Contents
How to decrypt Linux-ZTE backup config file?
It has been used to decrypt config.bin on 2 different routers at the time of writing. The obfuscated section of your config file is a series of ZLIB-compressed sections that have been encrypted with AES in ECB mode with a 16-byte key.
How to enable privileged mode on zxhn router?
First, we must connect to the router through Telnet, and enable the advanced commands mode: Connecting to the router: telnet 192.168.1.1 Username: root, password: public. Once you get the command-line prompt, we need to enable the privileged command, to do that you should use the command enable.
Where to find encryption key for ZTE routers?
The encryption for recent ZTE routers’ config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is CspDBInitPdtInterface, last snprintf call.
How to access zxhn h108n web shell and secrets?
In part one, we hacked and gained access to shell of the ZXHN H108N as root through Telnet, part two will talk about ZXHN H108N router web-shell and secrets, and I will show you how to access all that in few simple steps.
Are there any bugs in routerpassview for ZTE?
Fixed bug with some ZTE routers: RouterPassView decompressed only the first compressed block, so only a part of the file was displayed. Fixed the Ascii Text Mode to display properly router files that contain many null characters. Added support for another version of rom-0/Hdbgarea file format (Zyxel P-2612HWU-F1 Modem).
How to encrypt a zlib config file?
The obfuscated section of your config file is a series of ZLIB-compressed sections that have been encrypted with AES in ECB mode with a 16-byte key. There is an application named cspd on the router that does lots of different things. One of those things is to encrypt/decrypt the configuration file.
Where to find serial number for ZTE router?
You have to type the serial number in the Advanced Options window (F9). Added support for multiple ZTE models with AES encryption, including H108N, H118N, H267N, H298N, H168N, and possibly more…