Logging In Via GUI - Scalar i2000 (and maybe i6000)

Submitted by gpmidi on Fri, 12/14/2018 - 20:20

The default GUI accounts are:

  • admin:password
  • service:10101100

 

How to decode /usr/local/amc/app/Server/LMAccts.xml:

You can get root access via telnet to fetch LMAccts.xml per this doc: https://www.gpmidi.net/node/46

 

with open('/path/to/LMAccts.xml','rb') as f:
    root=bs4.BeautifulSoup(f,'xml')

def do(ep,pk,decode=True):
    if decode:
        ep = base64.b64decode(ep).decode('utf8')
        pk = base64.b64decode(pk).decode('utf8')
    res=[]
    ln=0
    for i in range(0,len(ep)):
        if i==0:
            maxlen=ord(ep[i])-ord(pk[i])
            print "Max len: %r (%r-%r)"%(maxlen,ep[i],pk[i])            
        elif i==1:
            offset = ord(ep[i])-ord(pk[i])
            print "Offset: %r"%offset
            print "ep: %r"%ep[offset:offset+maxlen]
            print "pk: %r"%pk[offset:offset+maxlen]
        elif i >= offset and ln < maxlen:
            res.append(unichr(ord(ep[i])-ord(pk[i])))
            ln+=1
    return ''.join(res)

def tester(root,tf):
    accounts=[]
    for user in root.user_accounts.children:
        accounts.append(dict(
            user=user.find('name').getText(),
            password=user.find('password').getText(),
            key=user.find('parent').getText(),
            user_decode=base64.b64decode(user.find('name').getText()),
            password_decode=base64.b64decode(user.find('password').getText()),
            key_decode=base64.b64decode(user.find('parent').getText()),
        ))
    for account in accounts:
        print "Testing Account"
        print "---"
        print repr(account)
        print "---"
        account['results-b64']=dict(
            name=tf(account['user'],account['key'],True),
            password=tf(account['password'],account['key'],True),
        )
        #account['results-no-b64']=dict(
        #    name=tf(account['user'],account['key'],False),
        #    password=tf(account['password'],account['key'],False),
        #)
        
    return accounts


results=tester(root,do)

print repr(results)

 

Comments