Raritan PowerIQ default credentials

[Brandon Perry <bperry.volatile () gmail com>]

Hello list,

Raritan PowerIQ ships with a few default accounts and passwords/hashes.

For the web interface, there are technically 3 default users.

web_api:sl33p30F00dumass!
epiq_api:raritan
admin:raritan

You can technically authenticate with the epiq_api user on the web
interface and the PowerIQ API, but can't do anything (as far as I can
tell). The web_api user seems disabled by default.

The password hashes are salted and shasum'd with salts stored next to the
passwords in the database.

shasum("--salt--pass--")

Some password hashes on the file system.

$1$MKq.819X$xEoWD6Lu4vcGFmZvF8H.M. -- drag0n -- seems like a
development/temp password
$1$A0O1SyDL$NhsID.NJdZkkbh1SS4tXz/
$1$JoxiePCF$UxrFdjuBa351WSwC9coP7/
$1$lkaK891$wnnnDvFd3qpJ8H/MHZs.T1 -- drag0n -- seems like a
development/temp password

I have been unable to crack the two middle passwords, but these were taken
from the setup configuration file and seem hardcoded.

-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/