Old router firmware config file not decrypting?

[rahulkmr69]

So I have 2 old jio devices.

• One of them is Firmware Version SRCMTF1_JCOW414_R2.52 which works fine as can be seen in the screenshot. The decrypted file can be read and contains standard lua configs.

• Another one of them is Firmware Version SRCMTF1_JCOW404_R2.15. I'm able to find the decryption key from the script keyguesser.py but the decrypted file looks like gibberish.

Perhaps I needed to use older methods of decryption.... So I used the keys available at https://github.com//discussions/52 to decrypt the backup but no luck.

What can i do about this? Don't have pendrive handy to try the dumping to pendrive method.

[v4iv]

Any answer on this would be quite helpful

Nevermind Found the keys.zip file

• Download the keys.zip file from Server.key #52 (comment) and extract it
• Go to Your Router WEB-UI Page (http://192.168.29.1) and Sign in as Admin. (The default credentials are admin : Jiocentrum)
• Go to Administrator --> Maintenance and click Backup.
• A file (RSTXXXXXXX_JCXXXXX.enc) will be downloaded with .enc extension.
• Decrypt the downloaded .enc file using the command
  • openssl aes-128-cbc -d -kfile "<path to the key file of your Router from keys.zip>" -in "RSTXXXXXXX_JCXXXXX.enc" -out "RSTXXXXXXX_JCXXXXX.txt"
  • openssl aes-128-cbc -d -kfile "./JCOW401.key" -in "RAROTEH00021051_JCOW401.enc" -out "RAROTEH00021051_JCOW401.txt"
• RSTXXXXXXX_JCXXXXX.txt contains the decrypted configuration. Open RSTXXXXXXX_JCXXXXX.txt. The first line of the file should look like : config.userdb = {}.
• Change the first line to :

  config.userdb = {} os.execute("/usr/sbin/telnetd"); os.execute("/pfrm2.0/bin/iptables -I fwInBypass -p tcp --dport 23 -m ifgroup --ifgroup-in 0x1/0x1 -j ACCEPT"); os.execute("echo -e \"password\npassword\" | passwd root");
  

• Copy everything in the text configuration file (RSTXXXXXXX_JCXXXXX.txt) till before config.checksum = "<some random md5 hash>".
• Go to an online MD5 hash generator and paste the copied text, and generate an MD5 Hash
• In your text configuration file (RSTXXXXXXX_JCXXXXX.txt) change config.checksum = "<some random md5 hash>" to config.checksum = "<THE MD5 HASH YOU COPIED IN LAST STEP>".
• Use this command to re-encrypt the text configuration file with your respective
  • openssl aes-128-cbc -kfile "<path to the key file>" -in "RSTXXXXXXX_JCXXXXX.txt" -out "RSTXXXXXXX_JCXXXXX.enc"
  • openssl aes-128-cbc -kfile "./JCOW401.key" -in "RAROTEH00021051_JCOW401.txt" -out "RAROTEH00021051_JCOW401.enc"
• In your Router WEB-UI Page (http://192.168.29.1), go to Administrator --> Maintenance, select and restore the RSTXXXXXXX_JCXXXXX.enc file that was generated in the last step
• Connect your router via Telnet at port 23 with root as user name and password as password.
• For newer firmwares, use command rm /flash/telnetDisable to keep Telnet enabled. (Otherwise it will be disabled after some time). Otherwise, on older firmwares use command touch /tmp/DEBUG_IMAGE to keep Telnet enabled. (Otherwise it will be disabled after some time).