I found a binary on a device I've been working on, it's called
genrandpass and the only user input is a public key (which is a .bin file) that's stored locally on the device. It also gathers some other information, possibly from the environment to produce three passwords (there is a reference to the Box ID using
strings). Looking thru the shell scripts pertaining to
genrandpass, it takes the three generated passwords and:
- uses the first password as the root password
- uses the second password is called
$epassand the third is called
$spass(I only note the names in case it means anything to someone smarter than I.)
- it then copies
$spassto the dropbear banner file and these are displayed whenever someone connects to dropbear (prior to even logging in).
This makes me think that the developer had intended on being able to use the
$spass variables to generate the actual root password. There are a few certificates and one Private key (decryption.pem) on the box itself. Not sure if it's the right key to decipher the code but I'd like to try because I have a few other models of these boxes that I haven't been able to break into yet. I'm just not sure what the correct commands are to try. Any ideas?
genrandpass file at https://dl.dropboxusercontent.com/u/23091/genrandpass
examples of the last 2 passwords generated: