Jump to content
Tuts 4 You

Help recovering telnet password from firmware


Recommended Posts


I'm not sure if it is right to ask it here, if not please delete and forgive me.


I would like to know the password for telnet access of an IP camera that we own. Firmware image is uImage_userland.


Any information would be greatly appreciated!


Link to comment
Extreme Coders

The firmware is from Ubiquiti, which has a default user/pass as ubnt/ubnt. See here for a list.


In general use binwalk + dd or firmware mod kit to extract the filesystem (cramfs, squashfs etc.) image.

Check the endianness of the image. If it is, say big endian cramfs use cramfsswap to convert it to little endian.


You can then mount the image to view the files inside.

  • Like 1
Link to comment
  • 4 weeks later...

Hello Extreme Coders and thank you for the reply,


The user/pass as ubnt/ubnt was not accepted.


To get things even worse, I don't have the knowledge to do the described procedures :)

Link to comment

binwalk gives 30+ false positives so I didnt extract it but in bold it's likely those are root md5 pw hashes, u have to either crack them w/hashcat or similar or erase + reflash. for telnet u need root pw, it wont be in plaintext.

noroot@mypc:~/firmware$ cat uImage_userland | grep -a root: | awk -F: '{print $2" - Line number : "$1}'
// lots of good info but heres very interesting ..
- Line number : 378214 :root:pass
appweb.pass1[jnW >1: root: Micronet IP Camera: a3b7eeb66e6d854df2db21c7909a8de0
- Line number : 378214
Arupnp1T( ku GBroot:$1$1pZvF3xY$WETN7XS8Zno6jaI0iY8/k0:10933:0:9c:7:
D}init.d1L8a*dk GBroot:$1$1pZvF3xY$AtG1K8SrHNF4j8BnTXTdI/:10933:0:9c:7:
  • Like 2
Link to comment

jg2t4.gif to atom0s and simple! f321V.gif


atom0s, I've tested those and they aren't working really;


simple, I don't have the knowledge to do that, but it seems like very interesting info!

Link to comment
  • 1 year later...

download and install the free unifi controller software from ubiquity.. you might have some luck with that if you can get it to talk to the camera. here i have shown you how to get a debug terminal  :) 


Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...