Raritan PowerIQ ships with three default backdoor credentials left in.
2dcd98105d78a18b206ac52d081745dcf42c639e862b7b25a8d8a0c7ab5e2c5e
Hello list,
Raritan PowerIQ ships with a few default accounts and passwords/hashes.
For the web interface, there are technically 3 default users.
web_api:sl33p30F00dumass!
epiq_api:raritan
admin:raritan
You can technically authenticate with the epiq_api user on the web
interface and the PowerIQ API, but can't do anything (as far as I can
tell). The web_api user seems disabled by default.
The password hashes are salted and shasum'd with salts stored next to the
passwords in the database.
shasum("--salt--pass--")
Some password hashes on the file system.
$1$MKq.819X$xEoWD6Lu4vcGFmZvF8H.M. -- drag0n -- seems like a
development/temp password
$1$A0O1SyDL$NhsID.NJdZkkbh1SS4tXz/
$1$JoxiePCF$UxrFdjuBa351WSwC9coP7/
$1$lkaK891$wnnnDvFd3qpJ8H/MHZs.T1 -- drag0n -- seems like a
development/temp password
I have been unable to crack the two middle passwords, but these were taken
from the setup configuration file and seem hardcoded.
--
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website