gabonator/password.txt

ShravanSinghRathore · 2024-12-01T06:58:53Z

root:$1$soidjfoi$9klIbmCLq2JjYwKfEA5rH1:10933:0:99999:7:::

help me with this to crack down anyone

ZervoTheProtogen · 2024-12-18T20:02:39Z

Hi everybody. Can you help me decrypt shadow on AK3918EN080 V200 (Anyka)? root:$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1:0:0:99999:7:::

Thank you for help.

I have the same hash on a device. Has anyone cracked it?

rryanc83 · 2024-12-20T05:01:55Z

Can anyone help me crack this? I successfully pulled the passwd file off the memory chip for my camera a Project Nursery camera, but I can't figure out hashcat to get the password from the hash. The passwd file contains one line:
root:$1$2bIsCaZh$4rPJIavm2oheHsh3.eORn.:0:0::/root:/bin/sh I guess my main question is what part of that to isolate in a text file to run hashcat on and how do I tell what kind of hash it is (md5... etc)?

megadon1 · 2025-01-21T00:10:50Z

i need help with this hash. root:$6$wyzecamv2$hvp6M6S2JI7vyyHfEDPWCYJ8N2r5B4ZzS8uZYwyMkoWyg90sCJzupBGD57CObtKonld0Yvr2B/ejt4l4/jryi.:0:0:root:/:/bin/sh . I tried using hashid with no luck . Is it a good hash?

f-gabel · 2025-02-15T15:47:11Z

I've got a Tuya TCP Smart cam here for which i would like to have the password: shadow says: root:$1$dVhFuDGx$YrOKRgTcjTCqEK75.z277/:15874:0:99999:7::: It shows "Lobster" and Linux version 3.10.27 (canjian@ubuntu) (gcc version 4.8.5 20150209 (prerelease) (Realtek RSDK-4.8.5p1 Build 2521) ) #1 PREEMPT Fri Dec 7 15:51:19 CST 2018

@Dobie007 Hi, I have the same camera, were you able to crack the password?

Dobie007 · 2025-02-16T22:02:21Z

Hi,
Since the firmware is in an external flash i could patch the inittab file and get a working terminal. I got the idea out of the video i linked above.
This is the line i actually changed:
ttyS1::respawn:-/bin/sh

Since then it's lying around because i have no idea how to continue. (The runtime file would need to be changed or an alternative chipset software used)

f-gabel · 2025-02-19T09:40:17Z

I haven't cracked the password yet either, but I haven't gotten around to extracting the FW yet. Would it be possible for you to send it to me? That would help me a lot :) (https://drive.google.com/drive/folders/1q8jVospsmOQUF0f-Y5loyOJjMwOogVA1?usp=sharing)

derzahla · 2025-03-31T17:27:17Z

Ive seen it asked for before here and other places but no answers. Any one can help with: $1$yFuJ6yns$33Bk0I91Ji0QMujkR/DPi1 ?

L18DAFENSG_AF_V0-A_XAHS-RTMP-H5 V3.3.2.1 build 2024-08-29 14:35:19

Ive tried all the dictionary attacks i could find and my AMD iGPU is now at its limit trying to brute force 8chars, could take me years

nor24o · 2025-04-21T19:14:03Z

somebody knows ? root:$1$RiBtxRAG$PvXy3AX92u.mvo/UwXlTJ0:19404:0:99999:7::: user:$1$ri3K4P4s$ne/es0YuNHyn0rti8KJ2a.:19404:0:99999:7:::

Hi , did you find the password for these ? can you share them if yes . thank you .

m0rb · 2025-04-23T22:31:12Z

$1$$.MO09JyxBBNd9Xv0pXIqc0

lbtech2002

Zoft123 · 2025-06-11T18:48:05Z

Hi everybody. Can you help me decrypt shadow on AK3918EN080 V200 (Anyka)? root:$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1:0:0:99999:7:::

Thank you for help.

