PPPoE username and password from ZTE ZXHN F680 V6

Question

I'm trying to extract the PPPoE username and password from a ZTE ZXHN F680 V6 router. I have obtained several files from the router and can get access to other files if needed. Here is where I'm at.

I have obtained the cspd file after reading this Q&A. I also have a config.bin file but was unable to determine any information from it using binwalk or strings commnads. Both returned empty results and indicated high level of entropy.

Here is a link to the files extracted from router.

I assume that the PPPoE file will be in an encoded or encrypted or both .xml file. So, my search in the cspd file for strings resulted in potentially useful information.

$ strings cspd | grep .xml
/var/tmp/db_user_cfg.xml
CP download xml doc failed!
/etc/db_user_cfg.xml
please input cfg file(/proc/cfg/db_user_cfg.xml) eg.
/var/tmp/db_cp_cfg.xml
/var/tmp/db_reload_cfg.xml
/var/tmp/db_backup_cfg.xml
/etc/db_default_%s_cfg.xml
/var/tmp/db_Decry_cfg.xml
/var/tmp/usb_rst_cfg.xml
dbc_mgr_file_xml.c
at %d line of xml file
sbsize(%d) xmlsize(%d)
/userconfig/cfg/db_user_cfg.xml
/etc/db_default_cfg.xml
/userconfig/cfg/db_backup_cfg.xml

I think the best candidates for containing the PPPoE username and password are /userconfig/cfg/db_backup_cfg.xml, /userconfig/cfg/db_user_cfg.xml and /etc/db_default_cfg.xml.

I have checked those files using binwalk and it seems they are high level of entropy with only one section (no obvious header), so have been encrypted, not simply encoded:

binwalk -E db_user_cfg.xml
WARNING: Failed to import matplotlib module, visual entropy graphing will be disabled
DECIMAL       HEXADECIMAL     ENTROPY
0             0x0             Rising entropy edge (0.954061)

I following the above linked post I have used Ghidra 10 to de-compile the cspd file and searched for these strings, as well as functions for decryption. I found the following files:

• AES_set_decryption_key
• AESDecrypt
• AESCBCDecry
• dbcCfgSetAesKey
• DecryByAES
• DecryByAESCBC

I think the most likely candidate to get a key for decryption is dbcCfgSetAesKey, but that's only because of the name of the function and the target .xml files have cfg in their names.

The body of the dbcCfgSetAesKey function is below. It only accepts one variable and :

undefined4 dbcCfgSetAesKey(void *param_1)
{
  if (param_1 != (void *)0x0) {
    memcpy(g_szMD5Key,param_1,0x20);
    return 0;
  }
  return 0xffffffff;
}

I searched Ghidra for g_szMD5Key and found there was only a Label with that name, no function. It appears to me that the above dbcCfgSetAesKey function is copying the config file AES key to a memory location to be accessed later by the decryption process. They key may be some type of MD5 hash?

My questions are:

1. What are my options for extracting the key to decrypt the .xml files? Am I right that they PPPoE data will likely be in the above mentioned .xml files?
2. Am I generally on the right track to extract config data from a ZTE router such as ZTE ZXHN F680 V6? I know that they are all different, and have looked at some other tools such as zte-config-utility which I see requires having a key to extract the config files.
3. What am I missing about this approach to reverse-compiling the router configuration.

I know my questions will be rather noob since I am just starting to learn reverse engineering / compiling. I am fairly good with encryption and modes, but not create with Ghidra or C++. If my question is much to simple and uninformed just let me know.