Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.


      I have a DVR server with linux embeded. It has some telnet functions but i don't have the password for it (the chinese manufacturer refuses to give me the password). I did get a upgrade folder from them and found a passwd file inside.
      So i assume that when i upgrade the firmware the password in that file will be used.
      Now i am trying to modify the file so taht i can insert a password i already know.
      The problem is that i don't know how to create the password hash from what i figured the password hash is $1$1/lfbDKX$Hmd.FqzB8IZEohPesYi961
      The file is named rom.ko and i found a command

telnetd
/mnt/yaffs/web/boa -c /mnt/yaffs/web &
/bin/cp -f /mnt/yaffs/rom.ko /etc/shadow 

in a script file so i assume this is the right way.
      Can you help me reconstruct a password that i know already? Tell me how or make one for me :) ?...


passwd file:
root:$1$1/lfbDKX$Hmd.FqzB8IZEohPesYi961:0:0:99999:7:-1:-1:33637592
bin::10897:0:99999:7:::
daemon:
:10897:0:99999:7:::
adm::10897:0:99999:7:::
lp:
:10897:0:99999:7:::
sync::10897:0:99999:7:::
shutdown:
:10897:0:99999:7:::
halt::10897:0:99999:7:::
mail:
:10897:0:99999:7:::
news::10897:0:99999:7:::
uucp:
:10897:0:99999:7:::
operator::10897:0:99999:7:::
games:
:10897:0:99999:7:::
gopher::10897:0:99999:7:::
ftp:
:10897:0:99999:7:::
nobody::10897:0:99999:7:::
next:
:11702:0:99999:7:::

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

If you are going to reset the password to your own, just remove the password hash for root in the rom.ko file and update the system. As long as there is not some update / integrity hash check on the update bundle this will effectively remove the root password/make it blank. You may still have to telnet in as a normal user and do a 'su' since direct root telnet / ssh is often disabled(a good thing).

John the Ripper is one of the most popular password crackers out there. If the update is hash protected / validated give it a try.

Good Luck!

share|improve this answer
    
i just installed jack on a test machine and run: "screen john -session:dvr -incremental:all /etc/shadow" is this ok ? –  s.mihai Jun 10 '10 at 15:40
    
just so that i can restore i will run: "screen john -restore:dvr"... hope this works :-s –  s.mihai Jun 10 '10 at 15:42
add comment

You will need the makepasswd command for this to work, but you should be able to do the following:

%echo "mypassword" | makepasswd --clearfrom=- --crypt-md5

Which should yield the following:

mypassword $1$ihlrowCw$45PvXmJvoJksKqNkoFi8s/

And you should be able to paste that into the root: area in the /etc/shadow file. However, don't come knocking on my door if this hoses your DVR.

share|improve this answer
    
on one of my development servers i have the "admin" password and the hash: $1$StfWoOhs$Enf0BtCwguKIlf096GU7c0 in the /etc/shadow file when i tried "%echo "admin" | makepasswd --clearfrom=- --crypt-md5" i received $1$0XSwfLKU$2At/XvjeOOyV2khu8UlX9/ any ideas on this ? –  s.mihai Jun 10 '10 at 15:04
    
Every time you run that command it generates a unique salt which it appends to the text you're hashing. So you can run that command a dozen times and get a dozen unique results. The has is the part between the 2nd and 3rd $ signs –  Josh Budde Jun 10 '10 at 15:41
    
yes. i get the idea. i will try and get the has in the firmware and then upgrade the firmware when i reach the headquarters where the dvr is placed at. for the time beeing i fired up a johnTheRipper session maby i get lucky :-?? –  s.mihai Jun 10 '10 at 15:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.