After a lot of digging I found out where the SMS messages are stored on the Yeastar TG series.
They're in a sqlite database that can be found at /persistent/var/lib/asterisk/db/MyPBX.sqlite, in the smsrecv table.
The SMS API is incredibly poorly documented. Even if you can get it working it still doesn't provide a way to get messages that arrived while there was no active TCP connection. Effectively there is no way to just read the inbox.
The system runs BusyBox, so available packages are very limited and are outdated on top of that. After a lot of trial and error and back and forth with ChatGPT, I managed to create a script that will run on the TG device and do the following at your desired interval:
- Get all unread messages from the sqlite db
- Add them in a temporary sqlite db
- gzip and base64 encode that temporary database
- Do an HTTP GET request to whatever URL you want with that base64 string as payload
- If the request was successful, update all records in the main database to "read"
On the other end a webhook can live and then take the payload, decode and unzip the database and just process the records in whatever way is needed. I personally have a n8n flow that does this for example.
The script will always execute the HTTP call, whether there is data or not. It doubles as a sort of heartbeat mechanism to be able to monitor if the script is still running.
Setting up the scripts on the TG device requires the following steps:
- Get the
add.sh,loop.shandprocess_texts.shscripts from this gist - Edit
process_texts.shto configure your webhook URL - Edit
add.shif you want to change the interval at which the script runs (it's set to 10 seconds by default) - Enable FTP in the UI if it isn't yet
- Upload the
loop.shandprocess_texts.shscripts to the/persistent/scriptfolder - Upload the
add.shscript to the/persistentfolder - Reboot the device
You can check if the script is running by:
- Enabling SSH in the UI
- Connecting to the terminal of the device
- Running this command:
ps aux | grep loop.sh - There should be an entry along the lines of
xxxx root 0:00 /bin/sh /persistent/script/loop.sh /persistent/script/process_texts.sh 10
Disclaimer: this works on my device. The scripts are provided as-is with no guarantees. Use them at your own risk.
@ownerer
Thank you for your reply!
I tried that password also, but didn't work neither did anything i could find on the internet, I even seduced and deceived ChatGPT to any possible extent; went down some rabbit holes, but couldn't possibly find the password. I then came to the conclusion That Yeastar must have done this intentionally. Because i had and older TG200 (with older firmware) where it worked just perfect! but on the newer one it didn't
the password they gave (in the screenshot i shared earlier) was for a user named support( and they don't even tell you that either! damn!). and that user account is basically useless everything is read-only and you barely have access to any important directory. so i understood.
The best i could get:
After much digging and going from rabbit holes to the next one, i found a CVE affecting my firmware where you could manage to get the /etc/passwd file in which there are hashes including the one for root password. and chatGPT suprisingly helped me find ways to decrypt it using some hackying tools with dictionnaries ( i might have gone hard on the deception here ๐ ) but unfortenately i couldn't decrupt it with any of the tools. so i was just left with the hash. Bruteforcing this will take so much time i didn't even try.
Oh yeah the GPT also suggested me to dismantle the device and connect to the UART port, that he was going to show me the pins connections and everthing and i would boot into a certain mode where i'll do some stuff.... and i just say no right away! ๐
That's so sad. maybe in the future when i feel confident enough i'll try that.
Thanks again!