tried and nope, comes up bad command.
I'm boxing it up sunday...
If you still have the router connected perhaps you might indulge a little further. Among many other commands the router also supports the
dumpmdm command:
root@lampu:/mnt# ls bin
acs_cli date ethctl lldpcli openl2tpd send_syslog_mail udpecho
acsd ddnsd ethswctl lldpd openssl setkey umount
adsl deluser false ln ping setmem uname
adslctl df false_httpd ls ping6 sh upnp
arl dhclient fap mailmonitor pluto sleep urlfilterd
arlctl dhcp6d fapctl mcp pppd smd usbcheck
ash dhcpc fc mcpctl pppoe-relay sntp usb_modeswitch
attached_devices dhcpd fcctl mcpd pptp spu usleep
avahi-daemon dmesg grep mdkshell ps spuctl vlanctl
bash dnsproxy hotplug mdm psp sshd wan_recovery
bcm_boot_launcher dnsspoof htpasswd meminfo pwd ssk wl
bpm dropbear httpd mkdir pwr stress wlctl
bpmctl dropbearkey http_get mknod pwrctl stty wlevt
brctl dropbearmulti ip mount racoon swmdk wlmngr
busybox dsldiagd ip6tables mroute radvd sync wlschd
buttonmonitor dumpcfg ipsec mv radvd_test tc wl_server
cat dumpeid iptables nas rastatus6 tcpdump wl_server_socket
chmod dumpmdm iq nas4not rawSocketTest telnetd wps_monitor
clicmds dumpmem iqctl nbsrelay ripd touch xdslctl
conntrack eapd kill netstat ripngd tr69c xtables-multi
consoled ebtables led_all nptest rm traffic_meter xtm
cp echo ledctl nvram sed true xtmctl
c_rehash epi_ttcp lld2d nvramUpdate send_cms_msg udhcpd zebra
root@lampu:/mnt# ls sbin
bcrelay depmod fdisk hotplug init klogd modprobe pppd2 pppstats pptpd rmmod sysinfo vconfig
chat ethctl halt ifconfig insmod logread poweroff pppdump pptpctrl reboot route syslogd
It was found by @highpriest in the thread
VMG8924-B10A unbranded supervisor password that the ZyXel routers dumped the 'supervisor' user password when this command was run. On the ZyXel, when logging in as supervisor, the 'sh' command then becomes available. Does the
dumpmdm command work on the Cisco, if that so, is it the same as the ZyXel and dumps usernames and passwords?
