One Day SecOne Day Sec

Zyxel Firmware Decryption

Onedaysec
3 min read
0 views
docx image 1769353523648 0 8225534d12

Introduction: This article introduces two general methods for Zyxel firmware decryption and shares details that need to be recorded during the decryption process.

0x00 Preface

This article will introduce two general methods for Zyxel firmware decryption and record test insights.

0x01 Overview

This article will cover the following content:

Basic Knowledge

Decrypting ZIP Files via Known Plaintext Attack

Obtaining ZIP Encryption Passwords by Tracking Process Parameters

0x02 Basic Knowledge

1. Firmware Download

Firmware download address: https://portal.myzyxel.com/my/firmwares

An account registration is required to download the specified version of the firmware.

2. Common Firmware Types

ATP

USG FLEX

VPN

ZyWALL/USG

Here we take VPN50 5.36(ABHL.0) as an example; after downloading, save it as VPN50_V5.36(ABHL.0).zip

Next, we introduce two methods for firmware decryption

0x03 Decrypting zip files via known-plaintext attack

References: https://attackerkb.com/topics/N3i8dxpFKS/cve-2023-28771/rapid7-analysis

The file contents in VPN50_V5.36(ABHL.0).zip are as follows:

536ABHL0C0.bin

536ABHL0C0.conf

536ABHL0C0.db

536ABHL0C0.pdf

536ABHL0C0.ri

VPN50_V5.36(ABHL.0)C0-foss.pdf

Among these, 536ABHL0C0.bin and 536ABHL0C0.db are encrypted and need to be decrypted

Decryption Conditions:

1. The complete plaintext file and zip file are known

2. The plaintext file needs to be compressed using the same compression algorithm

3. The encryption algorithm is ZipCrypto Store

For VPN50_V5.36(ABHL.0).zip, the 536ABHL0C0.conf file is consistent with the db/etc/zyxel/ftp/conf/system-default.conf file in 536ABHL0C0.bin and the etc/zyxel/ftp/conf/system-default.conf file in 536ABHL0C0.db, which satisfies Condition 1

Regarding Condition 2, it is necessary to determine the compression algorithms of 536ABHL0C0.bin and 536ABHL0C0.db. The reference materials do not cover this part either, so the analysis process is detailed here

Check the compression information of db/etc/zyxel/ftp/conf/system-default.conf in 536ABHL0C0.bin: zipdetails -v 536ABHL0C0.bin

Return Result:

IMG_257

IMG_258The compression algorithm obtained is as follows:

IMG_259

Therefore, when compressing 536ABHL0C0.conf, the parameter -9 needs to be added to set it to 'compress better', i.e., Maximum Compression

The complete decryption commands are as follows:

(1) Install pkcrack

IMG_260

(2) Decrypt 536ABHL0C0.bin

IMG_261

(3) Decrypt 536ABHL0C0.db

IMG_262

Note that the absolute paths of system-default.conf in 536ABHL0C0.bin and 536ABHL0C0.db are different

0x04 Obtaining zip encryption password by tracking process parameters

Reference: https://security.humanativaspa.it/zyxel-firmware-extraction-and-password-analysis/

Decryption principle: zld_fsextract can be extracted from .ri files, and zld_fsextract can calculate the decompression password based on the file content to decrypt the .bin file

After testing, using zld_fsextract can also unlock .bin files of other firmwares

1. Extract zld_fsextract

IMG_263

Check file type: file zld_fsextract

Return result: zld_fsextract: ELF 32-bit MSB executable, MIPS, N32 MIPS64 rel2 version 1 (SYSV), statically linked, stripped

It indicates that zld_fsextract is of MIPS architecture, so a MIPS environment needs to be set up to run it

2. Set up MIPS environment

IMG_264

3. Monitor process startup

IMG_265

Note:

Need to add parameter -f to track child processes generated by fork calls, add parameter -s 199 to specify the length of the output string per line in the trace result; if parameter -s is not set, the complete decryption password cannot be recorded

Return result example:

IMG_266

Obtain the decryption password GfmirkjRUJla2evWFLtqJoI5a6vfOmDgR/OIl7lFSWrXBm3S7yJTmdaMlV19HGr from it

Note:

This decryption password does not apply to 536ABHL0C0.db

0x05 Summary

This article introduces two general methods for decrypting Zyxel firmware and shares the details that need to be recorded during the decryption process.

Related Questions & Answers

Does the password obtained via zld_fsextract work for both .bin and .db firmware files?

No. The article notes that the decryption password obtained from tracking `zld_fsextract` parameters works for the .bin file but does not apply to the `536ABHL0C0.db` file. For .db files, the known-plaintext attack method is required instead, using the appropriate absolute path of `system-default.conf` within the archive.

How can I extract the decryption password for a Zyxel .bin firmware file using zld_fsextract?

First, extract the `zld_fsextract` binary from a .ri file and verify it is a MIPS ELF (32-bit MSB, MIPS64 rel2). Set up a MIPS emulation environment (e.g., QEMU), then run `strace -f -s 199` on the execution of `zld_fsextract` with the .bin file. The `-f` flag tracks child processes, and `-s 199` ensures the complete password string is captured. The password appears in the strace output as a long alphanumeric string, as shown in the article.

What conditions must be met for the known-plaintext attack to work on Zyxel firmware ZIP files?

Three conditions are required: (1) The complete plaintext file and the encrypted ZIP must be known; (2) The plaintext file must be compressed using the same algorithm as the target encrypted file (e.g., for `536ABHL0C0.bin`, the `536ABHL0C0.conf` file matches `system-default.conf` and must be compressed with ‘compress better’ or ‘Maximum Compression’); (3) The encryption algorithm used in the ZIP must be ZipCrypto Store.

What are the two general methods for decrypting Zyxel firmware discussed in the article?

The article introduces two methods: first, decrypting ZIP files via a known-plaintext attack using tools like pkcrack; second, obtaining the ZIP encryption password by tracking process parameters with `strace` on a MIPS-emulated environment where `zld_fsextract` runs. Both methods are detailed in the [Zyxel Firmware Decryption](/news/zyxel-firmware-decryption) article.

Continue Reading