Decrypting the Config file of a Huawei router "HG630 V2"

Question

followed that post from Wordpress

https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/

Extracted the 4 Hex strings needed. But, looks like there is a twist. the IV is 64 bits long.. so the .Py script he shared gives an error that the IV is too long.

uploaded the 4 files (GetInfo 1 through 4) and the extractkey.py script. also included is the output from that script as a proof.

https://drive.google.com/drive/folders/1hLF1I9lpB8etVNDGcuocoCmTpM6GciGJ

EDIT : can anyone get me in contact with that person on the wordpress ? Maybe he can help

Answer 1

Test this script out, I Tested it and it works well for me and it can even Re-encrypt the file back for hg630/hg633

decryption :

Usage :hg633.py decrypt inputfile outputfile

encryption :

Usage :hg633.py encrypt inputfile outputfile

To decode the encrypted passwords

Usage : hg633decode.py decrypt inputfile outputfile

To fix

Not a valid config file...exiting

in other words to get the script to treat this your config as a valid config, add this up of the line in script that has similar value XML_VERSION_TSTRING = b'TEDATA<?xml version="1.0" ?>'

which is the very first line of a decrypted config file

and modify

def check_config(new_config_file):
    head = new_config_file[0:len(XML_VERSION_STRING)]
    if head != XML_VERSION_STRING:
        print("Not a valid config file...exiting")

to

def check_config(new_config_file):
    head = new_config_file[0:len(XML_VERSION_STRING)]
    head2 = new_config_file[0:len(XML_VERSION_TSTRING)]
    if head != XML_VERSION_STRING:
     if head2 != XML_VERSION_TSTRING:               
        print("Not a valid config file...exiting")
        sys.exit()

to decode the admin password

 sdecode.py encryptedstring

It will output a sha-256 hash which is how the password is stored in newer routers at least , you can search the hash online for possible quick cracking

I couldn't figure out how to Re-encrypt the DG8045 as the signurate keeps failing even that i used the keys from getinfo function

if anyone can figure how to work out the RSA_N RSA_D , that would help a lot.