Decrypt config.bin file from Huawei B5328 router. I have source files

Question

I need some help in decrypting the file config.bin generated by the page backup_setting.html from Huawei B5328 router.

I have access to all files in the router, even the www files hosted on the www folder for the router. After analyzing the page backup_setting.html and checking the JavaScript .js files, I think someone who understands the JavaScript and some coding language will be able to encrypt and decrypt the config file easily.

The reason why I'm asking is that I want to enable telnet for this router from the WebUI, and I think it can be done through JavaScript or config file restore or maybe CGI command.

Here is the link for all files including backup_setting.html and the whole www folder is posted [here][1], you can get the .js files etc.

Thanks for helping.

---

You were correct, analyzing the file maintenance.cgi gets this :

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             ELF, 32-bit MSB executable, ARM, version 1 (SYSV)
67144         0x10648         Unix path: /var/tmp/update_info
68293         0x10AC5         Unix path: /var/config/ucfg_config.xml
68975         0x10D6F         Unix path: /var/config/ucfg_config.xml
71140         0x115E4         XML document, version: "1.0"
71741         0x1183D         HTML document header
71804         0x1187C         HTML document header
78624         0x13320         XML document, version: "1.0"
81900         0x13FEC         PEM RSA private key

Now, assuming I have the decrypted config file, if I encrypt this file into config.bin file, I think it should work.

Can someone help into decrypting or encrypting the file in the correct format? Thanks.

Analyzing a piece of code of maintenace.cgi gives the encrypt and decrypt cmd used :

 No Command [WebUpd]%s, recive file error case Parameters Abnormal.  [WebUpd]%s, Exit: %d  [WebUpd]----------------------------------------  main  write_file_form_encoded TR069_import  TR069_import  import_finish  file_check check_rsa_digest  [%02d-%02d-%02d %02d:%02d:%02d:%03ld]  ' >> /dev/console  echo '                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             [pbi] Failed to create key BIO [pbi] Failed to create RSA open file error
  ----------------do decrypt file parse---------------
  ----------------do encrypt file ----------------
  %s ERROR: %s
  Public Encrypt failed  Encrypted length =%d
  Private Decrypt failed  Decrypted Text =%s
 Decrypted Length =%d
  Hello this is PBI RSA test                                                                                                                   [bpi] caculate_sha_digest
 %02x  [bpi] get_sha_digest_in_image data_size=%d, privateKey size=%d
 [bpi] check_sha_digest
 caculate_sha_digest results
  0x 
  public_encrypt
 image_buf_len =%d
 [pbi] get_sha_digest_in_image fail
 img_sha =%d
  cal_sha =%d
  [pbi] image SHA256 digest is wrong
 [pbi] image SHA256 digest MATCH !!!
  [%02d-%02d-%02d %02d:%02d:%02d:%03ld]  ' >> /dev/console  echo '                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             ;    %02hhx delitem_1 = %s
 del_count =  %d
  ,  00 parment of index is wrong  <%s>  Error  Invalid index number.  </%s>
 wrong parment of del_count! [deleteNthValueMultiWithDataCheck]value:[%s],rulsCount = %d count = %d the index of content max than ruls count  the contexts are diff  11  the index is valied the contexts are diff  22  the contexts are diff  33  what about the value rec is:%s ,hashcode is :%s , and data->hashcode is:%s
 %s ;%s [utils] i=%d,rec=%s
  [utils] num=%d
 [utils_FilterReplaceOperation] i=%d,num=%d
 br0 [utils] getLanInfoList
 /proc/net/arp  r  %19s  %hhu.%hhu.%hhu.%hhu %hhx:%hhx:%hhx:%hhx:%hhx:%hhx  0x%x  [utils] get_arp_flags arp_flags = %d
  [utils] lan_info_count %d
  stat_info...  
  :  [util] getWlanMacList
 /proc/wlan0/sta_info      hwaddr [util] get wlan MAC %s 
  The public port "%d" is used with TCP and UDP, please use another one. The public port "%d"-"%d" is used with TCP and UDP, please use another one. The public port "%d" is used with TCP, please use another one. The public port "%d"-"%d" is used with TCP, please use another one. The public port "%d" is used with UDP, please use another one. The public port "%d"-"%d" is used with UDP, please use another one. The public port is used, please use another.  (%d)(%s)(%s)... utils.cgi.c i: %d, ignoredIdx: %d  sFromPort1: %s, sToPort1: %s, sProtocol1: %s  sFromPort: %s, sToPort: %s, sProtocol: %s  iFromPort1: %d, iToPort1: %d, Protocol1: %d TCP UDP TCP_UDP iFromPort: %d, iToPort: %d, Protocol: %d  check webs_isPublicPortUsed 1  check webs_isPublicPortUsed 2  check webs_isPublicPortUsed 3  check webs_isPublicPortUsed 4  session_stok  sess_stok  [www]cgi getSessinStok ok  RoamSetting AttachSetting  AttachManual  DeatchManual  PDNcfgSetting  DataManualConnect  SetSelectMode  SetPlmnId  SetFotaUrl JoinWps Check  DiagnosticCmd  \B2 \B2 \B2, \B2< \B2L \B2\ \B2p \B2\80 \B2\8C \B2\98 \B2\A0 \B2\A8[www]cgi_response_sess_stok ok Content-type: text/xml

Also in rsa.js file public key is displayed :

encrypt: function($data, $pubkey) {
        if (!$pubkey) return false;
        var bytes = ($pubkey.modulus.bitLength()+7)>>3;
        $data = this.pkcs1pad2($data,bytes);
        if(!$data) return false;
        $data = $data.modPowInt($pubkey.encryptionExponent, $pubkey.modulus);
        if(!$data) return false;
        $data = $data.toString(16);
        while ($data.length < bytes*2)
            $data = '0' + $data;
        return Base64.encode(Hex.decode($data));
    },
    encryptByDefaultKey: function($data, ispost){

Answer 1

Unfortunately, knowledge of JS probably isn't going to help. The HTML passes along the uploaded file to the cgi-bin/maintenance.cgi file which is a compiled ARM BE8 binary that's a bit more work to analyze than just looking at some javascript.

After a very brief look, there is an RSA public/private key pair embedded in the binary that might be useful for extracting the contents of the config.

That said, I'm not sure that decrypting the config will necessarily get you what you want. You might actually have everything you need already. For example, there's a ton of calls to system inside those files. There's a decent chance that you could use one of those to get command-injection on the router to enable a terminal that way.

And even that might actually be overkill if the router itself listens on telnet as a part of its bootup process which is fairly common.

Finally, there appears to be a telnet enabled config you can load from the backup_setting.html page as there is a snippet there that references a config with telnet in the name. In fact, that's the only mention of telnet in all the files, so there's not likely some default intended way to enable it via the built in binaries.

        if(filename.match("(.*)telnet(.*).bin") == null){
            AlertBlock('The router will restart after you restore it to the backup settings.Are you sure you want to import the config?','preConfigImport()','refreshpage()');