Hi everybody. Can you help me decrypt shadow on AK3918EN080 V200 (Anyka)? root:$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1:0:0:99999:7:::
Thank you for help.

I have the same hash on a device. Has anyone cracked it?

I know it's very late, but the password for this hash is yunyi666

mycana · 2025-06-20T23:02:59Z

root:$1$soidjfoi$9klIbmCLq2JjYwKfEA5rH1:10933:0:99999:7:::

help me with this to crack down anyone

I have the same password in the shadow file. Help please.

zerlokker · 2025-07-05T20:25:58Z

is there still a discord?

faragshawky86 · 2025-08-11T06:22:46Z

Hi everybody. Can you help me decrypt shadow on AK3918EN080 V200 (Anyka)? root:$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1:0:0:99999:7:::
Thank you for help.

Hi everybody. Can you help me decrypt shadow on AK3918EN080 V200 (Anyka)? root:$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1:0:0:99999:7:::
Thank you for help.

I have the same hash on a device. Has anyone cracked it?

I know it's very late, but the password for this hash is yunyi666

Oh thanks a lot! You saved me a ton of time!

nenad-sladojevic · 2025-08-24T14:39:30Z

Hello,
Can you help "decrypt" bellow hash:
root:$1$ouLOV500$zvYRvG33R/lxTS.9Gpz5H1

Model is: DENVER Indoor smart Wi-Fi_IP camera - IIC-172
SoC is: ANYKA AK3918EN080 V200 CDSJ02I22

Thanks in advance!

Lawliet95 · 2025-10-05T09:04:36Z

Hi everybody. Can you help me decrypt shadow on AK3918EN080 V200 (Anyka)? root:$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1:0:0:99999:7:::
Thank you for help.

Hi everybody. Can you help me decrypt shadow on AK3918EN080 V200 (Anyka)? root:$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1:0:0:99999:7:::
Thank you for help.

I have the same hash on a device. Has anyone cracked it?

I know it's very late, but the password for this hash is yunyi666

I have the same hash in shadow file,but the pwd doesn't seem to be that one.
How you found this? It should be md5crypt.
Using john:

┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware]
└─$ mkdir try 
                                                                                                                                                     
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware]
└─$ cd try  
 
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ touch root.hash  

┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ echo '$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1' > root.hash
                                                                                                                                          
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ cat root.hash
$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1

┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ touch wordlist.txt             
                                                                                                                                                          
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ echo 'yunyi666' > wordlist.txt                       
                                                                                                                                          
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ john --wordlist=./wordlist.txt --format=md5crypt --fork=4 root.hash 
Using default input encoding: UTF-8
Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3])
Node numbers 1-4 of 4 (fork)
4 0g 0:00:00:00 DONE (2025-10-05 11:00) 0g/s 0p/s 0c/s 0C/s
3 0g 0:00:00:00 DONE (2025-10-05 11:00) 0g/s 0p/s 0c/s 0C/s
2 0g 0:00:00:00 DONE (2025-10-05 11:00) 0g/s 0p/s 0c/s 0C/s
Press 'q' or Ctrl-C to abort, almost any other key for status
1: Warning: Only 1 candidate left, minimum 24 needed for performance.
1 0g 0:00:00:00 DONE (2025-10-05 11:00) 0g/s 50.00p/s 50.00c/s 50.00C/s yunyi666
Waiting for 3 children to terminate
Session completed. 
                                                                                                                                          
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ john --show --format=md5crypt root.hash                       
0 password hashes cracked, 1 left

Has someone cracked it? I tried to use hashcat with mask: 8 letters,only numbers and lowercase character,but after 3 days it couldn't find the pwd.

foxyc · 2025-10-05T09:10:23Z

Hi everybody. Can you help me decrypt shadow on AK3918EN080 V200 (Anyka)? root:$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1:0:0:99999:7:::
Thank you for help.

Hi everybody. Can you help me decrypt shadow on AK3918EN080 V200 (Anyka)? root:$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1:0:0:99999:7:::
Thank you for help.

I have the same hash on a device. Has anyone cracked it?

I know it's very late, but the password for this hash is yunyi666

I have the same hash in shadow file,but the pwd doesn't seem to be that one. How you found this? It should be md5crypt. Using john:

┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware]
└─$ mkdir try 
                                                                                                                                                     
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware]
└─$ cd try  
 
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ touch root.hash  

┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ echo '$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1' > root.hash
                                                                                                                                          
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ cat root.hash
$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1

┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ touch wordlist.txt             
                                                                                                                                                          
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ echo 'yunyi666' > wordlist.txt                       
                                                                                                                                          
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ john --wordlist=./wordlist.txt --format=md5crypt --fork=4 root.hash 
Using default input encoding: UTF-8
Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3])
Node numbers 1-4 of 4 (fork)
4 0g 0:00:00:00 DONE (2025-10-05 11:00) 0g/s 0p/s 0c/s 0C/s
3 0g 0:00:00:00 DONE (2025-10-05 11:00) 0g/s 0p/s 0c/s 0C/s
2 0g 0:00:00:00 DONE (2025-10-05 11:00) 0g/s 0p/s 0c/s 0C/s
Press 'q' or Ctrl-C to abort, almost any other key for status
1: Warning: Only 1 candidate left, minimum 24 needed for performance.
1 0g 0:00:00:00 DONE (2025-10-05 11:00) 0g/s 50.00p/s 50.00c/s 50.00C/s yunyi666
Waiting for 3 children to terminate
Session completed. 
                                                                                                                                          
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ john --show --format=md5crypt root.hash                       
0 password hashes cracked, 1 left

Has someone cracked it? I tried to use hashcat with mask: 8 letters,only numbers and lowercase character,but after 3 days it couldn't find the pwd.

It is not clear md5. It is modified version.

Lawliet95 · 2025-10-05T09:18:43Z

Hi everybody. Can you help me decrypt shadow on AK3918EN080 V200 (Anyka)? root:$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1:0:0:99999:7:::
Thank you for help.

Hi everybody. Can you help me decrypt shadow on AK3918EN080 V200 (Anyka)? root:$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1:0:0:99999:7:::
Thank you for help.

I have the same hash on a device. Has anyone cracked it?

I know it's very late, but the password for this hash is yunyi666

I have the same hash in shadow file,but the pwd doesn't seem to be that one. How you found this? It should be md5crypt. Using john:

┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware]
└─$ mkdir try 
                                                                                                                                                     
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware]
└─$ cd try  
 
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ touch root.hash  

┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ echo '$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1' > root.hash
                                                                                                                                          
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ cat root.hash
$1$6AHjBnTn$LvoexcPTiWwZP5fLfCGdv1

┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ touch wordlist.txt             
                                                                                                                                                          
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ echo 'yunyi666' > wordlist.txt                       
                                                                                                                                          
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ john --wordlist=./wordlist.txt --format=md5crypt --fork=4 root.hash 
Using default input encoding: UTF-8
Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3])
Node numbers 1-4 of 4 (fork)
4 0g 0:00:00:00 DONE (2025-10-05 11:00) 0g/s 0p/s 0c/s 0C/s
3 0g 0:00:00:00 DONE (2025-10-05 11:00) 0g/s 0p/s 0c/s 0C/s
2 0g 0:00:00:00 DONE (2025-10-05 11:00) 0g/s 0p/s 0c/s 0C/s
Press 'q' or Ctrl-C to abort, almost any other key for status
1: Warning: Only 1 candidate left, minimum 24 needed for performance.
1 0g 0:00:00:00 DONE (2025-10-05 11:00) 0g/s 50.00p/s 50.00c/s 50.00C/s yunyi666
Waiting for 3 children to terminate
Session completed. 
                                                                                                                                          
┌──(stagnola㉿kali)-[~/Scrivania/dump_firmware/try]
└─$ john --show --format=md5crypt root.hash                       
0 password hashes cracked, 1 left

Has someone cracked it? I tried to use hashcat with mask: 8 letters,only numbers and lowercase character,but after 3 days it couldn't find the pwd.

