- Видео 93
- Просмотров 102 797
Easy Hacks
Добавлен 26 июн 2021
PoC exploits for network device vulnerabilities.
Firmware analysis.
Router configuration file decryption.
Firmware analysis.
Router configuration file decryption.
Build toolchain to cross compile
Build buildroot toolchain, cross compile code to MIPS architecture and emulate binary using QEMU.
Просмотров: 102
Видео
CVE-2024-40505 D-Link DAP-1650 Path Traversal
Просмотров 161Месяц назад
Directory Traversal vulnerability in D-Link DAP-1650 Firmware v.1.03 via the hedwig.cgi component. The vulnerability is similar to ruclips.net/video/FPpEslaEsb0/видео.html
CVE-2024-37630 D-Link DIR-605L hardcoded password vulnerability
Просмотров 3042 месяца назад
D-Link DIR-605L v2.13B01 contain a hardcoded password vulnerability in /etc/passwd.
CVE-2024-33113 D-Link DIR-845L Information Disclosure
Просмотров 2613 месяца назад
Information disclosure vulnerability in DIR-845L. Exploit to get admin password with crafted HTTP request.
CVE-2024-33112 D-Link DIR-845L Command Injection Vulnerability
Просмотров 2413 месяца назад
D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection.
CVE-2024-33110 D-Link DIR-845L Permission Bypass
Просмотров 2873 месяца назад
D-Link DIR-845L router v1.01KRb03 and before is vulnerable to authentication bypass.
Decrypt D-Link DCS-930L camera firmware
Просмотров 2725 месяцев назад
Decrypt AES-128-CBC encrypted D-Link DCS-930L firmware. AES key is tz0# 7r|13kw0?,l
Analysis of CVE-2024-22853 (Hardcoded telnet credentials)
Просмотров 2165 месяцев назад
D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a telnet session.
Decrypt D-Link Encrypted config.bin
Просмотров 6996 месяцев назад
Decrypt D-Link DIR-822 backup config.bin file to get config.xml. Config file is gzip compressed, AES 256 CBC encrypted and has a SEAMA header. 03:24 Decrypt using openssl 08:15 Decrypt through emulation 21:11 Generate encryption passphrase
Analysis of CVE-2024-0769
Просмотров 4857 месяцев назад
Authentication bypass vulnerability in D-Link DIR-859 1.06B01. Affected component is hedwig.cgi
Decrypt Nokia router backup configuration file
Просмотров 2,1 тыс.9 месяцев назад
Decrypt backup configuration file of Nokia G-2425G-A GPON ONT and obtain config.xml text file. Encryption: AES-256-CBC Passphrase: S23l7nZm47XyMGs6y6oJpN9CR4nbfIZHJ4VRwp7HcdV6o2YvUmeNYFlz08Otwz78
Decrypt Juniper $9$ password
Просмотров 25910 месяцев назад
Decrypt encrypted password of Juniper starting with $9$.
How to get password from rom-0 file?
Просмотров 95711 месяцев назад
Configurations from certain ZyNOS based devices like ZyXEL P-662H, Huawei HG530, TP-Link TD-W8901N, etc. are exported in rom-0 format. Identify different fields in rom-0 file and decompress LZS compressed data to get the admin password.
Decrypt Netgear M1100 firmware
Просмотров 538Год назад
Decrypt firmware of Netgear M1100 M1 Nighthawk mobile router. pastebin.com/8N2HFp28
Find D-Link DAP-X1860 firmware encryption key
Просмотров 509Год назад
Find AES encryption key and XOR key of D-Link DAP-X1860 using Ghidra. AES-256-CBC key is MB0dBx62oXJXDvt12lETWQ . XOR key of ELX firmware is 0x8844A2D168B45A2D which is derived from 0x30471688.
Get configuration text file from D-Link config.bin
Просмотров 1,8 тыс.Год назад
Get configuration text file from D-Link config.bin
Decrypt D-Link firmware using QEMU user mode emulation
Просмотров 1,2 тыс.Год назад
Decrypt D-Link firmware using QEMU user mode emulation
Find encryption key and IV of D-Link 'encrpted_img' firmware
Просмотров 698Год назад
Find encryption key and IV of D-Link 'encrpted_img' firmware
Coldplay 'The Scientist' lyrics in Kingston firmware
Просмотров 143Год назад
Coldplay 'The Scientist' lyrics in Kingston firmware
Find D-Link SHRS firmware encryption key
Просмотров 772Год назад
Find D-Link SHRS firmware encryption key
Find decryption key of TP-Link configuration backup file from firmware
Просмотров 3,8 тыс.Год назад
Find decryption key of TP-Link configuration backup file from firmware
Key use explain?
Hello brother 👋🏻 , please share yout telegram id . How can I be content with you.
Thanks a lot!
Can I send you the .cfg file and get the .xml file in return?
thanks, you are the best, can you decrypt the firmware about this ?
This s what I wanted
Here is a simpler way :) I think this is the same CVE ? ruclips.net/video/h6LO0wvoi-c/видео.html
I love it.
I had a problem with my black screen on Lubuntu 24.04 LTS, but your method helped me solve it. Thank you very much!
God job pro i need you
❤
GG
Very nice, worked as expected. #1 xrdp install tutorial! Works for Ubuntu 24 minimal desktop.
AC1200 v1 I m using 20180124 rel.52299.bin firmware, follow your instructions to decrypt, decrypt successful with no error, but the dec_config file is not readable, can you help me to decrypt? if can please drop your email ... many thanks 😝
I think they have provided the source code of their firmware
I HAVE THE ORIGINAL ZTE FIRWARE, you can help me decrypt and encrypt so that I can lopersnalize and not lose data like my vlan or wifi network because I have problems every time the client resets it or the light goes down and up and resets it. I will pay friend, thank you very much.
