{"id":673,"date":"2012-11-11T19:59:01","date_gmt":"2012-11-11T19:59:01","guid":{"rendered":"https:\/\/trouble.org\/?p=673"},"modified":"2013-05-22T19:29:41","modified_gmt":"2013-05-22T19:29:41","slug":"avctpasswd","status":"publish","type":"post","link":"https:\/\/trouble.org\/?p=673","title":{"rendered":"avctpasswd"},"content":{"rendered":"

Since I didn’t find it anywhere else… Avocent, who makes a heck of a lot of BMCs, and at times (like with Dell’s iDRAC, at least version 6) keeps encrypted passwords in (well, quite possible\/probable OEM dependent) “\/flash\/data0\/etc\/avctpasswd” (don’t be fooled by the \/etc\/passwd file) using SHA1 hashed passwords converted into Base64.<\/p>\n

I surmise this file is used to protect the real passwords that are stored in clear text elsewhere (among other place, in RAM.)<\/p>\n

[<\/span>WPCM450 ~]<\/span>$ cat<\/span> \/<\/span>flash\/<\/span>data0\/<\/span>etc\/<\/span>avctpasswd
\n@<\/span>:@<\/span>:1<\/span>:1<\/span>:@<\/span>:@<\/span>:\/<\/span>bin\/<\/span>bash:0x0:0<\/span>
\nroot:y2VKyPNvhAAW8EOqPk4GeWUpcE0<\/span>=:2<\/span>:2<\/span>:Administrator:\/<\/span>flash\/<\/span>data0\/<\/span>home\/<\/span>root:\/<\/span>bin\/<\/span>bash:0x1FF:1<\/span>
\ndeadbeef:P7BaFjs7ClrA9v3pSUGbYjYszwA<\/span>=:3<\/span>:0<\/span>:@<\/span>:\/<\/span>flash\/<\/span>data0\/<\/span>home\/<\/span>deadbeef:\/<\/span>bin\/<\/span>bash:0x1FF:1<\/span>
\nxxxdellxxx:JEomstocR9Eyj4xqvFcTiQNDD3k<\/span>=:4<\/span>:0<\/span>:@<\/span>:\/<\/span>flash\/<\/span>data0\/<\/span>home\/<\/span>xxxdellxxx:\/<\/span>bin\/<\/span>bash:0x1FF:1<\/span>
\nfrankenstein:kA0wp2JHtjhBTDU6uo7DlKQThV4<\/span>=:5<\/span>:0<\/span>:@<\/span>:\/<\/span>flash\/<\/span>data0\/<\/span>home\/<\/span>frankenstein:\/<\/span>bin\/<\/span>bash:0x1F3:0<\/span>
\nkcrw:x0hrTCpCdlkj8phYyQcbcmG8yfU<\/span>=:6<\/span>:0<\/span>:@<\/span>:\/<\/span>flash\/<\/span>data0\/<\/span>home\/<\/span>kcrw:\/<\/span>bin\/<\/span>bash:0x1FF:0<\/span>
\ngeorge_orwell:MgaZ38Cxsq9wVSMsmwNIZTDMgk8<\/span>=:7<\/span>:0<\/span>:@<\/span>:\/<\/span>flash\/<\/span>data0\/<\/span>home\/<\/span>george_orwell:\/<\/span>bin\/<\/span>bash:0x1F3:1<\/span>
\n@<\/span>:@<\/span>:8<\/span>:8<\/span>:@<\/span>:@<\/span>:\/<\/span>bin\/<\/span>bash:0x0:0<\/span>
\n@<\/span>:@<\/span>:9<\/span>:9<\/span>:@<\/span>:@<\/span>:\/<\/span>bin\/<\/span>bash:0x0:0<\/span>
\n@<\/span>:@<\/span>:10<\/span>:10<\/span>:@<\/span>:@<\/span>:\/<\/span>bin\/<\/span>bash:0x0:0<\/span>
\n@<\/span>:@<\/span>:11<\/span>:11<\/span>:@<\/span>:@<\/span>:\/<\/span>bin\/<\/span>bash:0x0:0<\/span>
\n@<\/span>:@<\/span>:12<\/span>:12<\/span>:@<\/span>:@<\/span>:\/<\/span>bin\/<\/span>bash:0x0:0<\/span>
\n@<\/span>:@<\/span>:13<\/span>:13<\/span>:@<\/span>:@<\/span>:\/<\/span>bin\/<\/span>bash:0x0:0<\/span>
\n@<\/span>:@<\/span>:14<\/span>:14<\/span>:@<\/span>:@<\/span>:\/<\/span>bin\/<\/span>bash:0x0:0<\/span>
\n@<\/span>:@<\/span>:15<\/span>:15<\/span>:@<\/span>:@<\/span>:\/<\/span>bin\/<\/span>bash:0x0:0<\/span>
\n@<\/span>:@<\/span>:16<\/span>:16<\/span>:@<\/span>:@<\/span>:\/<\/span>bin\/<\/span>bash:0x0:0<\/span><\/div><\/div>\n

This seemingly missing accounts are simply unused slots in the BMC, which allows 16 user defined accounts. A little python program to illustrate (the hashes below, from known passwords, match the hashes above):<\/p>\n

