Skip to content

Instantly share code, notes, and snippets.

@ayumuate
Last active February 6, 2024 17:30
Show Gist options
  • Save ayumuate/03e4ed513e15a113a6379301f899d24b to your computer and use it in GitHub Desktop.
Save ayumuate/03e4ed513e15a113a6379301f899d24b to your computer and use it in GitHub Desktop.
Decrypts the password of some China Telecom's routers (e.g. MR622-KK).
// At very first, you need to obtain the encrypted password from (response).BASEINFO.baseinfoSet_USERPASSWORD at http://192.168.1.1:8080/cgi-bin/baseinfoSet.cgi.
// The relation of the numbers and their corresponding characters.
const table = [[69,"A"],[70,"B"],[71,"C"],[72,"D"],[73,"E"],[74,"F"],[75,"G"],[76,"H"],[77,"I"],[78,"J"],[79,"K"],[80,"L"],[81,"M"],[82,"N"],[83,"O"],[84,"P"],[85,"Q"],[86,"R"],[87,"S"],[88,"T"],[89,"U"],[90,"V"],[65,"W"],[66,"X"],[67,"Y"],[68,"Z"],[101,"a"],[102,"b"],[103,"c"],[104,"d"],[105,"e"],[106,"f"],[107,"g"],[108,"h"],[109,"i"],[110,"j"],[111,"k"],[112,"l"],[113,"m"],[114,"n"],[115,"o"],[116,"p"],[117,"q"],[118,"r"],[119,"s"],[120,"t"],[121,"u"],[122,"v"],[97,"w"],[98,"x"],[99,"y"],[100,"z"],[48,"0"],[49,"1"],[50,"2"],[51,"3"],[52,"4"],[53,"5"],[54,"6"],[55,"7"],[56,"8"],[57,"9"],[91,"["],[93,"]"],[33,"!"],[64,"@"],[35,"#"],[36,"$"],[37,"%"],[94,"^"],[42,"*"],[40,"("],[41,")"],[95,"_"],[43,"+"],[123,"{"],[125,"}"],[124,"|"],[59,";"],[58,":"],[46,"."],[44,","],[47,"/"],[63,"?"],[null,null]];
// Decryption function.
const d = p => p.split('&').map(c => {
for(let [code, char] of table)
if(code === parseInt(c)) return char;
}).join('');
// Decrypt the password.
console.log(d(`71&89&69&104&113&109&114`)); // CUAdmin
@ayumuate
Copy link
Author

ayumuate commented Feb 6, 2024

If you'd like to make the process easier, you can simply paste and run the code below in the cgi page using DevTools mentioned above:

const table = [[69,"A"],[70,"B"],[71,"C"],[72,"D"],[73,"E"],[74,"F"],[75,"G"],[76,"H"],[77,"I"],[78,"J"],[79,"K"],[80,"L"],[81,"M"],[82,"N"],[83,"O"],[84,"P"],[85,"Q"],[86,"R"],[87,"S"],[88,"T"],[89,"U"],[90,"V"],[65,"W"],[66,"X"],[67,"Y"],[68,"Z"],[101,"a"],[102,"b"],[103,"c"],[104,"d"],[105,"e"],[106,"f"],[107,"g"],[108,"h"],[109,"i"],[110,"j"],[111,"k"],[112,"l"],[113,"m"],[114,"n"],[115,"o"],[116,"p"],[117,"q"],[118,"r"],[119,"s"],[120,"t"],[121,"u"],[122,"v"],[97,"w"],[98,"x"],[99,"y"],[100,"z"],[48,"0"],[49,"1"],[50,"2"],[51,"3"],[52,"4"],[53,"5"],[54,"6"],[55,"7"],[56,"8"],[57,"9"],[91,"["],[93,"]"],[33,"!"],[64,"@"],[35,"#"],[36,"$"],[37,"%"],[94,"^"],[42,"*"],[40,"("],[41,")"],[95,"_"],[43,"+"],[123,"{"],[125,"}"],[124,"|"],[59,";"],[58,":"],[46,"."],[44,","],[47,"/"],[63,"?"],[null,null]];const d = p => p.split('&').map(c => {for(let [code, char] of table)if(code === parseInt(c)) return char;}).join('');console.log(d(JSON.parse(document.body.innerText).BASEINFOSET.baseinfoSet_TELECOMPASSWORD));

where I merely replaced the encrypted string with the actual encrypted string.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment