My router has a config backup function that downloads a base64-encoded file.

After decoding the file, it's clear that it is encrypted:

entropy plot graph from binwalk

I have tried redownloading the config, both after having changed config parameters in the router, and not having changed anything. Every part of the file - except 21 bytes - changes completely every time it is downloaded, regardless of config changes, logged in user etc.

difference between xxd output of aaa.bin and bbb.bin

It seems that these bytes will always be present at this position:

000019   BE B0 A9 D4 6B 76 F6 F3 18 FD 31 B7   ¾°©Ôkvöóý1·
000031   1D 50 84 B0 C0 69 3F 35 3F            P°Ài?5?

Does this provide any clues as to how these files are encrypted and how one might decrypt them? How do I go about achieving this?

This is a little known proprietary ISP CPE box and the backup feature is undocumented and has to be enabled via an undocumented API, so I haven't been able to find any information regarding this.

  • 2
    Guessing an encryption scheme based on the encrypted data is next to impossible, better get your hands on a non-encrypted firmware image of the router and reverse it. This way the chance is much higher to identify the used encryption algorithm and how the key is generated.
    – Robert
    Apr 24 at 11:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.