Have a look at "/etc/profile". It runs at boot . . .
[off topic]
In the last few lines of the
"/etc/profile" file, we can see where basic
"/var/passwd" and
"/var/group" files are created. That
"passwd" file is subsequently modified, later in the boot process.
Here are the lines from the
"/etc/profile" file, from my VMG1312-B10A device --
# generate login files
echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd
echo "root::0:root,supervisor,support,user" > /var/groupLet's look at the second field for the
"supervisor" line. I count thirteen characters. That just has to be the output of DES crypt(). Rather than attempting to use a "brute force" method of decrypting it, let's work the other way. A lot of the ZyXEL documentation, for various devices, will show
"zyad1234" as the default password for the
"supervisor" login. A few lines of C-code were quickly thrown together --
/*
* supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh
*
* Compile and link:
*
* cc -lcrypt -o doencrypt doencrypt.c
*/
#define _XOPEN_SOURCE
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
int main()
{
char *key = "zyad1234";
char *salt = "3G";
printf("crypt(\"%s\", \"%s\") returns \"%s\"\n", key, salt, crypt(key, salt));
exit(EXIT_SUCCESS);
}Compiling and then executing the resultant binary --
[Duo2 ~/tmp/]$ cc -lcrypt -o doencrypt doencrypt.c
[Duo2 ~/tmp/]$ doencrypt
crypt("zyad1234", "3G") returns "3Gnc.CJE1790M"
[Duo2 ~/tmp/]$Point proven.
[/off topic]
