just have to stick a telnet daemon in the same directory as the program. What are planning to do with it anyway?

28 October 2010 19:58

Adam said...

I would like to manipulate the xdslctl, I cant do it via the ping hack properly, I would eventually like to pull the firmware and modify it, if you could create a workable telnet that would be great.

28 October 2010 20:23

Mel said...

I decided to make it as a command line option in the end. "java -jar Authenticity_v*.jar utelnetd" assuming utelnetd is in the current directory. Alternatively, adding a copy of utelnetd into my jar file's "myroot" should also enable the telnet button. You'll need a copy of utelnetd that doesn't run login. I modified one off another router for my original hack, but one from a DG834GT would be ideal - If you download the latest dg834gt source from Netgear's website, and extract the "target.tar.bz2", there should be a pre-compiled utelnetd in there. If not, let me know, and I'll dig one up. http://rapidshare.com/files/427792818/Authenticity_v1.42.jar You'll need to connect on port 22 with you telnet client, rather than the default. If you think it would be worth adding some xdslctl "tweaking" options to my app, let me know, and I may consider it.

29 October 2010 14:56

Adam said...

This has worked great thanks, I'm now synced at, Channel: INTR, Upstream rate = 928 Kbps, Downstream rate = 8160 Kbps Before I was at 6500 down 400kbps up, I used adslctl configure --mod d --snr 1.

31 October 2010 15:48

Mel said...

That's quite some improvement, providing your connection remains stable. --mod d forces it to connect using G.Dmt, does it not? I've just been adding a new option to inject any shell command.

31 October 2010 17:11

Mitch said...

Hi, I'm very keen to try this out, but Rapidshare is telling me that the free link has had too many downloads. If it is available anywhere else I'd love to know where I could get it from! Cheers, Mitch.

2 November 2010 17:33

Mel said...

I'm afraid that message comes up when rapidshare's free download slots are all full, the download link is working again at the moment though. Unfortunately I don't have my own web server to host it on.

2 November 2010 20:08

Adam said...

I believe it is supposed to be G.DMT however I have synced at 8700 / 1100 on this mode so I'm not totally sure, the idea of injecting shell commands is a great idea :)

3 November 2010 04:46

Mitch said...

Quite right, and I have since downloaded it and run it successfully, I shall now be using my Belkin N1 vision exclusively and showing my love for you with cold hard cash into your paypal account. Thank you!

3 November 2010 12:52

Rent said...

Hi I tried running this .jar tool and get an error saying firewall blocking . Added port 8888 stil shows the same error. Can anyone suggest a way to get in please to get the password.

10 November 2010 20:12

Mel said...

I take it you waited for the router's web interface to start responding again after you enabled inbound access on port 8888. If your firewall has an option to block access to servers running on your PC make sure it is set not to do so. Also make sure that the "Local Address" reported in my program, is the IP assigned to your PC by the sky dlink router, and if not, correct it. Other than that, I'd suggest asking for help on skyuser.co.uk, or if you have a copy of a live Linux CD, you could try booting into Linux and running it from there.

11 November 2010 16:15

battery said...

This looks pretty damn awesome, I'm trying to now edit the block_info.html file through telnet but keep getting told it's a read only filesystem. I wouldn't mind totally outing the file itself so it just shows some error page and no obvious signs that the website has been blocked. Any ideas? Thanks

28 November 2010 16:19

Mel said...

To change that file, you'd have to extract the firmware off the router, modify the file, then write it back to the router's flash memory. As a workaround, you could try doing something to temporarily disable the router's http server, which should stop it displaying the blocked site page, although it will of course also disable the router's UI until it is rebooted. If you enable "advanced" in my program so that you can enter a shell command, and execute "telnetd", that would probably cause the http server to stop responding until the router is rebooted.

30 November 2010 20:26

Hicksdesign said...

Fantastic - worked like a dream on Mac OS X 10.6. Now up and running with a decent router. Thanks - Paypal dosh on the way!

30 November 2010 21:27

Richard said...

So just to double check, this literally grabs the password which is hidden and doesn't affect the router at all. I am needing to change to a Vigor or Billion for Hardware VPN but also don't really want to cause problems with the sky router if I ever stop using the alternative router I can go back to the sky one.

16 December 2010 16:56

Mel said...

Extracting the password doesn't make any permanent changes to the router. It just uses a rather complicated hack to inject a small script and a C program into the router's ram, which can then obtain the authentication details. The script removes itself and the program from the router's memory after it's finished, although rebooting the router would remove them anyway. I've tested it extensively myself, and it has been downloaded over 1,500 times, so it should be ok. You could do some harm, if you enable the telnet or advanced option which gives you root access, and type in the correct command line to flash the router, but you're not likely to do that by accident.

19 December 2010 04:09

Richard said...

This worked straight away, thanks so much what a great tool!

21 December 2010 10:10

Neil said...

What a hero, this worked a treat and no issues whatsoever. PayPal payment will be sent shortly. Cheers Neil

7 January 2011 17:54