0

      I have a DVR server with linux embeded. It has some telnet functions but i don't have the password for it (the chinese manufacturer refuses to give me the password). I did get a upgrade folder from them and found a passwd file inside.
      So i assume that when i upgrade the firmware the password in that file will be used.
      Now i am trying to modify the file so taht i can insert a password i already know.
      The problem is that i don't know how to create the password hash from what i figured the password hash is $1$1/lfbDKX$Hmd.FqzB8IZEohPesYi961
      The file is named rom.ko and i found a command 

telnetd
/mnt/yaffs/web/boa -c /mnt/yaffs/web &
/bin/cp -f /mnt/yaffs/rom.ko /etc/shadow

in a script file so i assume this is the right way.
      Can you help me reconstruct a password that i know already? Tell me how or make one for me :) ?...

passwd file:
root:$1$1/lfbDKX$Hmd.FqzB8IZEohPesYi961:0:0:99999:7:-1:-1:33637592
bin::10897:0:99999:7:::
daemon::10897:0:99999:7:::
adm::10897:0:99999:7:::
lp::10897:0:99999:7:::
sync::10897:0:99999:7:::
shutdown::10897:0:99999:7:::
halt::10897:0:99999:7:::
mail::10897:0:99999:7:::
news::10897:0:99999:7:::
uucp::10897:0:99999:7:::
operator::10897:0:99999:7:::
games::10897:0:99999:7:::
gopher::10897:0:99999:7:::
ftp::10897:0:99999:7:::
nobody::10897:0:99999:7:::
next::11702:0:99999:7:::

Improve this question

2 Answers 2

Reset to default
1

If you are going to reset the password to your own, just remove the password hash for root in the rom.ko file and update the system. As long as there is not some update / integrity hash check on the update bundle this will effectively remove the root password/make it blank. You may still have to telnet in as a normal user and do a 'su' since direct root telnet / ssh is often disabled(a good thing).

John the Ripper is one of the most popular password crackers out there. If the update is hash protected / validated give it a try.

Good Luck!

Improve this answer
2
  • i just installed jack on a test machine and run: "screen john -session:dvr -incremental:all /etc/shadow" is this ok ?
    – s.mihai
    Jun 10, 2010 at 15:40
  • just so that i can restore i will run: "screen john -restore:dvr"... hope this works :-s
    – s.mihai
    Jun 10, 2010 at 15:42
0

You will need the makepasswd command for this to work, but you should be able to do the following:

%echo "mypassword" | makepasswd --clearfrom=- --crypt-md5

Which should yield the following:

mypassword $1$ihlrowCw$45PvXmJvoJksKqNkoFi8s/

And you should be able to paste that into the root: area in the /etc/shadow file. However, don't come knocking on my door if this hoses your DVR.

Improve this answer
3
  • on one of my development servers i have the "admin" password and the hash: $1$StfWoOhs$Enf0BtCwguKIlf096GU7c0 in the /etc/shadow file when i tried "%echo "admin" | makepasswd --clearfrom=- --crypt-md5" i received $1$0XSwfLKU$2At/XvjeOOyV2khu8UlX9/ any ideas on this ?
    – s.mihai
    Jun 10, 2010 at 15:04
  • Every time you run that command it generates a unique salt which it appends to the text you're hashing. So you can run that command a dozen times and get a dozen unique results. The has is the part between the 2nd and 3rd $ signs
    – Josh Budde
    Jun 10, 2010 at 15:41
  • yes. i get the idea. i will try and get the has in the firmware and then upgrade the firmware when i reach the headquarters where the dvr is placed at. for the time beeing i fired up a johnTheRipper session maby i get lucky :-??
    – s.mihai
    Jun 10, 2010 at 15:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .