lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAOJKFBBg7OVtJFC_ti6wQTpZpxygj9HdNpPZwGM39ZOTqJUQZg@mail.gmail.com> Date: Thu, 10 Sep 2015 12:03:05 -0500 From: Brandon Perry <bperry.volatile@...il.com> To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org> Subject: [FD] Raritan PowerIQ default credentials Hello list, Raritan PowerIQ ships with a few default accounts and passwords/hashes. For the web interface, there are technically 3 default users. web_api:sl33p30F00dumass! epiq_api:raritan admin:raritan You can technically authenticate with the epiq_api user on the web interface and the PowerIQ API, but can't do anything (as far as I can tell). The web_api user seems disabled by default. The password hashes are salted and shasum'd with salts stored next to the passwords in the database. shasum("--salt--pass--") Some password hashes on the file system. $1$MKq.819X$xEoWD6Lu4vcGFmZvF8H.M. -- drag0n -- seems like a development/temp password $1$A0O1SyDL$NhsID.NJdZkkbh1SS4tXz/ $1$JoxiePCF$UxrFdjuBa351WSwC9coP7/ $1$lkaK891$wnnnDvFd3qpJ8H/MHZs.T1 -- drag0n -- seems like a development/temp password I have been unable to crack the two middle passwords, but these were taken from the setup configuration file and seem hardcoded. -- http://volatile-minds.blogspot.com -- blog http://www.volatileminds.net -- website _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists