Reverse Engineering ZyXel C1100Z modem firmware

Question

first time post so please bear with me.

For days I have been trying to bypass a password my ISP has added to their remote CLI with no luck.

I have a Zyxel C1100Z DSL modem that I've purchased from my ISP and I have been trying to breakdown their newest firmware in order to bypass a new shell password feature they've implemented. The past firmware did not have this feature and simply allowed you to login via ssh/telnet and then type 'sh' to drop into a simple Busybox shell.

Now with the latest firmware, SSH seems to be severely broken/buggy, as does most of the CLI commands when you login over telnet (Cat,echo,netstat,etc.. do not function)

Since this is a new feature, I have guessed that the password is either

1. Hard-coded into a CLI binary
2. Pulled from a configuration I have overlooked
3. Pushed remotely from the ISP

So far I have extracted the root-fs using binwalk and I've scoured many hours through each configuration, running strings to no end, I even tried to emulate MIPS using QEMU.

Running file on one of the binaries gives me: ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, corrupted section header size

I installed the old firmware hoping to get an idea of how the system worked and thought some of this info might prove useful:

system type             : 963168MBV_17A
processor               : 0
cpu model               : Broadcom4350 V8.0
BogoMIPS                : 398.33
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
ASEs implemented        :
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available
unaligned exceptions            : 60561

I've begun decompiling binaries using https://retdec.com/decompilation/ but that has't gotten me very far.

I have hosted the extracted firmware root in a git repo at https://github.com/bwbryant1/CTL_C110Z

I'm not asking for someone to do all of the work for me, mostly just some guidance as this is my first-attempt at reverse-engineering. Yes I have looked at past tutorials but none of the fit my firmware specifically and I have hit a brick wall.

How does one add a password to a shell? I know you can with inittab but it doesn't seem like that is what they are doing. I have no idea where the shell password prompt gets called from but I do know the text for it is stored inside /lib/private/libcms_cli.so. But I am not sure what this is.

Thank you

Edit for clarification: I have ssh and telnet access but they do not give you access to the root-fs. It drops you into a kind of chrooted environment with limited capabilities. However, by typing "sh" you are prompted with "Please type in shell password:" and it doesn't ask for a username, only a pass

Answer 1

The password seems to be generated dynamically from /etc/profile

...
# generate login files
echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd
echo "root::0:root,supervisor,support,user" > /var/group
...

You would need to try to crack the DES hash with a program like John the Ripper or replace it with another known password or nothing.