0

Hello i need somehelp in decrypting the file config.bin generated by the page backup_setting.html from huawei B5328 router , i have access to all files in the router even the www files hosted on the www folder for the router after analyzing the page backup_setting.html and checking the javascript js files i think someone who understands the javascript and some coding language will be able to encrypt and decrypt the config file easily. the reason why i'm asking is that i want to enable telnet for this router from the webui and i think it can be done through javascript or config file restore or maybe cgi command. here is the link for all files including backup_setting.html and the whole www folder is posted here you can get the .js files etc . thanks for helping

Config file


you were correct analyzing the file maintenance.cgi gets this :

binwalk -e maintenance.cgi 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             ELF, 32-bit MSB executable, ARM, version 1 (SYSV)
67144         0x10648         Unix path: /var/tmp/update_info
68293         0x10AC5         Unix path: /var/config/ucfg_config.xml
68975         0x10D6F         Unix path: /var/config/ucfg_config.xml
71140         0x115E4         XML document, version: "1.0"
71741         0x1183D         HTML document header
71804         0x1187C         HTML document header
78624         0x13320         XML document, version: "1.0"
81900         0x13FEC         PEM RSA private key

now how to extract the private key and make use of it?

after some analyzing to the bin it seems it will be decrypted into a file called ucfg_config.xml which it has already a copy of it in the system directory . in the beginning of the file we see :

<UCFG>
<VerDTD>1.0</VerDTD>
<product>GCT</product>
<version>201509041858</version>
<pesi>
    <debugon>0</debugon>
    <security_token>0</security_token>
    <led_ctl_flg>9</led_ctl_flg>
    <RUN_ODUMD>1</RUN_ODUMD>
    <RUN_TELNETD>1</RUN_TELNETD>
    <log_level>1</log_level>
    <hw_ver></hw_ver>
    <bcupgd_flg>0</bcupgd_flg>
    <ltedm_enable>0</ltedm_enable>
    <WEB_LANG>en.xml</WEB_LANG>
    <cm_config>
        <cm_dbg>0</cm_dbg>

there is this value in the file RUN_TELNETD>1

link to file ecfg_factory

https://www.mediafire.com/file/vemfvqjgjcnvcp8/ucfg_factory.xml/file

now assuming i have the decrypted config file if i encrypt this file into config.bin file i think it should work . can someone help into decrypting or encrypting the file in the correct format ? thanks

analyzing a piece of code of maintenace.cgi gives the encrypt and decrypt cmd used :

 No Command [WebUpd]%s, recive file error case Parameters Abnormal.  [WebUpd]%s, Exit: %d  [WebUpd]----------------------------------------  main  write_file_form_encoded TR069_import  TR069_import  import_finish  file_check check_rsa_digest  [%02d-%02d-%02d %02d:%02d:%02d:%03ld]  ' >> /dev/console  echo '                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             [pbi] Failed to create key BIO [pbi] Failed to create RSA open file error
  ----------------do decrypt file parse---------------
  ----------------do encrypt file ----------------
  %s ERROR: %s
  Public Encrypt failed  Encrypted length =%d
  Private Decrypt failed  Decrypted Text =%s
 Decrypted Length =%d
  Hello this is PBI RSA test                                                                                                                   [bpi] caculate_sha_digest
 %02x  [bpi] get_sha_digest_in_image data_size=%d, privateKey size=%d
 [bpi] check_sha_digest
 caculate_sha_digest results
  0x 
  public_encrypt
 image_buf_len =%d
 [pbi] get_sha_digest_in_image fail
 img_sha =%d
  cal_sha =%d
  [pbi] image SHA256 digest is wrong
 [pbi] image SHA256 digest MATCH !!!
  [%02d-%02d-%02d %02d:%02d:%02d:%03ld]  ' >> /dev/console  echo '                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             ;    %02hhx delitem_1 = %s
 del_count =  %d
  ,  00 parment of index is wrong  <%s>  Error  Invalid index number.  </%s>
 wrong parment of del_count! [deleteNthValueMultiWithDataCheck]value:[%s],rulsCount = %d count = %d the index of content max than ruls count  the contexts are diff  11  the index is valied the contexts are diff  22  the contexts are diff  33  what about the value rec is:%s ,hashcode is :%s , and data->hashcode is:%s
 %s ;%s [utils] i=%d,rec=%s
  [utils] num=%d
 [utils_FilterReplaceOperation] i=%d,num=%d
 br0 [utils] getLanInfoList
 /proc/net/arp  r  %19s  %hhu.%hhu.%hhu.%hhu %hhx:%hhx:%hhx:%hhx:%hhx:%hhx  0x%x  [utils] get_arp_flags arp_flags = %d
  [utils] lan_info_count %d
  stat_info...  
  :  [util] getWlanMacList
 /proc/wlan0/sta_info      hwaddr [util] get wlan MAC %s 
  The public port "%d" is used with TCP and UDP, please use another one. The public port "%d"-"%d" is used with TCP and UDP, please use another one. The public port "%d" is used with TCP, please use another one. The public port "%d"-"%d" is used with TCP, please use another one. The public port "%d" is used with UDP, please use another one. The public port "%d"-"%d" is used with UDP, please use another one. The public port is used, please use another.  (%d)(%s)(%s)... utils.cgi.c i: %d, ignoredIdx: %d  sFromPort1: %s, sToPort1: %s, sProtocol1: %s  sFromPort: %s, sToPort: %s, sProtocol: %s  iFromPort1: %d, iToPort1: %d, Protocol1: %d TCP UDP TCP_UDP iFromPort: %d, iToPort: %d, Protocol: %d  check webs_isPublicPortUsed 1  check webs_isPublicPortUsed 2  check webs_isPublicPortUsed 3  check webs_isPublicPortUsed 4  session_stok  sess_stok  [www]cgi getSessinStok ok  RoamSetting AttachSetting  AttachManual  DeatchManual  PDNcfgSetting  DataManualConnect  SetSelectMode  SetPlmnId  SetFotaUrl JoinWps Check  DiagnosticCmd  \B2 \B2 \B2, \B2< \B2L \B2\ \B2p \B2\80 \B2\8C \B2\98 \B2\A0 \B2\A8[www]cgi_response_sess_stok ok Content-type: text/xml

