Series

JioFiber Router

How I explored a JioFiber JCO4032 router: decrypting its configuration backup, tracing the restore path, and eventually getting root access.

Part 1Nov 7, 20264 min read
Decrypting the JioFiber Router Config Backup (.enc)
My JioFiber JCO4032 router saved its configuration as an encrypted .enc file. I found the firmware code that created it, decrypted it with OpenSSL, and then hit the checksum that protected edited backups.
Part 2Nov 7, 20265 min read
How the JioFiber Router Restores an Encrypted Config Backup
After decrypting my JioFiber router backup, I traced its restore code, found how the checksum was verified, and discovered that the configuration was executed as Lua.
Part 3Nov 7, 20264 min read
How I Got Root Access to My JioFiber Router
The JioFiber restore path executed its decrypted configuration as Lua before checking the checksum. I used that behavior to start Telnet and get a root shell.