It is not clear md5. It is modified version.

Can you tell me more about this?

Lawliet95 · 2025-10-06T18:34:49Z

Btw I can't access U-Boot either.
On my camera looks like u-boot disables prompt until kernel is loaded.
My only one way is to modify firmware,change shadow pwd and flash it back so I can login as root

foxyc · 2025-10-06T19:21:41Z

Btw I can't access U-Boot either. On my camera looks like u-boot disables prompt until kernel is loaded. My only one way is to modify firmware,change shadow pwd and flash it back so I can login as root

As i remember, hashing algorithm in some library modified by vendor, so you must make hash with same algorithm and write hash in shadow pwd. Than system can compare hash from pass you entered with hash in shadow pwd.

Lawliet95 · 2025-10-06T22:23:19Z

Btw I can't access U-Boot either. On my camera looks like u-boot disables prompt until kernel is loaded. My only one way is to modify firmware,change shadow pwd and flash it back so I can login as root

As i remember, hashing algorithm in some library modified by vendor, so you must make hash with same algorithm and write hash in shadow pwd. Than system can compare hash from pass you entered with hash in shadow pwd.

Yeah that was kinda clear from your last message. I tried the password “yunyi666” (a guy here said was that one)to auth to device and it doesn’t work.
What you mean with “libraries modified by the vendor”?
Are there some libraries with source?

foxyc · 2025-10-07T09:02:00Z

Hi. Ho, there is no source of libraries. You only can extract file from firmware and make reverse engineering with Ghidra or IDA Pro.

foxyc · 2025-10-07T09:06:36Z

You can try to find some more info in telegram group "OpenIPC User"

Lawliet95 · 2025-10-09T20:45:50Z

++Update:

There you go @chrismclellen 😘

@foxyc btw there was no custom algorithm. That was md5crypt

chrismclellen · 2025-10-10T21:24:23Z

What did I miss?

…

On Thu, Oct 9, 2025 at 2:46 PM Lawliet95 ***@***.***> wrote: ***@***.**** commented on this gist. ------------------------------ ++Update: There you go @chrismclellen <https://github.com/chrismclellen> 😘 image.png (view on web) <https://gist.github.com/user-attachments/assets/933f7492-1166-47b4-aa3c-cb65da813879> — Reply to this email directly, view it on GitHub <https://gist.github.com/gabonator/74cdd6ab4f733ff047356198c781f27d#gistcomment-5794947> or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFPXRVNMIHJLYJ66SU4JBX33W3CRJBFHORZGSZ3HMVZKMY3SMVQXIZNMON2WE2TFMN2F65DZOBS2WR3JON2EG33NNVSW45FGORXXA2LDOOIYFJDUPFYGLJDHNFZXJJLWMFWHKZNIGM3DQNRUHAYDLKTBOR2HE2LCOV2GK44TQKSXMYLMOVS2SMJSGE3DGMJTGAYKI3TBNVS2QYLDORXXEX3JMSBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDHNFZXJJDOMFWWLK3UNBZGKYLEL52HS4DF> . You are receiving this email because you were mentioned. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> .

foxyc · 2025-10-15T06:45:30Z

++Update:

There you go @chrismclellen 😘
@foxyc btw there was no custom algorithm. That was md5crypt

Sorry, I must have confused this camera with another one that used modified base64.

semaja2 · 2025-10-21T11:58:56Z

I am working on a camera with the root hash $1$lPbKHYLS$r6JMTEm949/hCMv85Fsx9/ anyone been able to crack it?

OlafTheSnowman · 2025-10-28T10:31:49Z

Technaxx TX-61 (FI9803W board from Foscam with Hi3518CV100 SoC)
root / ak47agai
worked for me

psy0p · 2025-10-29T10:29:54Z

root:$1$soidjfoi$9klIbmCLq2JjYwKfEA5rH1:10933:0:99999:7:::
help me with this to crack down anyone

I have the same password in the shadow file. Help please.

