Since we have plain unpacked firmware images (wich we can flash to the device etc.) i don't understand where the SSH password is stored, i did some research and checked these files:
/etc/passwd
Code: Select all
root:x:0:0:root:/root:/bin/ash
ftp:*:55:55:ftp:/home/ftp:/bin/false
network:*:101:101:network:/var:/bin/false
nobody:*:65534:65534:nobody:/var:/bin/false
daemon:*:65534:65534:daemon:/var:/bin/false
stretch:$1$9lXRHfBm$YqKT/lan.UNQmWYRwVhWV1:1000:1000:Stretch User:/home/stretch:/usr/bin/pwstick2clishell
nginx:*:1001:1001:nginx:/dev/null:/bin/false
userp1:$1$Bmzo2ajH$j6QP4AwbNbp2sbMcwYAkh.:1002:1002:p1_user:/dev/null:/bin/ash
Code: Select all
root:$1$lSwEj9Zc$.d1Eog99MMdeZ2PjPxe7x1:15335:0:99999:7:::
daemon:*:0:0:99999:7:::
ftp:*:0:0:99999:7:::
network:*:0:0:99999:7:::
nobody:*:0:0:99999:7:::
So we have these (salted) UNIX MD5 hashes:
user "root":
Code: Select all
$1$lSwEj9Zc$.d1Eog99MMdeZ2PjPxe7x1
Code: Select all
$1$9lXRHfBm$YqKT/lan.UNQmWYRwVhWV1
Code: Select all
$1$Bmzo2ajH$j6QP4AwbNbp2sbMcwYAkh.
![Wink ;-)](./images/smilies/icon_wink.gif)
user: root, password: root
user: stretch, password: stretch
user: userp1, password: userp1
Here is a hashcat screen of the results: But entering these in a SSH session doesn't work: So why can't we login with these credentials? am i missing something?