Zyxel EX5601-T0

[Frostis12]

There seems to be new algorithm for Zyxel EX5601-T0 router and possibly other newer models. In libzcfg.so i can find "zcfgBeCommonIsApplyRandomSupervisorPasswordNewAlgorithm"

libzcfg_be.zip

[aka-khalid]

@boginw idk if it's useful, but I downloaded "V550ABPM8.1C0.bin", extracted the "libzcfg_be.so". tried to decompile it using RetDec and got this: libzcfg_be.zip I have ZERO experience in reverse engineering neither in C, so I can't figure out what I should do next. Buy I found a lot of functions in there, I believe these are usueful:

zcfgBeCommonAccountPasswordToSN
zcfgBeCommonAccountPasswordToSN2
zcfgBeCommonIsApplyRandomAdminPassword
zcfgBeCommonIsApplyRandomAdminPassword2
zcfgBeCommonIsApplyRandomAdminPasswordNewAlgorithm
zcfgBeCommonIsApplyRandomAdminPasswordNewAlgorithm2
zcfgBeCommonIsApplyRandomSupervisorPasswordNewAlgorithm
zcfgBeCommonIsApplyRandomSupervisorPasswordNewAlgorithm2

[gilsonolegario]

"GP_Privilege" stands for "http,ssh,telnet,ftp", sometimes "login,httpd,samba"

"X_ZYXEL_LoginCfg": {
"LoginGroupNumberOfEntries": 3,
"LoginGroupConfigurable": true,
"LogGp": [
{
"GP_Privilege": "http,ssh,telnet,ftp",
"Account": [
{
"AutoShowQuickStart": false,
"Enabled": true,
"EnableQuickStart": true,
"Page": "",
"Username": "root",
"Password": "",
"PasswordHash": "",
"Privilege": "login"
},
{
"AutoShowQuickStart": false,
"Enabled": true,
"EnableQuickStart": true,
"Page": "",
"Username": "supervisor",
"Password": "",
"PasswordHash": "",
"Privilege": "login,httpd,samba"
},
{
"AutoShowQuickStart": false,
"Enabled": true,
"EnableQuickStart": true,
"Page": "",
"Username": "kkkk",
"Password": "kkkk",
"PasswordHash": "",
"Privilege": "login,httpd,samba"
}