Help recovering telnet password from firmware

[david.lynch]

I'm not sure if it is right to ask it here, if not please delete and forgive me.

 

I would like to know the password for telnet access of an IP camera that we own. Firmware image is uImage_userland.

 

Any information would be greatly appreciated!

 

[Extreme Coders]

The firmware is from Ubiquiti, which has a default user/pass as ubnt/ubnt. See here for a list.

 

In general use binwalk + dd or firmware mod kit to extract the filesystem (cramfs, squashfs etc.) image.

Check the endianness of the image. If it is, say big endian cramfs use cramfsswap to convert it to little endian.

 

You can then mount the image to view the files inside.

[david.lynch]

Hello Extreme Coders and thank you for the reply,

 

The user/pass as ubnt/ubnt was not accepted.

 

To get things even worse, I don't have the knowledge to do the described procedures

[atom0s]

Skimming through the file looking at what could be combo's from in it:

Admin / 1234

root / webtex

gleason / my.password

[simple]

binwalk gives 30+ false positives so I didnt extract it but in bold it's likely those are root md5 pw hashes, u have to either crack them w/hashcat or similar or erase + reflash. for telnet u need root pw, it wont be in plaintext.

noroot@mypc:~/firmware$ cat uImage_userland | grep -a root: | awk -F: '{print $2" - Line number : "$1}'

// lots of good info but heres very interesting ..

- Line number : 378214 :root:pass

378216:^T^T^T1a1jDPohBV

                                          appweb.pass1[jnW >1: root: Micronet IP Camera: a3b7eeb66e6d854df2db21c7909a8de0

- Line number : 378214 

root:1:1:1:1

378511:1l%ktk

Arupnp1T( ku GBroot:$1$1pZvF3xY$WETN7XS8Zno6jaI0iY8/k0:10933:0:9c:7:

D}init.d1L8a*dk GBroot:$1$1pZvF3xY$AtG1K8SrHNF4j8BnTXTdI/:10933:0:9c:7:

[david.lynch]

to atom0s and simple!

 

atom0s, I've tested those and they aren't working really;

 

simple, I don't have the knowledge to do that, but it seems like very interesting info!

[secursig]

download and install the free unifi controller software from ubiquity.. you might have some luck with that if you can get it to talk to the camera. here i have shown you how to get a debug terminal