3 ms·

Turns out I need to do that with my old SGI. Got any tips?

by mmjaa 9y ago

jjwiseman 9y ago
Not quite what you're asking, but if you just want to get a shell on the machine, IRIX often had a bunch of accounts with no password. Try lp, demo, games, and guest.
DanBC 9y ago
Would something like John the Ripper, first with wordlists and then with incremental mode, be acceptable? http://www.openwall.com/john/ http://www.openwall.com/john/ http://www.openwall.com/john/doc/ http://www.openwall.com/john/doc/
Aloha 9y ago
Boot from a CD, mount the drive, change the password or remove it - if it were linux I'd edit /etc/shadow - obviously easier with another IRIX machine to put the drive into.
Keyframe 9y ago
Multiple ways to do it. All lead to you getting to the /etc/passwd file and the hash inside for the root. If you have IRIX installation CD then you can even set the new password, but you probably don't have it? You can also put the disk into another SGI, also not what everyone has. If guest account is enabled, login with guest (no password) and just cat the /etc/passwd. If guest account is not enabled, you can do the cat via sash, which is a bit more compicated, like this: https://web.archive.org/web/20151023042224/http://crackaddict.com/~nate/hackirix.html https://web.archive.org/web/20151023042224/http://crackaddic... Once you have your hash, do it with John the Ripper (GPU version). Store the password int a text file in format of root:hash and run john the ripper on it. Encryption is, AFAIK, DES so use john --format=des passwd.txt if john doesn't autodetect which encryption it is (I remember I had to set it manually). It can take awhile, depending on the GPU, but not that long. If you run into trouble, I can have a look. I think I wrote down somewhere what to do, in case I need it again.
- mmjaa 9y ago
  Thanks for this, looks to be not a problem at all! Well, now I've got one less reason to keep the SGI boxes wrapped up, thanks!
neko_koneko 9y ago
When I was in similar situation (bought an old SGI O2 box and didn’t had any other SGI machines to plug HDD into to get /etc/passwd), I used telnet RCE/privilege escalation exploit: https://www.exploit-db.com/exploits/20149/ https://www.exploit-db.com/exploits/20149/, worked like a charm. These old systems have many vulnerable services running by default, including telnet.
- mmjaa 9y ago
  Had some great suggestions, but this one wets my whistle the most, haha! Probably what I'll do, though, is set up SCSI on a linux box somewhere and try to xxx the shadow, seems to be the smoothest route .. don't wanna mess too much, because after all, 20 years later .. I still wanna boot my old SGI like the good ol' days. :)
contingencies 9y ago
Try logging in as lp. Often no password.
atkbrah 9y ago
You will need /etc/passwd file from SGI the disk. Either use irix installation CDs or boot the system over network [1]. You could also try booting openbsd [2] to get your hands to it. Next you would use something like hashcat [3] to bruteforce the password. 1. http://software.majix.org/irix/install-network.shtml http://software.majix.org/irix/install-network.shtml 2. https://ftp.openbsd.org/pub/OpenBSD/6.2/sgi/INSTALL.sgi https://ftp.openbsd.org/pub/OpenBSD/6.2/sgi/INSTALL.sgi 3. https://hashcat.net/hashcat/ https://hashcat.net/hashcat/

Turns out I need to do that with my old SGI. Got any tips?

by mmjaa 9y ago

Turns out I need to do that with my old SGI. Got any tips?

Not quite what you're asking, but if you just want to get a shell on the machine, IRIX often had a bunch of accounts with no password. Try lp, demo, games, and guest.

DanBC 9y ago

Would something like John the Ripper, first with wordlists and then with incremental mode, be acceptable? http://www.openwall.com/john/ http://www.openwall.com/john/ http://www.openwall.com/john/doc/ http://www.openwall.com/john/doc/

Aloha 9y ago

Boot from a CD, mount the drive, change the password or remove it - if it were linux I'd edit /etc/shadow - obviously easier with another IRIX machine to put the drive into.

Keyframe 9y ago

Multiple ways to do it. All lead to you getting to the /etc/passwd file and the hash inside for the root. If you have IRIX installation CD then you can even set the new password, but you probably don't have it? You can also put the disk into another SGI, also not what everyone has. If guest account is enabled, login with guest (no password) and just cat the /etc/passwd. If guest account is not enabled, you can do the cat via sash, which is a bit more compicated, like this: https://web.archive.org/web/20151023042224/http://crackaddict.com/~nate/hackirix.html https://web.archive.org/web/20151023042224/http://crackaddic... Once you have your hash, do it with John the Ripper (GPU version). Store the password int a text file in format of root:hash and run john the ripper on it. Encryption is, AFAIK, DES so use john --format=des passwd.txt if john doesn't autodetect which encryption it is (I remember I had to set it manually). It can take awhile, depending on the GPU, but not that long. If you run into trouble, I can have a look. I think I wrote down somewhere what to do, in case I need it again.

mmjaa 9y ago
Thanks for this, looks to be not a problem at all! Well, now I've got one less reason to keep the SGI boxes wrapped up, thanks!

neko_koneko 9y ago

When I was in similar situation (bought an old SGI O2 box and didn’t had any other SGI machines to plug HDD into to get /etc/passwd), I used telnet RCE/privilege escalation exploit: https://www.exploit-db.com/exploits/20149/ https://www.exploit-db.com/exploits/20149/, worked like a charm. These old systems have many vulnerable services running by default, including telnet.

mmjaa 9y ago
Had some great suggestions, but this one wets my whistle the most, haha! Probably what I'll do, though, is set up SCSI on a linux box somewhere and try to xxx the shadow, seems to be the smoothest route .. don't wanna mess too much, because after all, 20 years later .. I still wanna boot my old SGI like the good ol' days. :)

contingencies 9y ago

Try logging in as lp. Often no password.

atkbrah 9y ago

You will need /etc/passwd file from SGI the disk. Either use irix installation CDs or boot the system over network [1]. You could also try booting openbsd [2] to get your hands to it. Next you would use something like hashcat [3] to bruteforce the password. 1. http://software.majix.org/irix/install-network.shtml http://software.majix.org/irix/install-network.shtml 2. https://ftp.openbsd.org/pub/OpenBSD/6.2/sgi/INSTALL.sgi https://ftp.openbsd.org/pub/OpenBSD/6.2/sgi/INSTALL.sgi 3. https://hashcat.net/hashcat/ https://hashcat.net/hashcat/