Hello friend, I'm looking for how to upload my configuration via telnet and even if it is factory reset, I don't lose it because I have to go to the client's house to configure it again. Do you know where to replace the .xml or what to do? I would pay for the support.
I'M LOOKING TO MODIFY THE .xml or save my configuration even if I don't lose it after reset, do you know how to achieve this? page please
Hello friend, can you help me, I have ZTE F670L firmware is Hardware Version V9.0 Software Version V9.0.11P1N10B Boot Version V9.0.11P10N2 I want to decrypt and encrypt I can pay if you help me with the process.
Can you help me decrypt a ZTE config.bin I want to convert it to .xml I can pay friend you phone & mail
I love you videos, thanks for making them! How did you obtain the RSA private key that you used to decrypt the AES key file? Is it available on the D-Link website or was it extracted from a piece of physical hardware?
Do you have hints what to do with Type 05 configuration? Or where to download firmware version of V6.0.10P2N14 (for F680)?
Can we edit this file to change passwords
Sir are you satisfied with your subscribers and views
What is the benefit of this work?
please need some help about dlink 2750u firmware
Hello sir, I want to change confirmation file permanently. please help
Can you make video Huawei firmware download & decrypt?
Good job ❤
Thank you very much
thank you bro :)
👌
Exatcly what I was looking for. Not for that particular router, but I was wondering if the source-code available was only the modified copies of the open-source packages used in the full build or it is the full system-build environment with the toolchain and the SDK. Thank you. Looks heavily similar to D-Link/Ralink/Mediatek SoC SDK.
なるほど。imagesに脆弱性があったのか
Good explain.... just note here 14:39 you could create shell script that take file input variable, and warp the rest of the code for you.
You are my savior, thanks for existence ☺
How to dump its firmware by accessing telnet or fin login password for webpage for dir 850l plzz
I have a TP-LINK EAP110 outdoor backup file, I want to open it, can I do it with Windows?
Hello, I'm one of the authors of CVE, great video thanks for sharing!
And Could you change Title to include '0' > '0769'?
great work sir.
Product old. Wontfix. Buy a new one from us! Jerks! Thanks for the interesting video!
could you make a video how to install embark in kali linux...???
Cool
I wonder if we should re add checksum after editing the file to upload back. Any ideas?
the last bytes of the file may vary on each product. In the WA860RE wifi extender there are 5 null bytes at the end so had to use truncate -s -5 config.txt
with which you do what next exactly? also is that the actual key? Isn't that just the hex representation of it?
Hi, just 2 things my friend (maybe my source info could be wrong but this what I realize, but I want to help you) 1. Old TP link products (or outdated firmwares) use DES encryption with ecb mode to encrypt their backup files with just one private key. This video shows a firmware using this encryption and he's showing how to locate the not-so-private key. What do you do next exactly? Decrypt the backup file with that key using openSSL. In a windows cmd or linux terminal you would do something like "openssl enc -d des-cbc -k yourkey -in config.bin -out decrypted.bin" this will output the decrypted file but I'm afraid there are some steps more to do to reach the plain text file. 2. Modern Tp link products (or latest firmwares on old products) are using now AES encryption with cbc mode to encrypt their backup files. This is a different approach as you have to provide a key and vector init key. And more steps are needed, basically you decrypt the file with openssl, decompress the file with zlib, remove first 16 bytes of checksum content, decrypt again, and you will have the .xml backup file in plain text. The decryption command would start like "openssl aes-256-cbc -d -K yourKey -iv yourVector -in config.bin | openssl zlib -d -out decrypted.bin" Isn't that just the hex representation of it? Yes, the encryption key could be represented as hex format or base-64. Refer to "Cryptographic key" in google The funny thing is that both methods have been unpuzzled long time ago, and you can find even decryption scripts for tp link backup files.
@@Aljjocol Thanks! Also just realized he has a follow up video too so it all makes more sense :)
Forgot to add something. The key should NEVER be the same for everyone. If you buy product A from Tp Link and your friend buy product B from TP link, the key used to decrypt a configuration file should be different. Using the same key for multiple files, especially in cryptographic applications, is generally considered bad practice and reusing them can lead to vulnerabilities, if an attacker gains access to your device, if he's lucky enough he can decrypt backup data of your devices of same manufacturer using the same credentials. Now imagine how many units does Tp link produce and sell? They won't bother setting a random key for every single unit but generate a single one for all of em.
Hello, can I contact you? Via your phone number or email
help unlock zyxel ont PMG5617-T20B FIRWARE
not workin on ac1200 vc220 g3u (aka vr1200) conf.bin not decryptable i found the key. but no success. getting error like this: error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:349 edited openssl.conf file as: [openssl_init] providers = provider_sect [provider_sect] default = default_sect legacy = legacy_sect [default_sect] activate = 1 [legacy_sect] activate = 1 the error fixed. but decrypted file not readable even with hex editor or any other softwares.
Hi, use an older version of openssl. Had same error on openssl 3+ on Ubuntu and it's because the algorithm is old so I used openssl 1.0.2 and it worked. Other thing is that maybe ac1200 uses the new decrypt method with key and iv. If your encrypt key is longer than the video here then it certainly uses the new method. There are lots of repositories on github that have scripts for most tp links backup decryption.
How to contact you?
Very good! Do you how find encripted type AES-256CB? Find it in the bytes hexadecimal?