Huawei B593s-22 - Accessing b593s-22 - Putty SSH, "downloadconfigfile.conf

Hello to everyone interested in the topic of modification, improvement of operation and strengthening of work safety on the Huawei b593-s22 router.



A few Off-topic sentences:
I am developing a neat application to modify both the firmware and remote management of this router, however it is a big project, and as I am a hobbyist, I cannot devote as much time to it as I would like. Now spring is coming, so I will spend the next month on the plot (300m2 and "Americans" are already waiting). So I decided to describe the procedure of decoding the configuration file and device access passwords for the safety of network users.

To decode the file: downloadconfigfile.conf you will need: OpenSSL .
For deciphering passwords, I recommend the free one: BP-Tools

I suggest BP-Tools because OpenSSL was causing problems on my computer (and it couldn't open / find the file, and it had to create a configuration file for him), and besides, it's a command-line application.

Let's get to the point:

To decode the configuration file, the following command is enough:



To encrypt:



As you can easily guess, the algorithm is AES 128 CBC Key: 3E4F5612EF64305955D543B0AE350880; IV: 8049E91025A6B54876C3B4868090D3FC.
However, you have to be careful about the file size - it must be a multiple of 16 bytes -> Huawei uses an unconventional method for AES CBC, namely ZERO "padding" (when you change the file size, you will need a HEX editor to add a few "00" to the end of the file - so that the size in bytes divided by 16 does not give the remainder).

Decrypting passwords from the configuration file:

The decrypted configuration file is in * .xml format, so any text editor will be needed to edit it ... The above "print screen" shows a fragment of this file with default passwords to the router's WebGUI - for the "admin" account the encrypted password is here: f3nGyuud1GOwq4E1LtMDbWcQgRAK3uxuUf + Ezxi0qq6OXeW9 / qX22A == .

Therefore, we proceed to decryption:

1. Select 'Base64' from the "Generic" menu of BP-Tools (Cryptographic Calculator):


and we decode our password to hexadecimal form:


2. From the "Generic" menu of the program, select 'DES' ('3DES', 'CBC', 'Heksadecimal', 'Padding: None'). The decryption key is: K: 3E4F5612EF64305955D543B0AE3508807968905960C44D37 ; IV: 8049E91025A6B548 . The HEX string from the previous operation will be decrypted, so: 7F79C6CAEB9DD463B0AB81352ED3036D671081100ADEEC6E51FF84CF18B4AAAE8E5DE5BDFEA5F6D8:



3. From the "Generic" menu of the program, select 'Character encoding' -> 'Heksadecimal-> binary' and en-encode the data resulting from the "3DES" decryption, so: 63585268636B5A534E4667363976424E4A53494865426C7948456C58395134500640013D3D




4. The resulting string (Base64) should be DIVIDED into 2 parts -> in the first part, use 12 (!!!) characters: cXRhckZSNFg6; in the second part the remaining characters: 9vBNJSIHeBlyHElX9Q4VCQ ==.
From the 'Character encoding' menu, choose 'ASCII Text -> Heksadecimal' and en-encode characters separately for two parts:



5. Staying in 'Character encoding' - 'ASCII Text -> Heksadecimal' in the 'Data' field, enter the numbers from 1 to 8 at the end of which we add the en-encoded characters from the first part (8 characters, ':' skipping) of the previous point, so in this case the whole is: 12345678qtarFR4X:




6. Having enough data, select 'AES' ('AES-128', 'ECB', 'Hexadecimal') from the "Generic" menu of the program. The key here is the hexadecimal sequence from the previous point (12345678qtarFR4X), so: 31323334353637387174617246523458. The hexadecimal string from the second part will be deciphered (see point 4.9vBNJSIHeBlyHElX9Q4VCQ ==), that is: F6F04D2522077819721C4957F50E1509





7. At the end, from the "Generic" menu of the program, select 'Character encoding' -> 'Heksadecimal-> binary' and en-encode the obtained value, i.e .: 61646D696E0000000000000000000000 to ASCII characters and this is how we obtain the password (in this particular case) admin ( "00" is omitted !!!)





If you want to change the valid password on the router, proceed in the reverse order, except that:
-you need to create a unique combination of eight characters (lowercase and uppercase letters + numbers), it will be the second half of the AES ECB encryption key (the first half is 12345678 and it should stay that way),
-conceive / generate a unique password (max 16 characters - in the case of a short password to hexadecimal form, complete "00" with zeros up to a total length of 16 bytes),
-in the encryption stage '3DES' -> "Data Input" = 'ASCII' -> "Padding Method" = 'Zeros',
- if everything goes well, the new password will be 56 characters long and should be overwritten in the right place in the configuration file.