also in rsa.js file public key is displayed :

encrypt: function($data, $pubkey) {
        if (!$pubkey) return false;
        var bytes = ($pubkey.modulus.bitLength()+7)>>3;
        $data = this.pkcs1pad2($data,bytes);
        if(!$data) return false;
        $data = $data.modPowInt($pubkey.encryptionExponent, $pubkey.modulus);
        if(!$data) return false;
        $data = $data.toString(16);
        while ($data.length < bytes*2)
            $data = '0' + $data;
        return Base64.encode(Hex.decode($data));
    },
    encryptByDefaultKey: function($data, ispost){
        var pem = "-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwWWFhP5QimWzLjruWuHbU3FKnNnLC2wiYjgTyDEz8fEqYrJQ9bJbT7jkKc/3IknhpGfHwYqW4+ryfF9E8fmZFjfc4QuIiJdlKCg1xwNzFnXNovdDq6fEpykJ/w6fkkjZNyoKXxghzsjBQ3+9jVdT5ALcf4hwLTsU0HM/mnDMuJwIDAQAB-----END PUBLIC KEY-----";
        if(USE_2048_BIT){
        pem= "-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt9rDGWk8g5W+6XR+QC+JFim58MSm4nkjhlTfxXISq0ZKge+Nl7TfAOB5EBFELdRonjWqb1xce9OdBgHv4pMqHlhMpBG82s9dPDGG7FCdavCLqF7PMY/mEN+jU8FMug/upkou1Nt0ymdZdMMQfiUkwTb/b1h6mzRpyMn3h7qMUkYunwW3q2gB50pza3fHj+MK5G3AU1bLkpo6359I5HlJt+gCVtpv+BYHy5yI0IsYCL2sN3bWKDPgTsfMq1zmUStJti4d8RHdjrv3ToUFZm14lfTk31aZa0M7XUztTuoVDSGl5jH3IogDP8ABZAZSqjDIlpLIichHCAnMkAMQGjxVYwIDAQAB-----END PUBLIC KEY-----";
1

Unfortunately, knowledge of JS probably isn't going to help. The HTML passes along the uploaded file to the cgi-bin/maintenance.cgi file which is a compiled ARM BE8 binary that's a bit more work to analyze than just looking at some javascript.

After a very brief look, there is an RSA public/private key pair embedded in the binary that might be useful for extracting the contents of the config.

That said, I'm not sure that decrypting the config will necessarily get you what you want. You might actually have everything you need already. For example, there's a ton of calls to system inside those files. There's a decent chance that you could use one of those to get command-injection on the router to enable a terminal that way.

And even that might actually be overkill if the router itself listens on telnet as a part of its bootup process which is fairly common.

Finally, there appears to be a telnet enabled config you can load from the backup_setting.html page as there is a snippet there that references a config with telnet in the name. In fact, that's the only mention of telnet in all the files, so there's not likely some default intended way to enable it via the built in binaries.

        if(filename.match("(.*)telnet(.*).bin") == null){
            AlertBlock('The router will restart after you restore it to the backup settings.Are you sure you want to import the config?','preConfigImport()','refreshpage()');
  • thanks for your reply . another alternative would be that one can passes the config file directly to the file cgi-bin/maintenance.cgi and make a script that would send the ouput of the decrypted file to export or change in the html or javascript to export the file decrypted using the same cgi file ... the reason would be to get the correct parameter to set to be able to enable the telnet through the config file because i have another router which webui does not work but have telnet open it's stuck in debug mode – coolirc Aug 6 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.