1

I need the root password from my router. I need to change my snr because my provider had lock it at a high value. I try to decrypt my config.bin file but no result. I try first with zte-config-utility

┌──(gsxrk7㉿kali)-[~/zte-config-utility-master]
└─$ python3 examples/decode.py resources/config.bin resources/config.xml --key 'GrWM2Hz&LTvz&f^5'
Signature: ZXHN H108N V2.5
Failed to decrypt payload.
Hint: payload type is 4, might need a serial number instead of a key.

then i try my s/n at back side of my router

┌──(gsxrk7㉿kali)-[~/zte-config-utility-master]
└─$ python3 examples/decode.py --serial 'ZTEERT1K9902468'  resources/config.bin resources/config.xml
Signature: ZXHN H108N V2.5
Failed! Trying again, with signature: ZXHNH108NV2.5
Malformed decrypted payload, probably used the wrong key!

nothing then I try binwalk

┌──(gsxrk7㉿kali)-[~/zte-config-utility-master]
└─$ binwalk /home/gsxrk7/zte-config-utility-master/config.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

I think that they update the firmware last month.

my config V2.5.5_VDFT13

config file V2.5.5_VDFT10 previous version

when I use this

first version header magic:    0x99999999, 0x44444444, 0x55555555, 0xAAAAAAAA
second version header offset:  0x14
third version header offset:   0x40
signed config size:            0x1db3
signature header magic:        0x04030201
signature length:              15
signature:                     ZXHN H108N V2.5
encryption header magic:       0x01020304
encryption type:               4

the return config.xml

Can someone take a look?

2
  • i amd trying to find the key on my cspd file, from zte f680 gpon fiber device.. i have the cspd file around 2mb i am running the cmd strings -a cspd and inside the file i can only see 2 db_backup_cfg.xml after running the cmd root@PSI:/media/jffs2-extracted/bin/test_cspd# strings -a cspd | grep db_backup_cfg.xml /var/tmp/db_backup_cfg.xml /userconfig/cfg/db_backup_cfg.xml is there any other special cmd i should use to capture the possible key also? attached below is my cspd file from the jffs2 extracted files from the original firmware.. if anyone can share some hints.. as we have other xml fi Oct 20, 2022 at 14:24
  • FYI: The above comment (converted from a non-answer) ended with: "as we have other xml files also inside this firmware which seems to be encrypted also.. and others dont. easyupload.io/cipgtc"
    – 0xC0000022L
    Oct 21, 2022 at 12:34

1 Answer 1

1

Hint : The Key Can Be found by using findstr /s "db_backup_cfg.xml" .

bin\cspd:  %s:%s,len:%d from flash userssid%d  %s :%s, len:%d from flash       dbPersonInitPSKKeyProduct   dbPersonInitWEPKeyProduct   dbPersonInitSSIDProduct /proc/cfg/db_user_cfg.xml   /proc/cfg/db_default_dsl_cfg.xml    /proc/cfg/db_default_eth_cfg.xml    /proc/cfg/db_backup_cfg.xml GrWM2Hz&LTvz&f^5    dbc_mgr_bckup_product.c pointer is NULL path is too long!   CspDBInitBackupCfg               sendcmd 1 dhcps statemachine:          show statemachine.

you will find it right next the file path... all you need is to do get the firmware somehow , if you have the ftp root access or something

download the cspd file

even running strings command on it you can find the key easily.

Also from the zte-config-utility you linked

Some routers (Type 4), might use the signature to create the encryption key. When decoding, ZCU will use the signature it finds automatically (without spaces), but you can specify one by passing the --signature argument to the decode.py script.

so... for further help , Do a full port scan on the router to see if there a way we can get into the device to access the cspd file ....or if you can get the firmware by searching for it online.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.