To this topic I attach a log of the entire operation (the log also includes reverse steps, i.e. password encryption) ... it will definitely be helpful.

BP-Tools..g.txt (5 kB)You must be logged in to download this attachment.

I encourage forum users skilled in creating batch files, programs in high-level languages to embrace the topic for less informed users.
I myself am a supporter of asm, at most ANSI C, and my project is quite extensive and a few more months to master it will be gone.




PS
Only the WebGUI and CLI passwords are encrypted simultaneously with the 3DES and AES_ECB algorithms ... The rest of the passwords only require the use of the AES_ECB -> "log" algorithm from decoding the sample Wifi password below:




Regards.

I got the password by doing a little trick with ftp and sharing the entire root directory. I also got involved in editing files on a living organism. somehow the modem survived. at least the second. I wonder where you found the options to unlock the frequencies. I was playing with the modem two years ago and I don't remember much, but I still have the passwords somewhere, so log in and do it, it's not a problem. from your experiments, I would suggest that you prepare some soft, where you would have all these options unlocked.
ps. I was also surprised that pl was stunned.

kolopeter2 wrote:

I got the password by doing a little trick with ftp and sharing the entire root directory ...

Hello,
as for the method to intercept the "POST - for FTP" method, or other known -> via "Ping", it only worked on the b593 model u-12 for the model p-22 the above tricks are ineffective (after swapping the target directory, it lands in / mnt ), and the only way out to gain access to the device was to connect to UART .

Quote:

"... I wonder where you found the options to unlock the frequencies ..."

This statement applies to my old topic in which I thought it was enough to just edit html / js files to get the frequency selection ... :



Unfortunately, this is not enough, you still need to edit / replace the file (library) libatchannel_modematcommand.so in the directory / atp / lib on partition " yaffs1 "... :shii:

Below is the difference in the "shape" of the function responsible for frequency switching between FW V200R001B236D30SP01C56 and V200R001B180D20SP05C69:
// ================== Tele2 V200R001B236D30SP01C56 =========


// ================== PlusGSM V200R001B180D20SP05C69 =========


Regards.

Re.Mastered.M wrote:

As for the method to intercept the "POST - for FTP" method, or another known method -> by "Ping", it worked only on the b593u-12 model, for the s-22 model the above tricks are ineffective (after replacing the target directory, you land anyway w / mnt), and the only way to access the device was to connect to the UART.

aatam. you can enter this method because that's how I got the root password. all you need is a firefox plugin and a pendrive in the usb port and when sending, splash the POST and change the path from USB to /.
I don't remember what the plugin is called, but I described it somewhere on the forum. the second method which seems to do the same is a linux script. I will not give the name either, because I don't remember. I found him on some blog. Unfortunately, I am now in China and unfortunately google is cut here, and yandex is hard to find. and yet I found it
https://blog.hqcodeshop.fi/archives/254-First...exploit-Setup-FTP-to-get-varsshusers.cfg.html

Hello,
I know this page, I have been following the author of this blog since I still had the B593u-12 model.
I tested this script my time and it does not work for me (I ran it today and it also does not work for me) - I do not know, maybe I have a messed Perl configuration because I am sitting on Win7 ... In the case of my computer configuration, it is even strange that I am not in able to establish Telnet connections with the router (despite of course turning on Telnet and turning off port filtering on the device), and after changing the access path to "../ ../" it lands in "/ mnt" anyway. I am glad that this script works for someone. To get to the files, all I need is SSH / UART access - here only "#cp" and "#dd" commands are enough and everything goes to the USB drive.
Regards.

even on linux it took a lot of work to get the script to work. in any case, I typed the error that popped up in the google and added, until at some point they were gone.

Hello,
if given keys AES_cbc / 3DES they do not work with your Huawei router, it means that they have been changed by the distributor, or you are using a different model (not B593) ... nevertheless, if you are interested in how to get them from FW, see the "PrintScreen" below :



And everything becomes clear .
PS
The given method works on many devices of this brand, not only for the B593 series (recently I got confirmation that it also works, among others, on the Huawei E5172 series).

