Netgear configuration file is a password protected ZIP?

Sizzlechest

Regular Contributor
I was poking around the Netgear backup file for my RAX42 router to see if any of my settings were in ASCII. I discovered the file appears to be a password protected ZIP of "backup.cfg"

I tried my router password as the zip password, but that didn't work. Has anyone figured out what the password for the backup file is?
 

OzarkEdge

Part of the Furniture
I was poking around the Netgear backup file for my RAX42 router to see if any of my settings were in ASCII. I discovered the file appears to be a password protected ZIP of "backup.cfg"

I tried my router password as the zip password, but that didn't work. Has anyone figured out what the password for the backup file is?

I would assume the password protection is meant to protect, and that revealing the password would defeat this.

OE
 

fossil

Occasional Visitor
I was poking around the Netgear backup file for my RAX42 router to see if any of my settings were in ASCII. I discovered the file appears to be a password protected ZIP of "backup.cfg"

I tried my router password as the zip password, but that didn't work. Has anyone figured out what the password for the backup file is?
I opened R7800 cfg and there is no ascii/text info in it, not even IP. I assume RAX42 cfg config might be same as well.

There was a vulnerability reported for RAX43 backup config zip password sometime back, NG was using a hard coded password for zipped config. I think that was fixed by NG, most probably NG is using some randomly generated password for the zipped config now. You can check it at below link, they mentioned the hard coded password NG was using and give it a try.

https://vuldb.com/?id.189488

I prefer to keep both cfg and ascii/text backup. Below cmd will create ascii/text backup of all nvram vars in file "text_bkp_config":
nvram show | sort >/opt/text_bkp_config
 
Last edited:

Sizzlechest

Regular Contributor
I opened R7800 cfg and there is no ascii/text info in it, not even IP. I assume RAX42 cfg config might be same as well.

There was a vulnerability reported for RAX43 backup config zip password sometime back, NG was using a hard coded password for zipped config. I think that was fixed by NG, most probably NG is using some randomly generated password for the zipped config now. You can check it at below link, they mantioned the hard coded password NG was using and give it a try.

https://vuldb.com/?id.189488

I prefer to keep both cfg and ascii/text backup. Below cmd will create ascii/text backup of all nvram vars in file "text_bkp_config":
Oh my goodness. That's the password. And I should note that I'm using the latest firmware. Extracting the backup cfg file with 7zip yields an XML file with all the settings.

Yes, the R7800 backup config file is different. It's not a ZIP file. The one from this router is.

BTW, I tried to enable telnet, but there's no option for it in the debug menu for this router.
 
Last edited:

fossil

Occasional Visitor
Oh my goodness. That's the password. And I should note that I'm using the latest firmware. Extracting the backup cfg file with 7zip yields an XML file with all the settings.

Yes, the R7800 backup config file is different. It's not a ZIP file. The one from this router is.
That might be one of the reason they started using password protected zip in newer models rather than using the binary cfg like R7800. (Also there are some default settings that they do not want user to change in the backup config). I don't have RAX model that is why I was not sure.

BTW, I tried to enable telnet, but there's no option for it in the debug menu for this router.
They removed telnet from R7800 debug menu after firmware version .68. I know few other models as well in which they removed telnet access from firmware in phases. RAX42 might be among them as well. It is the Voxel firmware that is keeping the Telnet access alive in R7800. Try Voxel firmware if it is available for your router model.
 

fossil

Occasional Visitor
Thanks that is a great utility, it could be very useful in case of Nand failures for the bad batch of R7800 with Macronix Nands. My R7800 has Micron Nand (MT29F1G08ABBEAH4), one from the earliest batches.

I do keep both cfg and txt bkps through a script. I figured the cmds from nvram binary, it has usage instructions. Only time I use UI is when I have to update the firmware, everything else through scripts.

nvram-usage.png
 

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top