July 6, 2022, 2:46 p.m.

FREE ZLT-S10G 2.11.1 (2.11.2 and 2.11.3) Full PC Openline (Unlock) Tutorial

IMPORTANT

Check out the new method for openline and admin access (requires internet connection on the ZLT S10G router): https://r1bnc.eu.org/post/81/

Offline version is now depreceated!

Disclaimer/Terms: Download only this free script on my official website, avoid getting scammed by other people who provides remote assistance for using this free script. You may request for assistance to me if you need help in using the script. Paid script is also available upon request. For resellers, piso wifi vendos do not use this free script. This is only for personal and non-commercial use only!

Beware of the following individuals that uses my script for commercial purposes WITHOUT MY AUTHORIZATION and marketing it as their own: James Villasor (aka. James Villa), Cdtrix (gzekph) & Boss Junjun and others.

How to Telnet and SSH Access

I managed to openline/unlock the ZLT-S10G (2.11.2) aka. fake 2.11.1 with the help of Backspace Discord (invite link), to simplify things. I made a userscript for enabling telnet and dropbear (SSH) that can be downloaded here: https://backspace.r1bnc.eu.org/exploit.zlts10g.user.js. If you cannot download it, use a VPN. This should work on other ZLT S10G firmware version too like 2.10.1 or 2.10.2. Test to find out! To use the script, you need to install Tampermonkey of Chrome or Firefox browser.
The Tampermonkey browser extension can be downloaded using the link below:
* For Chrome and Chromium-based browsers: https://tinyurl.com/3wryytp8
* For Firefox: https://tinyurl.com/ybed26ab

Upon clicking the user script link, a new window should pop up. Go and press “Install” when the window appears.

Look at the bottom left corner of the screen, there should be a big (“Enable Telnet” and “Enable SSH”) button, if not enter 192.168.254.254 on the address bar again.

Click the two buttons and now you can telnet/ssh to the device.

To access the telnet, download a telnet Client like puTTY or just use the built in Windows telnet client:

telnet 192.168.254.254

There is no password authentication.

To access the ssh, you can also use the built in Windows SSH client or download puTTY.

SSH username and password: admin/backspace

The IP is 192.168.254.254 and Port is 8357.

If you are using GNU/Linux, you can type this on the terminal emulator and login: ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@192.168.254.254 -p8357

How to Openline/Unlock only to SMART (Non Rocket SIM/SUN), DITO and GLOBE

These files are patched by me, do not attempt to sell these files. They are distributed for FREE!
Again, do not sell these files!

Download the files from: https://cloud.r1bnc.eu.org/s/- for the 2.11.2 version
Download the files from: https://cloud.r1bnc.eu.org/s/- for the 2.11.3 Version
The download password is: “backspace__r1bnc” remove the quotations and extra underscore

The 7zip File password is my username. Be sure to verify the file integrity before proceeding. Download a utility to check for MD5 Hash.

Checksum (File hash verification):
MD5 Hash                          File Name
55017930d0efa0ea2efaf0145613740d  S10G_2.11.2_UNLOCKING_FILES_r1bnc.7z

ce82782cb63c209919511c539e45c2b5  apply_config.conf
3ab904c006d517027b207bfe8227d2b0  at_ctl
ffe71aa4035aa2603ccc22940e3a44c7  default_parameter_sys
b0b8cd880a1b58261afc4bcbcc21629b  default_parameter_user
3e97cfde4fdde7e191a14fe1f5898ebb  README.txt

2,11,3 firmware

File checksum for 2.11.3 VERSION ONLY:

3c2df9a345c00e5837eb4ea8bffc5f88  S10G_2.11.3_UNLOCKING_FILES_r1bnc.7z
b8268efa71f51291ecc6bf45ce8b08c7  apply_config.conf
abfe3ba54b2186254824e781c58ad5e7  at_ctl
ca09128cf697b1d74876059e1c433dda  default_parameter_sys
b0b8cd880a1b58261afc4bcbcc21629b  default_parameter_user

Proceed if they match.

We need the tftpd64 binary to be able to upload and download files from the S10G device. Download it from: https://pjo2.github.io/tftpd64/

Pick the one that will be compatible with your architecture (x32/x86 or x64).

Run the tftpd64.exe as Administrator and allow it on the Windows Firewall.

Select the Interface of the LAN, or Wifi that contains the default ZLT-S10G IP of 192.168.254.X. In my case it is 192.168.254.102, this may vary.

We can now telnet to the device.

Check the firmware real version and build time, there is a trick that makes people brick their devices. Globe or Sztozed is faking the firmware version string!
By checking the file /version, we can now be sure of the real firmware version. In my case, it is 2.11.2 and build time of March 23, 2022. My files are made for this version, if yours does not match the version. DO NOT PROCEED! Chat me on my discord server to request remote assistance for FREE! Be sure to read the rules of the discord guild.

Extract the files from the archive: S10G_2.11.2_UNLOCKING_FILES_r1bnc.7z to a new folder, name it to anything. Because we will first create backup of the stock/default configuration of the router.

We will now create a backup configuration from our device.
Backup the files with these commands:

cd /yaffs
tftp -p -l apply_config.conf 192.168.254.102
cd /etc_ro/default
tftp -p -l default_parameter_sys 192.168.254.102
tftp -p -l default_parameter_user 192.168.254.102
cd /sbin
tftp -p -l at_ctl 192.168.254.102

Change the IP address (192.168.254.102) to your own IP address.

Move these backup files to another folder and extract the patched files to the current folder with the tftpd64.exe.
^ Do not forget!

We are now ready to patch the router and unlock (openline) it, option to change APN, disable TR069, band locking, enabling telnet, adb and ssh. Option to change IMEI.

Execute these commands to upload the patched files:

Disclaimer/Terms: Download only this free script on my official website, avoid getting scammed by other people who provides remote assistance for using this free script. You may request for assistance to me if you need help in using the script. Paid script is also available upon request. For resellers, piso wifi vendos do not use this free script. This is only for personal and non-commercial use only!

Beware of the following individuals that uses my script for commercial purposes WITHOUT MY AUTHORIZATION and marketing it as their own: James Villasor (aka. James Villa), Cdtrix (gzekph) & Boss Junjun and others.

cd /yaffs
tftp -g -r apply_config.conf 192.168.254.102
cd /etc_ro/default
tftp -g -r default_parameter_sys 192.168.254.102
tftp -g -r default_parameter_user 192.168.254.102
cd /sbin
killall at_ctl
tftp -g -r at_ctl 192.168.254.102
chmod 755 at_ctl

Restart the device by pressing the power button.

Power off the device and insert your preferred SIM card DITO, GLOBE (except at home prepaid), SMART (except SUN and Rocket SIM) and start it again.

The device is now unlocked to certain networks.

The username is admin and password is: backspace or vice versa if it does not work.

The same on telnet and ssh:

Telnet IP: 192.168.254.254 Port: 4719
SSH IP: 192.168.254.254 Port: 8357

To change IMEI just execute on telnet or ssh:

# at_cmd AT^MODIMEI=123456789012345

Change 12345.. to your preferred IMEI.

DISCLOSURE: By default TR069 is enabled and telemetry data is being sent on my server. You can choose to disable that by unclicking TR069 on the Advanced Settings.
The Sztozed account is still locked, I do not want to release the files yet as someone will surely make profit from this work!

I prepared a video tutorial on my Youtube channel:

https://odysee.com/@R1BNC:7/zlt-s10g-2.11.1-full-pc-openline:3

Preview video with Sztozed account access:

FULL CREDITS TO r1bnc and 1Conan of Backspace

If you find this useful, consider subscribing and liking the video. You may also opt to support me via Patreon or Liberapay.

Share the video too on your friends and make them aware that free unlocking is possible!

Donation: https://ganknow.com/r1bnc/donate

Disclaimer/Terms: Download only this free script on my official website, avoid getting scammed by other people who provides remote assistance for using this free script. You may request for assistance to me if you need help in using the script. Paid script is also available upon request. For resellers, piso wifi vendos do not use this free script. This is only for personal and non-commercial use only!

Beware of the following individuals that uses my script for commercial purposes WITHOUT MY AUTHORIZATION and marketing it as their own: James Villasor (aka. James Villa), Cdtrix (gzekph) & Boss Junjun and others.

Except where otherwise noted, this work is licensed under Creative Commons Attribution-ShareAlike 4.0 International License (http://creativecommons.org/licenses/by-sa/4.0/).