Hey there... I'm also searching for this one.Did you find it somewhere? Can you please help me?

Lawliet95 · 2025-10-31T13:50:38Z

There is a chance you guys can find password for your hashes bruteforcing, but it will hardly work without spending days on it.
I tried a lot of different masks and lenght, been bruteforcing (with 3060ti overclocked) my hash for days with no luck.
You could be luckier then me,but I find it kinda hard.
I wrote an article (still in progress),if you want more info,look here,it's my public repo about my hacking journey.

https://github.com/Lawliet95/ANYKA-Tuya-Hacking-Journey-AK3918v200EN080-v200

	Summary of passwords by sperglord8008s, updated November 1. 2020. For login try "root", "default", "defaul" or "root"

	00000000
	059AnkJ
	4uvdzKqBkj.jg
	7ujMko0admin
	7ujMko0vizxv
	123
	1111
	1234
	1234qwer
	2601hx
	12345
	54321
	123456
	666666
	888888
	1111111
	/*6.=_ja
	anko
	anni2013
	annie2012
	avtech97
	cat1029
	ccadmin
	cxlinux
	default
	dreambox
	fxjvt1805
	hdipc%No
	hi3518
	hichiphx
	hipc3518
	hkipc2016
	hslwificam
	ikwb
	ipc71a
	IPCam@sw
	ivdev
	juantech
	jvbzd
	jvtsmart123
	klv123
	klv1234
	meinsm
	OxhlwSG8
	pass
	password
	realtek
	root
	hi3518
	S2fGqNFs
	service
	smcadmin
	supervisor
	support
	system
	tech
	tlJwpbo6
	ubnt
	user
	vhd1206
	vizxv
	xc3511
	xmhdipc
	zlxx.
	Zte521

gabonator/password.txt

ShravanSinghRathore commented Dec 1, 2024

Uh oh!

ZervoTheProtogen commented Dec 18, 2024

Uh oh!

rryanc83 commented Dec 20, 2024

Uh oh!

megadon1 commented Jan 21, 2025

Uh oh!

f-gabel commented Feb 15, 2025

Uh oh!

Dobie007 commented Feb 16, 2025

Uh oh!

f-gabel commented Feb 19, 2025

Uh oh!

derzahla commented Mar 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nor24o commented Apr 21, 2025

Uh oh!

m0rb commented Apr 23, 2025

Uh oh!

Zoft123 commented Jun 11, 2025

Uh oh!

mycana commented Jun 20, 2025

Uh oh!

zerlokker commented Jul 5, 2025

Uh oh!

faragshawky86 commented Aug 11, 2025

Uh oh!

nenad-sladojevic commented Aug 24, 2025

Uh oh!

Lawliet95 commented Oct 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

foxyc commented Oct 5, 2025

Uh oh!

Lawliet95 commented Oct 5, 2025

Uh oh!

Lawliet95 commented Oct 6, 2025

Uh oh!

foxyc commented Oct 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Lawliet95 commented Oct 6, 2025

Uh oh!

foxyc commented Oct 7, 2025

Uh oh!

foxyc commented Oct 7, 2025

Uh oh!

Lawliet95 commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chrismclellen commented Oct 10, 2025 via email

Uh oh!

foxyc commented Oct 15, 2025

Uh oh!

semaja2 commented Oct 21, 2025

Uh oh!

OlafTheSnowman commented Oct 28, 2025

Uh oh!

psy0p commented Oct 29, 2025

Uh oh!

Lawliet95 commented Oct 31, 2025

Uh oh!

derzahla commented Mar 31, 2025 •

edited

Loading

Lawliet95 commented Oct 5, 2025 •

edited

Loading

foxyc commented Oct 6, 2025 •

edited

Loading

Lawliet95 commented Oct 9, 2025 •

edited

Loading