I am trying to decrypt a router configuration backup file that appears to be a combination of a 128-byte header, a PKCS #7 encrypted file, and another OpenSSL salted format encrypted file. I think the file encrypts a single data chunk in a nested way in order to hinder its decryption.
I can decrypt the first part with the following command.
dd if=file skip=128 iflag=skip_bytes | openssl smime -decrypt -inform der -in - -inkey server.key -out part1
This gives me 5550 base-64 encoded bytes, which I can then convert into a 4096 byte binary file. The distribution of byte values within the file is random: similar to that I obtain from
My initial guess is that the first part file is a (too long?) key for decrypting the second part file. Based on commands used in the router's firmware, I tried to decrypt the second part with the decrypted first part as a key, both before and after decoding it with base64.
dd if=file skip=$(grep -abo Salted__ file | cut -d: -f 1) iflag=skip_bytes | openssl enc -d -aes-256-cbc -out decrypted -pass file:part1 dd if=file skip=$(grep -abo Salted__ file | cut -d: -f 1) iflag=skip_bytes | openssl enc -d -aes-256-cbc -out decrypted -pass file:<(base64 -d <part1)
In both cases I get a
bad decrypt error, and the decrypted file appears to contain random bytes. Any other ideas on how the file could be encrypted?