Full Disclosure mailing list archives

By Date By Thread Raritan PowerIQ default credentials From: Brandon Perry <bperry.volatile () gmail com>

Date: Thu, 10 Sep 2015 12:03:05 -0500

Hello list, Raritan PowerIQ ships with a few default accounts and passwords/hashes. For the web interface, there are technically 3 default users. web_api:sl33p30F00dumass! epiq_api:raritan admin:raritan You can technically authenticate with the epiq_api user on the web interface and the PowerIQ API, but can't do anything (as far as I can tell). The web_api user seems disabled by default. The password hashes are salted and shasum'd with salts stored next to the passwords in the database. shasum("--salt--pass--") Some password hashes on the file system. $1$MKq.819X$xEoWD6Lu4vcGFmZvF8H.M. -- drag0n -- seems like a development/temp password $1$A0O1SyDL$NhsID.NJdZkkbh1SS4tXz/ $1$JoxiePCF$UxrFdjuBa351WSwC9coP7/ $1$lkaK891$wnnnDvFd3qpJ8H/MHZs.T1 -- drag0n -- seems like a development/temp password I have been unable to crack the two middle passwords, but these were taken from the setup configuration file and seem hardcoded. -- http://volatile-minds.blogspot.com -- blog http://www.volatileminds.net -- website _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/ By Date By Thread Current thread: Raritan PowerIQ default credentials Brandon Perry (Sep 10)