1

I am trying to decrypt a router configuration backup file that appears to be a combination of a 128-byte header, a PKCS #7 encrypted file, and another OpenSSL salted format encrypted file. I think the file encrypts a single data chunk in a nested way in order to hinder its decryption.

I can decrypt the first part with the following command.

dd if=file skip=128 iflag=skip_bytes |
openssl smime -decrypt -inform der -in - -inkey server.key -out part1

This gives me 5550 base-64 encoded bytes, which I can then convert into a 4096 byte binary file. The distribution of byte values within the file is random: similar to that I obtain from openssl rand.

My initial guess is that the first part file is a (too long?) key for decrypting the second part file. Based on commands used in the router's firmware, I tried to decrypt the second part with the decrypted first part as a key, both before and after decoding it with base64.

dd if=file skip=$(grep -abo Salted__ file | cut -d: -f 1) iflag=skip_bytes |
openssl enc -d -aes-256-cbc -out decrypted -pass file:part1

dd if=file skip=$(grep -abo Salted__ file | cut -d: -f 1) iflag=skip_bytes |
openssl enc -d -aes-256-cbc -out decrypted -pass file:<(base64 -d <part1)

In both cases I get a bad decrypt error, and the decrypted file appears to contain random bytes. Any other ideas on how the file could be encrypted?

  • Can you provide more details, like what router model is this for. And can you post a sample file? – Willem Hengeveld Dec 2 '17 at 22:08
  • I hyperlinked the router in the question. I'd have to perform a factory reset in order to post a sample file, because the configuration backup contains sensitive authentication information – Diomidis Spinellis Dec 3 '17 at 9:53
  • I think the file encrypts a single data chunk in a nested way in order to hinder its decryption. - If you have access to the code that performs the encryption, it should be possible to reverse engineer this code to recover the algorithm used – julian Dec 3 '17 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.