Sunluxy DVR mkII - telnet & root password

Just a quick update on the Grain Media supplied firmware for the new Sunluxy DVR. Unsurprisingly for a cheap bit of kit like this, the security is rather wanting. Everything runs as root and of course telnet is available.

Escape character is '^]'.

GM login: root
Password:
Welcome to

    _____    __      ___       __     ___       _     _    _
   |  ___|  /  \    / __ \    /  \   |  _ \    /  \   \ \ / /
   | |___  / /\ \  | /__\ \  / /\ \  | | \ |  / /\ \   \ V /
   |  ___|| |__| | |  _   / | |__| | | | | | | |__| |   \ /
   | |    |  __  | | |  \ \ |  __  | | |_/ / |  __  |   | |
   |_|    |_|  |_| |_|   \_\|_|  |_| |___ /  |_|  |_|   |_|

For further information check:
http://www.faraday.com/





BusyBox v1.19.4 (2014-05-28 09:56:23 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

[root@GM]# cat /etc/passwd
root:N.lbMktxdQ76A:0:0:root:/:/bin/sh
bin:x:1:1:bin:/bin:/bin/sh
daemon:x:2:2:daemon:/usr/sbin:/bin/sh
adm:x:3:4:adm:/adm:/bin/sh
lp:x:4:7:lp:/var/spool/lpd:/bin/sh
sync:x:5:0:sync:/bin:/bin/sync
shutdown:x:6:11:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
uucp:x:10:14:uucp:/var/spool/uucp:/bin/sh
operator:x:11:0:Operator:/var:/bin/sh
nobody:x:99:99:nobody:/home:/bin/sh
[root@GM]#

The root password is trivial to crack using John the Ripper. Now, it would be irresponsible for me to post the password here, but I can't help what people put in the comments ;-) Suffice to say, the password wasn't a surprise and consisted of two upper case letters (hmm I wonder what those could be, eh Grain Media?) followed by four numbers. 

At least with this version of the Sunluxy it is feasible to start making modifications to the file system and make it more secure. In the next post I'll look into updating the firmware by resetting the password and possibly a few other tweaks. I might even see if I can make the process simpler than I did in the last post.