$ cat p.py<\/span>
\nfrom<\/span> sha<\/span> import<\/span> sha<\/span>
\nimport<\/span> base64<\/span>
\nimport<\/span> hashlib
\n
\n# for these known passwords, print out the hash<\/span>
\nfor<\/span> passwd in<\/span> "hprulez"<\/span>,<\/span> "ecclectic"<\/span>,<\/span> "calvin"<\/span>,<\/span> "lagosi"<\/span>,<\/span> "frued"<\/span>,<\/span> "zen"<\/span>:
\nhash<\/span> =<\/span> base64<\/span>.b64encode<\/span>(<\/span>hashlib.sha1<\/span>(<\/span>passwd)<\/span>.digest<\/span>(<\/span>)<\/span>)<\/span>
\nprint<\/span> passwd + " hash: "<\/span> + hash<\/span>
\n
\n$ python p.py<\/span>
\nhprulez =<\/span> JEomstocR9Eyj4xqvFcTiQNDD3k=<\/span>
\necclectic =<\/span> x0hrTCpCdlkj8phYyQcbcmG8yfU=<\/span>
\ncalvin =<\/span> y2VKyPNvhAAW8EOqPk4GeWUpcE0=<\/span>
\nlagosi =<\/span> kA0wp2JHtjhBTDU6uo7DlKQThV4=<\/span>
\nfrued =<\/span> MgaZ38Cxsq9wVSMsmwNIZTDMgk8=<\/span>
\nzen =<\/span> P7BaFjs7ClrA9v3pSUGbYjYszwA=<\/span><\/div><\/div>\n

(edit later) And for good measure, a stupid little password cracker that I used later when looking for a password that matched a specific hash ;) Use john the ripper or something unless situation is dire!<\/p>\n

#!\/usr\/bin\/python<\/span>
\nfrom<\/span>   sha<\/span> import<\/span> sha<\/span>
\nimport<\/span> base64<\/span>
\nimport<\/span> hashlib
\nimport<\/span> sys<\/span>
\n
\n# we're looking for this<\/span>
\nprehash =<\/span> 'XtdLbGTpY0nSIpw\/uchvPXPOHpo='<\/span>
\n
\ntry<\/span>:
\n   passwords =<\/span> open<\/span>(<\/span>sys<\/span>.argv<\/span>[<\/span>1<\/span>]<\/span>)<\/span>.read<\/span>(<\/span>)<\/span>.split<\/span>(<\/span>'\\n<\/span>'<\/span>)<\/span>
\nexcept<\/span>:
\n   print<\/span> "Usage: %s word-file"<\/span>
\n   sys<\/span>.exit<\/span>(<\/span>1<\/span>)<\/span>
\n
\n# print # for every... xth word<\/span>
\nx =<\/span> 1000000<\/span>
\nn =<\/span> 0<\/span>
\n
\nprint<\/span> "looking for password that when hashed matches "<\/span> + prehash
\nfor<\/span> p in<\/span> passwords:
\n   n +=<\/span> 1<\/span>
\n   if<\/span> p ==<\/span> ""<\/span>:
\n      continue<\/span>
\n   hashy =<\/span> base64<\/span>.b64encode<\/span>(<\/span>hashlib.sha1<\/span>(<\/span>p)<\/span>.digest<\/span>(<\/span>)<\/span>)<\/span>
\n   # print "pass:" + p + ":\\t" , hashy<\/span>
\n   if<\/span> hashy ==<\/span> 'XtdLbGTpY0nSIpw\/uchvPXPOHpo='<\/span>:
\n      print<\/span> "match: %s cracked (word # %s in file) ==> %s"<\/span> % (<\/span>hashy,<\/span> n,<\/span> p)<\/span>
\n      sys<\/span>.exit<\/span>(<\/span>0<\/span>)<\/span>
\n
\n   if<\/span> (<\/span>n % x)<\/span> ==<\/span> 0<\/span>:
\n      print<\/span> n
\n
\nsys<\/span>.exit<\/span>(<\/span>1<\/span>)<\/span><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"

Since I didn’t find it anywhere else… Avocent, who makes a heck of a lot of BMCs, and at times (like with Dell’s iDRAC, at least version 6) keeps encrypted passwords in (well, quite possible\/probable OEM dependent) “\/flash\/data0\/etc\/avctpasswd” (don’t be fooled by the \/etc\/passwd file) using SHA1 hashed passwords converted into Base64. I surmise this […]<\/p>\n","protected":false},"author":44,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31,146,154,172,4,6],"tags":[175,174,158,113,173],"class_list":["post-673","post","type-post","status-publish","format-standard","hentry","category-code","category-hack","category-ipmi-2","category-python","category-security","category-tech","tag-all-that-jazz","tag-avocent","tag-bmc","tag-ipmi","tag-under-the-hood"],"_links":{"self":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/673","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=673"}],"version-history":[{"count":25,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/673\/revisions"}],"predecessor-version":[{"id":706,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/673\/revisions\/706"}],"wp:attachment":[{"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=673"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=673"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=673"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}