Mitrastar HGU GPT-2741GNAC

OS: Linux 2.6.36 with BusyBox

Escalation:
sed -i 's/cmdsh/sh/g' /etc/passwd

Backup cfg decryption key:
openssl aes-256-cbc -k dF4pEeZjRIlmiv7pWW3kgf5g0bqFfsVj -d -in romfile.cfg -out romfile_decrypted.cfg

I used version openssl-1.0.2 (same on router) because it will throw error on newer openssl versions.

Disable Backup encryption option:

/userfs/bin/tcapi set WebCurSet_Entry EncryptFile off
/userfs/bin/tcapi commit WebCurSet_Entry

Now that should let you download and upload the romfile freely with no more encryption. If the tcapi commit gives you a forbidden message. Just do: echo authenticated > /tmp/Authentication