2

I need support to decrypt the config file of ZTE F660 v9 router. I have telnet access to the router and the below link consists of the following files.

Link

config.bin, paramtag, cspd, db_user_cfg.xml, db_backup_cfg.xml

7
  • Can you upload /etc/hardcodefile/dataprotocol file, we need to get DefAESCBCIV from that file.
    – xax
    May 9, 2023 at 10:59
  • @xax I uploaded the dataprotocol file to the same drive link
    – zhanshi123
    May 9, 2023 at 11:22
  • I'm missing /etc/hardcode file, Can you upload it and all file from /bin/*
    – xax
    May 9, 2023 at 14:24
  • @xax requested files have been uploaded.
    – zhanshi123
    May 9, 2023 at 16:27
  • Have lost a admin password Can you help me? ZTE Home Gateway D-SN: ZTEEH8UNAD00639 WEB Username: user WEB Password: 3CC7316056 MAC: 74-6F-88-AF-DF-C3 drive.google.com/drive/folders/… File default_config.bin Thks Oct 2, 2023 at 1:14

1 Answer 1

6

Download script and config file

KEY = SERIAL + MAC: CF28772Bf438d406f608 from paramtag
IV  = DefAESCBCIV:  ZTE%FN$GponNJ025     from /etc/hardcodefile/dataprotocol

Example command: .cmd.example.cmd

ECHO decode config.bin to config.xml
decode.py --key CF28772Bf438d406f608 config.bin config.xml

ECHO encode config.xml to config.out.bin
encode.py --key CF28772Bf438d406f608 config.xml config.out.bin --include-header --signature F660

ECHO decode db_backup_cfg.xml to db_backup_cfg.xml.xml
decode.py --key CF28772Bf438d406f608 db_backup_cfg.xml db_backup_cfg.xml.xml

ECHO encode db_backup_cfg.xml.xml to db_backup_cfg.out.xml without signature and header
encode.py --key CF28772Bf438d406f608 db_backup_cfg.xml.xml db_backup_cfg.out.xml

command: zte_hardcode_dump.py hardcode dataprotocol

/etc/hardcodefile/dataprotocol after decrypt

DefAESCBCKey=f680v9.0
DefAESCBCIV=ZTE%FN$GponNJ025
AESENCRYKey=
userkey=608158c36497b00221db14afb845c9e3
  • paramtag
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  54 41 47 48 30 32 30 31 00 00 00 00 02 9D 5E CB  TAGH0201......^Ë
00000010  DC 03 00 00 00 90 40 00 40 00 56 39 2E 30 2E 31  Ü.....@[email protected]
00000020  30 50 32 4E 32 42 00 00 00 00 00 00 00 00 00 00  0P2N2B..........
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000050  00 00 00 00 00 00 00 00 00 00 00 00 00 01 06 00  ................
00000060  06 00 08 F6 06 D4 38 F4 01 01 06 00 06 00 08 F6  ...ö.Ô8ô.......ö        08 F6 06 D4 38 F4 is MAC -> f438d406f608
00000070  06 D4 38 F5 02 01 06 00 06 00 08 F6 06 D4 38 F6  .Ô8õ.......ö.Ô8ö
00000080  03 01 06 00 06 00 08 F6 06 D4 38 F7 04 01 06 00  .......ö.Ô8÷....
00000090  06 00 08 F6 06 D4 38 F8 05 01 06 00 06 00 08 F6  ...ö.Ô8ø.......ö
000000A0  06 D4 38 F9 80 08 04 00 04 00 5A 54 45 47 00 00  .Ô8ù€.....ZTEG..
000000B0  81 08 08 00 08 00 43 46 32 38 37 37 32 42 00 00  ......CF28772B..         CF28772B is SERIAL
000000C0  00 03 06 00 06 00 30 38 46 36 30 36 00 02 24 00  ......08F606..$.
000000D0  24 00 00 00 01 00 64 72 6D 2F 66 ED 6D 46 BF A2  $.....drm/fímF¿¢
000000E0  AE FD 7D 81 E4 57 59 65 82 04 8A 78 74 6B 03 66  ®ý}.äWYe‚.Šxtk.f
000000F0  0F 99 A0 27 E2 F3 00 00 01 06 04 00 04 00 75 73  .™ 'âó........us
00000100  65 72 00 00 01 07 04 00 04 00 75 73 65 72 00 00  er........user..
00000110  00 04 09 00 09 00 53 4C 54 5F 46 49 42 52 45 00  ......SLT_FIBRE.
00000120  10 05 09 00 09 00 53 4C 54 5F 46 49 42 52 45 00  ......SLT_FIBRE.
4
  • 1
    It works!!! Thank you so much for your effort and time.
    – zhanshi123
    May 10, 2023 at 0:47
  • Thank you for removing the config files from your drive link because it had some sensitive information. I have uploaded here some sample config files. You can add them to the drive if you want.
    – zhanshi123
    May 10, 2023 at 5:58
  • Ok, the files have been uploaded.
    – xax
    May 10, 2023 at 6:29
  • Have lost a admin password Can you help me? ZTE Home Gateway D-SN: ZTEEH8UNAD00639 WEB Username: user WEB Password: 3CC7316056 MAC: 74-6F-88-AF-DF-C3 drive.google.com/drive/folders/… File default_config.bin THE RESET DONOT SOLVE MY PROBLEM Thks Oct 2, 2023 at 10:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.