2

followed that post from Wordpress

https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/

Extracted the 4 Hex strings needed. But, looks like there is a twist. the IV is 64 bits long.. so the .Py script he shared gives an error that the IV is too long.

uploaded the 4 files (GetInfo 1 through 4) and the extractkey.py script. also included is the output from that script as a proof.

https://drive.google.com/drive/folders/1hLF1I9lpB8etVNDGcuocoCmTpM6GciGJ

EDIT : can anyone get me in contact with that person on the wordpress ? Maybe he can help

1
  • 1
    I have looked in python script and I have no idea how you get IV 64bit long with iv=raw[-32:-16] which copy 16 bytes (128 bits) into IV. Lengths of all variables are hardcoded and fit one to another. Even more fantastic is that 64bits is too long when 128 required Jan 20, 2020 at 19:52

1 Answer 1

1

Test this script out, I Tested it and it works well for me and it can even Re-encrypt the file back for hg630/hg633

decryption :

Usage :hg633.py decrypt inputfile outputfile

encryption :

Usage :hg633.py encrypt inputfile outputfile

To decode the encrypted passwords

Usage : hg633decode.py decrypt inputfile outputfile

To fix

Not a valid config file...exiting

in other words to get the script to treat this your config as a valid config, add this up of the line in script that has similar value XML_VERSION_TSTRING = b'TEDATA<?xml version="1.0" ?>'

which is the very first line of a decrypted config file

and modify

def check_config(new_config_file):
    head = new_config_file[0:len(XML_VERSION_STRING)]
    if head != XML_VERSION_STRING:
        print("Not a valid config file...exiting")

to

def check_config(new_config_file):
    head = new_config_file[0:len(XML_VERSION_STRING)]
    head2 = new_config_file[0:len(XML_VERSION_TSTRING)]
    if head != XML_VERSION_STRING:
     if head2 != XML_VERSION_TSTRING:               
        print("Not a valid config file...exiting")
        sys.exit()

to decode the admin password

 sdecode.py encryptedstring

It will output a sha-256 hash which is how the password is stored in newer routers at least , you can search the hash online for possible quick cracking

I couldn't figure out how to Re-encrypt the DG8045 as the signurate keeps failing even that i used the keys from getinfo function

if anyone can figure how to work out the RSA_N RSA_D , that would help a lot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.