Jump to content
Tuts 4 You
Sign in to follow this  
david.lynch

Help recovering telnet password from firmware

Recommended Posts

david.lynch

I'm not sure if it is right to ask it here, if not please delete and forgive me.


 


I would like to know the password for telnet access of an IP camera that we own. Firmware image is uImage_userland.


 


Any information would be greatly appreciated!


 


Share this post


Link to post
Extreme Coders

The firmware is from Ubiquiti, which has a default user/pass as ubnt/ubnt. See here for a list.


 


In general use binwalk + dd or firmware mod kit to extract the filesystem (cramfs, squashfs etc.) image.


Check the endianness of the image. If it is, say big endian cramfs use cramfsswap to convert it to little endian.


 


You can then mount the image to view the files inside.


  • Like 2

Share this post


Link to post
david.lynch

Hello Extreme Coders and thank you for the reply,


 


The user/pass as ubnt/ubnt was not accepted.


 


To get things even worse, I don't have the knowledge to do the described procedures :)


Share this post


Link to post
atom0s

Skimming through the file looking at what could be combo's from in it:

Admin / 1234

root / webtex

gleason / my.password

  • Like 1

Share this post


Link to post
simple

binwalk gives 30+ false positives so I didnt extract it but in bold it's likely those are root md5 pw hashes, u have to either crack them w/hashcat or similar or erase + reflash. for telnet u need root pw, it wont be in plaintext.



noroot@mypc:~/firmware$ cat uImage_userland | grep -a root: | awk -F: '{print $2" - Line number : "$1}'
// lots of good info but heres very interesting ..
- Line number : 378214 :root:pass
378216:^T^T^T1a1jDPohBV
appweb.pass1[jnW >1: root: Micronet IP Camera: a3b7eeb66e6d854df2db21c7909a8de0
- Line number : 378214
root:1:1:1:1
378511:1l%ktk
Arupnp1T( ku GBroot:$1$1pZvF3xY$WETN7XS8Zno6jaI0iY8/k0:10933:0:9c:7:
D}init.d1L8a*dk GBroot:$1$1pZvF3xY$AtG1K8SrHNF4j8BnTXTdI/:10933:0:9c:7:
  • Like 2

Share this post


Link to post
david.lynch

jg2t4.gif to atom0s and simple! f321V.gif


 


atom0s, I've tested those and they aren't working really;


 


simple, I don't have the knowledge to do that, but it seems like very interesting info!


Share this post


Link to post
secursig

download and install the free unifi controller software from ubiquity.. you might have some luck with that if you can get it to talk to the camera. here i have shown you how to get a debug terminal  :) 

busyboxubnt.thumb.png.a05f2793eb2fc2a2cf7d41ce776cedb2.png

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
×
×
  • Create New...