Comments for tiwocBlog

Comment on Recovery of passwords from Draytek Vigor routers by Andy

Andy — Fri, 06 Jan 2012 23:19:01 +0000

Since your substitution list didn’t work for all characters of my Vigor 2500WE config file I adapted it a bit: http://pastebin.com/H5BYNdKP
With that I could recover my password, thanks for your prior work!

Comment on java -jar ignores classpath — Workaround by Jan

Jan — Fri, 02 Sep 2011 08:01:33 +0000

Thanks a lot for sorting that out

Comment on Recovery of passwords from Draytek Vigor routers by Dan

Dan — Tue, 23 Aug 2011 15:49:02 +0000

An easier way that certainly works on the vigour 2820, as I’ve just done it, is to view the frame source code. Search for your user name, and it will be a little further along.

Comment on Recovery of passwords from Draytek Vigor routers by AMMOnium

AMMOnium — Sun, 21 Aug 2011 18:25:23 +0000

I have published the source code here:
https://github.com/ammonium/draytools/
Feel free to use and report bugs.

Comment on Recovery of passwords from Draytek Vigor routers by dan_clarkson

dan_clarkson — Thu, 18 Aug 2011 17:09:23 +0000

Hi I am trying to get hold of a way to read an old dsl password form a draytek 2820, AMMOnium can you let me know what the method was for getting the unencryted config file from the router ?

Comment on Recovery of passwords from Draytek Vigor routers by 28202820

28202820 — Sun, 17 Jul 2011 10:13:21 +0000

AMMOnium. Thank you so much, you stopped me from going insane. You are a genius.

Comment on Recovery of passwords from Draytek Vigor routers by 28202820

28202820 — Sun, 17 Jul 2011 00:56:15 +0000

I’m going to go insane! please publish the details of how to get the password

Comment on Recovery of passwords from Draytek Vigor routers by 28202820

28202820 — Sat, 16 Jul 2011 21:26:14 +0000

All the tea in China kind kind sirfor details on how to strip the password from 2820.cfg. I have no hope in hell of doing any of the funky stuff you just mentioned. We were totally held to ransomed by a networking company and they have refused to give us the password for our 2820.

Comment on Recovery of passwords from Draytek Vigor routers by AMMOnium

AMMOnium — Fri, 01 Jul 2011 17:41:26 +0000

And the most amazing thing is that there IS an undocumented way to get an unencrypted config file from the router, so you can get the whole substitution table in no time, or just backup your configuration (it’s still compressed so you may not find your password there if it had really low entropy).

But that’s too easy and solves the problem for only one particular model.
If you have some patience and go deeper, you can grab the universal algorithm and also the key derivation function.

Comment on Recovery of passwords from Draytek Vigor routers by AMMOnium

AMMOnium — Thu, 30 Jun 2011 23:16:58 +0000

Hi all,

I have just cracked the real “sh*t-cryption” algorithm & also compression for config (and firmware ) of modern Draytek SOHO routers (only tested on 2710, 2820, 2830, but all other V2*** DrayOS-based MIPS boxes should probably be OK).

It was a piece of cake

I don’t want to spoil the fun for you guys, if you want to solve the puzzle on your own,
but if anyone asks, I will surely publish my results.

ammonium ат mail dот ru