Richard "mtfnpy" Harman (xabean@infosec.exchange)'s status on Tuesday, 03-Sep-2024 07:59:38 JST

@tychotithonus if you want to poke at it, here you go -- this is for a Yealink SIP phone. Strings in the firmware nearby suggest the password is YealinkPhone1106 but it doesn't seem to work on my hardware; which might be due to the fact that there's a config partition that overlay mounts a shadow file overtop of /etc/shadow from the ROM:

root:$1$.jKlhz0B$/Nmgj0klrsZk0nYc1BLUR/:11876:0:99999:7:::