Perusing the release notes for the latest Linksys WRT120N firmware, one of the more interesting comments reads:
Firmware 1.0.07 (Build 01)
- Encrypts the configuration file.
Having previouslyreversedtheir firmware obfuscation andpatchedtheir code to re-enable JTAG debugging, I thought that surely I would be able to use this access to reverse this new encryption algorithm used to secure their backup configuration files.
Boy was I giving them way too much credit.
Here’s a diff of two backup configuration files from the WRT120N. The only change made between backups was that the administrator password was changed from “admin” in backup_config_1.bin to “aa” in backup_config_2.bin:
OFFSET backup_config_1.bin backup_config_2.bin
----------------------------------------------------------------------------------------
0x00001468 9E 9B 92 96 91 FF FF FF |........| / 9E 9E FF FF FF FF FF FF |........|
Two things to note here:
- The first letter of each password (“a”) is encrypted to the same value (0x9E)
- The same letter (“a”) is encrypted to the same value (0x9E), regardless of its position in the password
I immediately suspected some sort of simple single-byte XOR encryption. If true, then XORing the known plain text (“a”, aka, 0×61) with the known cipher text (0x9E) should produce the XOR key:
0x61 ^ 0x9E = 0xFF
Applying the XOR key of 0xFF to the other characters in the password gives us:
0x9E ^ 0xFF = a 0x9B ^ 0xFF = d 0x92 ^ 0xFF = m 0x96 ^ 0xFF = i 0x91 ^ 0xFF = n
And XORing every byte in the config file with 0xFF gives us a decrypted config file:
00000000 33 34 35 36 00 01 df 60 00 00 46 ec 76 31 2e 30 |3456...`..F.v1.0|
00000010 2e 30 37 00 00 00 00 00 00 00 00 00 00 00 00 00 |.07.............|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 57 52 54 31 |............WRT1|
00000030 32 30 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 |20N.............|
00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000080 61 64 6d 69 6e 00 00 00 00 00 00 00 00 00 00 00 |admin...........|
00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000000a0 00 00 00 00 00 00 00 00 61 64 6d 69 6e 00 00 00 |........admin...|
000000b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000100 00 00 00 00 00 00 00 00 30 2e 30 2e 30 2e 30 00 |........0.0.0.0.|
00000110 00 00 00 00 00 00 00 00 01 01 01 00 00 00 00 01 |................|
00000120 00 00 00 01 00 00 00 00 00 00 00 08 32 39 34 38 |............2948|
00000130 33 31 30 35 00 01 00 00 00 31 39 32 2e 31 36 38 |3105.....192.168|
00000140 2e 31 2e 31 00 00 00 00 00 32 35 35 2e 32 35 35 |