-
-
Save staaldraad/605a5e40abaaa5915bc7 to your computer and use it in GitHub Desktop.
| #!/usr/bin/python | |
| """ | |
| Simple tool to extract local users and passwords from most Huawei routers/firewalls config files. | |
| Will extract plain-text passwords and crypted credentials. Huawei config files use DES encryption with | |
| a known key. Using this information, the script will decrypt credentials found in the config file. | |
| Author: Etienne Stalmans ([email protected]) | |
| Version: 1.0 (12/01/2014) | |
| """ | |
| from Crypto.Cipher import DES | |
| import sys | |
| import binascii | |
| def decode_char(c): | |
| if c == 'a': | |
| r = '?' | |
| else: | |
| r = c | |
| return ord(r) - ord('!') | |
| def ascii_to_binary(s): | |
| assert len(s) == 24 | |
| out = [0]*18 | |
| i = 0 | |
| j = 0 | |
| for i in range(0, len(s), 4): | |
| y = decode_char(s[i + 0]) | |
| y = (y << 6) & 0xffffff | |
| k = decode_char(s[i + 1]) | |
| y = (y | k) & 0xffffff | |
| y = (y << 6) & 0xffffff | |
| k = decode_char(s[i + 2]) | |
| y = (y | k) & 0xffffff | |
| y = (y << 6) & 0xffffff | |
| k = decode_char(s[i + 3]) | |
| y = (y | k) & 0xffffff | |
| out[j+2] = chr(y & 0xff) | |
| out[j+1] = chr((y>>8) & 0xff) | |
| out[j+0] = chr((y>>16) & 0xff) | |
| j += 3 | |
| return "".join(out) | |
| def decrypt_password(p): | |
| r = ascii_to_binary(p) | |
| r = r[:16] | |
| d = DES.new("\x01\x02\x03\x04\x05\x06\x07\x08", DES.MODE_ECB) | |
| r = d.decrypt(r) | |
| return r.rstrip("\x00") | |
| f_in = open(sys.argv[1],'r') | |
| print "[*] Huawei Password Decryptor" | |
| for line in f_in: | |
| if ('local-user' not in line) or ('password' not in line): | |
| continue | |
| inp = line.split() | |
| print "[*]-----------------------" | |
| print "\t[+] User: %s"%inp[1] | |
| print "\t[+] Password type: %s"%inp[3] | |
| if inp[3] == "cipher": | |
| print "\t[+] Cipher: %s"%inp[4] | |
| print "\t[+] Password: %s"%decrypt_password(inp[4]) | |
| else: | |
| print "\t[+] Password: %s"%(inp[4]) |
Hey guys, i tried both the website https://andreluis034.github.io/huawei-utility-page/#cipher and the python script here, nothing seems to work. I'm using a HG8145X6-10 and the ISP (Nova Greece) is using a very restricted custom firmware on it. I managed to extract the config data and the admin user is: Nova_admin
Password as per the config file is: $2z0m&BlvfqI'$Tw1grk@_!Gs46RKnm)]UmP"9Z8c$CVHn_or<A/WHPI)X8SP!$
I understand it contains html elements and after cleaning it it reads this:
$2z$Z|9jwJWMO(S8,0)1%-pzg#;mH:-.@vm|IBC@I2a2kN3x#J`XaMe4*.gkUL$
I need to be able to bridge it to my router but none of the option work, can anyone assist?
Thanks!Hey, I just received the HG8145X6-10 fiber modem from my ISP (Algérie Télécom). I need to access some advanced settings that are locked under the default user account. I saw that you managed to retrieve the configuration file—could you share how you did it? Also, were you able to decrypt the superadmin credentials? Did you use Telnet, SSH, or another method to gain full access? Any guidance would be greatly appreciated ! :) @filipposxeil
same here, I tried messing with the network traffic on the config website (by setting cfgmode into an isp other than "DZTELECOM" in addition to some other things) which did make a download config button pop up, yet when clicked the router forbids the request I am trying to find some code/command execution bug but it seems like im going nowhere
also telnet/ssh/ftp are all filtered so no luck
i did manage to find sql copyright data which contained a bunch of packages and their respective versions (some had vulnerabilities, yet after poking around it seems that none of them relate to this problem)
aaand firmware dumping or hardware debugging is not a valid option fr
wbu? what did you try? and did you find anything relevant(i dont think so, this was written yesterday lmao)
I received the modem three days ago, so I haven’t had the chance to try anything yet. From what I’ve seen online, there don’t seem to be any exploitable vulnerabilities. For now, I’m considering simply requesting the ISP (Algérie Télécom) to switch it to bridge mode and pushing for it if necessary. We’ll see if they comply
Hey there.. check X_HW_CLIUserInfoInstance where the admin pass is not salted and can be decrypted..
Try using this for the web interface as well on my case it worked..
Hey guys, i tried both the website https://andreluis034.github.io/huawei-utility-page/#cipher and the python script here, nothing seems to work. I'm using a HG8145X6-10 and the ISP (Nova Greece) is using a very restricted custom firmware on it. I managed to extract the config data and the admin user is: Nova_admin
Password as per the config file is: $2z0m&BlvfqI'$Tw1grk@_!Gs46RKnm)]UmP"9Z8c$CVHn_or<A/WHPI)X8SP!$
I understand it contains html elements and after cleaning it it reads this:
$2z$Z|9jwJWMO(S8,0)1%-pzg#;mH:-.@vm|IBC@I2a2kN3x#J`XaMe4*.gkUL$
I need to be able to bridge it to my router but none of the option work, can anyone assist?
Thanks!Hey, I just received the HG8145X6-10 fiber modem from my ISP (Algérie Télécom). I need to access some advanced settings that are locked under the default user account. I saw that you managed to retrieve the configuration file—could you share how you did it? Also, were you able to decrypt the superadmin credentials? Did you use Telnet, SSH, or another method to gain full access? Any guidance would be greatly appreciated ! :) @filipposxeil
same here, I tried messing with the network traffic on the config website (by setting cfgmode into an isp other than "DZTELECOM" in addition to some other things) which did make a download config button pop up, yet when clicked the router forbids the request I am trying to find some code/command execution bug but it seems like im going nowhere
also telnet/ssh/ftp are all filtered so no luck
i did manage to find sql copyright data which contained a bunch of packages and their respective versions (some had vulnerabilities, yet after poking around it seems that none of them relate to this problem)
aaand firmware dumping or hardware debugging is not a valid option fr
wbu? what did you try? and did you find anything relevant(i dont think so, this was written yesterday lmao)I received the modem three days ago, so I haven’t had the chance to try anything yet. From what I’ve seen online, there don’t seem to be any exploitable vulnerabilities. For now, I’m considering simply requesting the ISP (Algérie Télécom) to switch it to bridge mode and pushing for it if necessary. We’ll see if they comply
consider asking them for the superadmin credentials, that way you can configure it at home without needing their support
other than that extracting the credentials requires either firmware dumping or developing your own exploit, which may be troublesome
let me know if they give you any useful information
same here, I tried messing with the network traffic on the config website (by setting cfgmode into an isp other than "DZTELECOM" in addition to some other things) which did make a download config button pop up, yet when clicked the router forbids the request
I am trying to find some code/command execution bug but it seems like im going nowhere
also telnet/ssh/ftp are all filtered so no luck
i did manage to find sql copyright data which contained a bunch of packages and their respective versions (some had vulnerabilities, yet after poking around it seems that none of them relate to this problem)
aaand firmware dumping or hardware debugging is not a valid option fr
wbu? what did you try? and did you find anything relevant(i dont think so, this was written yesterday lmao)