Regards

kolopeter2 wrote:

you can enter this method because that's how I got the root password. all you need is a firefox plugin and a pendrive in the usb port and when sending, splash POST and change the path from USB to /

I confirm the access to the password in this way, it works for sure for the older versions of the FW-180, in newer versions it is already blocked ...

but the password is already valid on every software, except those that are locked. I think the one from the vodafon is blocked. it seems to me that it was enough to reset to factory settings after changing the software and access was again

Hello
Available: Speedport LTE II (B593s-12),
HW Ver .- Ver.B,
FW-V200R001B180D40SP04C748
downloadconfigfile.conf:
Unable to decrypt conf file
Can you help me?

deadfire wrote:

Hello
Available: Speedport LTE II (B593s-12),
HW Ver .- Ver.B,
FW-V200R001B180D40SP04C748
downloadconfigfile.conf: https: // drive.google.com/file************************************ ************************************************** ************
Unable to decrypt conf file
Can you help me?

Hello,
The manufacturer / distributor of this equipment is probably closely following the actions on this forum, but that's good because it was possible to enforce the strengthening of security for such an old device.

Yesterday I sent you all information regarding the configuration file you have published in a private message - please check your private message inbox.

I advise you to edit your post by removing the link to this file.
GREETINGS.

Unable to connect to B593s-12 over SSH: Connection Denied
In telnet downloadconfigfile.conf is enabled, there is no SSH in the config file.
Is it possible to establish a connection SSH?

Hi there.

deadfire wrote:

Unable to connect to B593s-12 over SSH: Connection Denied
In telnet downloadconfigfile.conf is enabled, there is no SSH in the config file.
Is it possible to establish a connection SSH?

Unfortunately not all B593 firmwares has SSH/port22 enabled ( You may try reset to default settings, and try connect to the device right after it resets)...
From downloadconfigfile.conf: "" this settings is dead end...
You may also try forcing "SSH/enable=1" on the ACL rule, and add this rule to the "X_FireWall CurrentLevel" service.

I encountered problems with openssl version > 0.9.8

For a more compact password decryption you can use this script:

Hi,

I logged in using ssh, but unfortunately the ATP console has some very limited possibilities':




router info:
Hardware version:
Ver.B
Firmware version:
V200R001B180D20SP06C69
Firmware build date:
Apr 21 2021 / 15:02:19

Is it this version of the software that limits the console options after ssh and you have to get through UART to do something more?

greet

Yes, give it a go

Re.Mastered.M wrote:

kolopeter2 wrote:

I got the password by doing a little trick with ftp and sharing the entire root directory ...

Hello,
as for the method to intercept the "POST - for FTP" method, or other known -> via "Ping", it only worked on the b593 model u-12 for the model p-22 the above tricks are ineffective (after swapping the target directory, it lands in / mnt ), and the only way out to gain access to the device was to connect to UART .

Quote:

"... I wonder where you found the options to unlock the frequencies ..."

This statement applies to my old topic in which I thought it was enough to just edit html / js files to get the frequency selection ... :

Unfortunately, this is not enough, you still need to edit / replace the file (library) libatchannel_modematcommand.so in the directory / atp / lib on partition " yaffs1 "... :shii:

Below is the difference in the "shape" of the function responsible for frequency switching between FW V200R001B236D30SP01C56 and V200R001B180D20SP05C69:
// ================== Tele2 V200R001B236D30SP01C56 =========

Code: C / C++

Log in, to see the code

// ================== PlusGSM V200R001B180D20SP05C69 =========

Code: C / C++

Log in, to see the code

Greetings.

How to extract / edit libatchannel_modematcommand.so?

Hi,

when it comes to password extraction - I did it by downloading the configuration file and the decryption manual

as for ssh, all you have to do is enter "shell" in the ATP console and I'm at home:



an interesting tool - letat:



while the most interesting command - to check which base station the router connects to, unfortunately for some reason it does not show any information :(



any ideas how else - or with another command to check with which base station the connection?

soft:
V200R001B236D30SP01C56


EDIT:


and thus we have the E-CID (in the field xxxxxxxx)

Hello!
I got a Huawei B539s-22 (Hardware version B) and I want to lock it to a specific band because some bands are unusable here (almost no internet speed). I haven't used UART ever, but as I understand, I must have shell access to the router to be able to lock bands. The problem is that my router uses this firmware version V200R001B270D25SP02C26, so I can't make use of the exploits shown here.

Can anyone help me?

1. How can I downgrade firmware (and where can I find it)?
Or:
2. How can I gain shell access without UART?

If both are impossible to do, then what is the order of pins of UART (any other hint is really appreciated)?

Thank you all very much!!!