I need some help in decrypting the file config.bin
generated by the page backup_setting.html
from Huawei B5328 router.
I have access to all files in the router, even the www files hosted on the www
folder for the router. After analyzing the page backup_setting.html
and checking the JavaScript .js
files, I think someone who understands the JavaScript and some coding language will be able to encrypt and decrypt the config file easily.
The reason why I'm asking is that I want to enable telnet for this router from the WebUI, and I think it can be done through JavaScript or config file restore or maybe CGI command.
Here is the link for all files including backup_setting.html
and the whole
www
folder is posted [here][1], you can get the .js
files etc.
Thanks for helping.
You were correct, analyzing the file maintenance.cgi
gets this :
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 ELF, 32-bit MSB executable, ARM, version 1 (SYSV)
67144 0x10648 Unix path: /var/tmp/update_info
68293 0x10AC5 Unix path: /var/config/ucfg_config.xml
68975 0x10D6F Unix path: /var/config/ucfg_config.xml
71140 0x115E4 XML document, version: "1.0"
71741 0x1183D HTML document header
71804 0x1187C HTML document header
78624 0x13320 XML document, version: "1.0"
81900 0x13FEC PEM RSA private key
Now, assuming I have the decrypted config file, if I encrypt this file into config.bin
file, I think it should work.
Can someone help into decrypting or encrypting the file in the correct format? Thanks.
Analyzing a piece of code of maintenace.cgi
gives the encrypt and decrypt cmd used :
No Command [WebUpd]%s, recive file error case Parameters Abnormal. [WebUpd]%s, Exit: %d [WebUpd]---------------------------------------- main write_file_form_encoded TR069_import TR069_import import_finish file_check check_rsa_digest [%02d-%02d-%02d %02d:%02d:%02d:%03ld] ' >> /dev/console echo ' [pbi] Failed to create key BIO [pbi] Failed to create RSA open file error
----------------do decrypt file parse---------------
----------------do encrypt file ----------------
%s ERROR: %s
Public Encrypt failed Encrypted length =%d
Private Decrypt failed Decrypted Text =%s
Decrypted Length =%d
Hello this is PBI RSA test [bpi] caculate_sha_digest
%02x [bpi] get_sha_digest_in_image data_size=%d, privateKey size=%d
[bpi] check_sha_digest
caculate_sha_digest results
0x
public_encrypt
image_buf_len =%d
[pbi] get_sha_digest_in_image fail
img_sha =%d
cal_sha =%d
[pbi] image SHA256 digest is wrong
[pbi] image SHA256 digest MATCH !!!
[%02d-%02d-%02d %02d:%02d:%02d:%03ld] ' >> /dev/console echo ' ; %02hhx delitem_1 = %s
del_count = %d
, 00 parment of index is wrong <%s> Error Invalid index number. </%s>
wrong parment of del_count! [deleteNthValueMultiWithDataCheck]value:[%s],rulsCount = %d count = %d the index of content max than ruls count the contexts are diff 11 the index is valied the contexts are diff 22 the contexts are diff 33 what about the value rec is:%s ,hashcode is :%s , and data->hashcode is:%s
%s ;%s [utils] i=%d,rec=%s
[utils] num=%d
[utils_FilterReplaceOperation] i=%d,num=%d
br0 [utils] getLanInfoList
/proc/net/arp r %19s %hhu.%hhu.%hhu.%hhu %hhx:%hhx:%hhx:%hhx:%hhx:%hhx 0x%x [utils] get_arp_flags arp_flags = %d
[utils] lan_info_count %d
stat_info...
: [util] getWlanMacList
/proc/wlan0/sta_info hwaddr [util] get wlan MAC %s
The public port "%d" is used with TCP and UDP, please use another one. The public port "%d"-"%d" is used with TCP and UDP, please use another one. The public port "%d" is used with TCP, please use another one. The public port "%d"-"%d" is used with TCP, please use another one. The public port "%d" is used with UDP, please use another one. The public port "%d"-"%d" is used with UDP, please use another one. The public port is used, please use another. (%d)(%s)(%s)... utils.cgi.c i: %d, ignoredIdx: %d sFromPort1: %s, sToPort1: %s, sProtocol1: %s sFromPort: %s, sToPort: %s, sProtocol: %s iFromPort1: %d, iToPort1: %d, Protocol1: %d TCP UDP TCP_UDP iFromPort: %d, iToPort: %d, Protocol: %d check webs_isPublicPortUsed 1 check webs_isPublicPortUsed 2 check webs_isPublicPortUsed 3 check webs_isPublicPortUsed 4 session_stok sess_stok [www]cgi getSessinStok ok RoamSetting AttachSetting AttachManual DeatchManual PDNcfgSetting DataManualConnect SetSelectMode SetPlmnId SetFotaUrl JoinWps Check DiagnosticCmd \B2 \B2 \B2, \B2< \B2L \B2\ \B2p \B2\80 \B2\8C \B2\98 \B2\A0 \B2\A8[www]cgi_response_sess_stok ok Content-type: text/xml
Also in rsa.js
file public key is displayed :
encrypt: function($data, $pubkey) {
if (!$pubkey) return false;
var bytes = ($pubkey.modulus.bitLength()+7)>>3;
$data = this.pkcs1pad2($data,bytes);
if(!$data) return false;
$data = $data.modPowInt($pubkey.encryptionExponent, $pubkey.modulus);
if(!$data) return false;
$data = $data.toString(16);
while ($data.length < bytes*2)
$data = '0' + $data;
return Base64.encode(Hex.decode($data));
},
encryptByDefaultKey: function($data, ispost){