≡ Menu

Enable Telnet Access For Netgear Wireless Router DGND3700 [ N600 ]

Neggear DGND3700 is an all-in-one router with built-in ADSL2+ modem and WAN gigabit Ethernet port for cable/fiber combined with a wireless router create the integrated home gateway. How do I enable telnet access on this router under Linux or OS X operating systems?

Tutorial details
Root privilegesYes
RequirementsNetgear DGND3700/N600 router

This router ( NETGEAR N600 ) is wireless dual band gigabit ADSL2+ modem router. It offers concurrent dual band technology, as well as wireless access from your computer to USB printers. However, telnet access is locked down by default. You can enable it easily as follows.

Find out information about open port

My router has ip address. Open a terminal and type the following command to see all open ports:
$ nmap
Sample outputs:

Starting Nmap 5.00 ( http://nmap.org ) at 2012-08-11 16:17 IST
Interesting ports on
Not shown: 997 closed ports
23/tcp open  telnet
53/tcp open  domain
80/tcp open  http
Nmap done: 1 IP address (1 host up) scanned in 0.70 second

Try connecting using telnet, run:
$ telnet
Sample outputs:

Connected to
Escape character is '^]'.

You will not able to access telnet as it is locked down by vendor.

Say hello to telnetenable.py

Netgear provides a developer tool for unlocking the console access from a Windows client. However, Unix / Linux user can use python script to sends the router magic packets to enable the telnet interface. You can download program by visiting this url:

Install python-crypto

First, you need to install python-crypto package which provides cryptographic algorithms and protocols for Python. Type the following command under Debian / Ubuntu Linux, enter:
# apt-get install python-crypto
Type the following command to grab telnetenable.py using wget command, enter:
$ wget http://netgear-telnetenable.googlecode.com/files/netgear-telnetenable-0.1.zip
Sample outputs:

--2012-08-11 16:34:37--  http://netgear-telnetenable.googlecode.com/files/netgear-telnetenable-0.1.zip
Resolving nas02...
Connecting to nas02||:3128... connected.
Proxy request sent, awaiting response... 200 OK
Length: 2323 (2.3K) [application/x-zip]
Saving to: `netgear-telnetenable-0.1.zip'

100%[==========================================================>] 2,323       --.-K/s   in 0s      

2012-08-11 16:34:37 (156 MB/s) - `netgear-telnetenable-0.1.zip' saved [2323/2323]

To unzip netgear-telnetenable-0.1.zip, enter:
$ unzip netgear-telnetenable-0.1.zip

How do I use telnetenable.py?

The syntax is:

python telnetenable.py $(/usr/sbin/arp -n | awk "/"'  { gsub(/:/, "", $3); print toupper($3)}') Gearguy Geardog

Sample outputs:

Sent telnet enable payload to ''

Make sure you replace the router IP with your actual IP address.

Test it

Type the following command to access router via telnet:
$ telnet
Sample outputs:

Connected to
Escape character is '^]'.
BusyBox v1.00 (2011.10.21-00:18+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
WARNING! These examples may crash your router if not executed with proper care.

To see information about your router type:
# routerinfo
Sample outputs:

Release version : Netgear Wireless Router DGND3700
           Time : Oct 21 2011 08:07:44
    CFE version : N/A
WSC PIN - 52135095
LAN mac address - 7444014057FB
WAN mac address - 7444014057FC
WLAN mac address - 7444014057FB
serial number - 2XXXXXXXXXYZ

To see CPU info, enter:
# cat /proc/cpuinfo
Sample outputs:

system type             : 96368MVWG
processor               : 0
cpu model               : BMIPS 4350 V3.1
BogoMIPS                : 398.95
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
ASEs implemented        :
VCED exceptions         : not available
VCEI exceptions         : not available

unaligned exceptions            : 21822527
Share this tutorial on:

Your support makes a big difference:
I have a small favor to ask. More people are reading the nixCraft. Many of you block advertising which is your right, and advertising revenues are not sufficient to cover my operating costs. So you can see why I need to ask for your help. The nixCraft, takes a lot of my time and hard work to produce. If you use nixCraft, who likes it, helps me with donations:
Become a Supporter →    Make a contribution via Paypal/Bitcoin →   

Don't Miss Any Linux and Unix Tips

Get nixCraft in your inbox. It's free:

{ 3 comments… add one }
  • Fabio January 5, 2016, 7:53 am

    I have two devices with* ip, is the router and is a nas, i don’t know the reason why but your script detect both of them and feed the wrong MAC to telnetenable.py. I don’t know how to debug it so i can’t help you, i resolved manually giving the correct MAC.
    Sorry about my broken english.
    Thank you very much.

  • Adam S January 14, 2016, 10:00 pm

    Just wanted to say thank you for this great guide. Id tried everything. THIS, actually got it working! Thank you!!

  • Koen February 10, 2016, 9:17 pm

    thanks, finally after a downgrade of the firmware (WGR614v9) I got in.

    first output;

    Starting Nmap 6.40 ( http://nmap.org ) at 2016-02-10 22:08 CET
    Nmap scan report for
    Host is up (0.0058s latency).
    Not shown: 996 closed ports
    23/tcp open telnet
    53/tcp open domain
    80/tcp open http
    5000/tcp open upnp

    but when I;

    Connected to
    Escape character is ‘^]’.

    I don ‘t come further than this???
    I ‘m not reaching shell
    Please could You help?

    regards, Koen.

Security: Are you a robot or human?

Leave a Comment

You can use these HTML tags and attributes: <strong> <em> <pre> <code> <a href="" title="">

   Tagged with: , , , ,