how to decrypt zte zxhn h108n V2.5.5_VDFT13 config.bin?

Question

I need the root password from my router. I need to change my snr because my provider had lock it at a high value. I try to decrypt my config.bin file but no result. I try first with zte-config-utility

┌──(gsxrk7㉿kali)-[~/zte-config-utility-master]
└─$ python3 examples/decode.py resources/config.bin resources/config.xml --key 'GrWM2Hz&LTvz&f^5'
Signature: ZXHN H108N V2.5
Failed to decrypt payload.
Hint: payload type is 4, might need a serial number instead of a key.

then i try my s/n at back side of my router

┌──(gsxrk7㉿kali)-[~/zte-config-utility-master]
└─$ python3 examples/decode.py --serial 'ZTEERT1K9902468'  resources/config.bin resources/config.xml
Signature: ZXHN H108N V2.5
Failed! Trying again, with signature: ZXHNH108NV2.5
Malformed decrypted payload, probably used the wrong key!

nothing then I try binwalk

┌──(gsxrk7㉿kali)-[~/zte-config-utility-master]
└─$ binwalk /home/gsxrk7/zte-config-utility-master/config.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

I think that they update the firmware last month.

my config V2.5.5_VDFT13

config file V2.5.5_VDFT10 previous version

when I use this

first version header magic:    0x99999999, 0x44444444, 0x55555555, 0xAAAAAAAA
second version header offset:  0x14
third version header offset:   0x40
signed config size:            0x1db3
signature header magic:        0x04030201
signature length:              15
signature:                     ZXHN H108N V2.5
encryption header magic:       0x01020304
encryption type:               4

the return config.xml

Can someone take a look?

Answer 1

Hint : The Key Can Be found by using findstr /s "db_backup_cfg.xml" .

bin\cspd:  %s:%s,len:%d from flash userssid%d  %s :%s, len:%d from flash       dbPersonInitPSKKeyProduct   dbPersonInitWEPKeyProduct   dbPersonInitSSIDProduct /proc/cfg/db_user_cfg.xml   /proc/cfg/db_default_dsl_cfg.xml    /proc/cfg/db_default_eth_cfg.xml    /proc/cfg/db_backup_cfg.xml GrWM2Hz&LTvz&f^5    dbc_mgr_bckup_product.c pointer is NULL path is too long!   CspDBInitBackupCfg               sendcmd 1 dhcps statemachine:          show statemachine.

you will find it right next the file path... all you need is to do get the firmware somehow , if you have the ftp root access or something

download the cspd file

even running strings command on it you can find the key easily.

Also from the zte-config-utility you linked

Some routers (Type 4), might use the signature to create the encryption key. When decoding, ZCU will use the signature it finds automatically (without spaces), but you can specify one by passing the --signature argument to the decode.py script.

so... for further help , Do a full port scan on the router to see if there a way we can get into the device to access the cspd file ....or if you can get the firmware by searching for it online.