Conversation

Notices

1. Embed this notice
   Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Friday, 21-Feb-2025 17:14:09 JST Ryan Castellucci :nonbinary_flag:

   Oh, neat, I found a second backdoor account on the EnGenius serial console that wasn't picked up by strings because it's too short.

   Password "pe" (the serial console doesn't ask for a username) drops you into a manufacturer test tool. You can get a root shell from there with "cmd sh".

   • Embed this notice
     Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Friday, 21-Feb-2025 17:18:28 JST Ryan Castellucci :nonbinary_flag:

     in reply to

     The first backdoor password I found was "hom18" which drops you right into a root shell.

   • Embed this notice
     Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Friday, 21-Feb-2025 18:10:23 JST Ryan Castellucci :nonbinary_flag:

     in reply to

     Apparently the serial console password on basically all EnGenius devices that I have firmware dumps for is "hom18".

   • Embed this notice
     D2 (inkomtech@infosec.exchange)'s status on Friday, 21-Feb-2025 20:42:36 JST D2

     in reply to

     @ryanc not hom1e or hom13?!

     Huh. I’m so bent from all (hand waves) *THIS*, I’m getting grumpy over a minor leetspeak opportunity.