5268ac routers

[drsnooker]

I ended up buying a Sonic edition 5268AC. The WIFI passwords still seem to follow the basic rules of start with a number and no more than 3 letters in a row.




I never thought I would actually find the wifi keygen, but perhaps a clue could come from the ESSID gerenation algo.
The RMA password again is generated using the pseudopwd that @90h reversed, so root access over UART was quickly set up.

In /rwdata/pkg/sonic-config.pkgstream there are two notable comments:

<------------------ SNIP ------------------>

# Changes
#    2015-04-22  - Added second "CASE" value and bumped the "loop_thru_case" to 2
#                - Change SSID0 to "Sonic-XXXX" [SN-5268-PDP-01]
#                        Note: XXXX is a random number.  This mandates that SSID0 be loaded by the factory build
#                              The assumption is that "/sys/module/board/parameters/wifissid0" will contain this value??
#                - Make primary 5Ghz SSID (SSID5) the same as the primary 2.4GHz SSID (SSID0) [SN-5268-PDP-01]
#                        Note: Similar assumption is that SSID5 will be loaded from by the factory build
#                - Wifi PassPhrase be set to 12 alpha/numeric characters [SN-5268-PDP-01]
#                        Note: Similar assumption is that WiFi passphrase be loaded by the factory build
#                - WPS button must be functional for 2.4GHz and 5Ghz on primary SSIDs (0 & 5). [SN-5268-GCG-03]
#                - Add, but not enabled, IPv6 dual-stack information for future ACS-enabling
#    2015-06-09  - Added Broadcast/Multicast group to include teh Bonjour discovery
#    2015-06-17  - Disable IPv6 detection
#    2015-07-13  - New SSH password (Need to encrypt)
#    2015-08-21  - Encrypted new password




#2015_08_20.... Change SSH password and encrypt.
    echo "--Changing root password"   
    echo root:'$1$D6xa9FbN$9b9TgxSBUYzISHNGTn6qJ/' | chpasswd -e
   
    echo "--Changing Tech password"
    usermod -p "w53t3uMR" tech

<------------------ SNIP ------------------>


Sadly, unlike the previous root password, this one is not cracked by 8 chars with a leading number
-a 3 -1 ?d?u?l ?d?1?1?1?1?1?1?1
It's possible it follows the Tech password without a number in the first spot, but I already have root access using the RMA user, so don't feel like burning electrons trying to solve the new root password.


And lastly the SSID number is also pulled directly from NVRAM as suggested by the changes of 4/22, it is not calculated.
/sys/module/board/parameters/wifissid0 just shows the complete ESSID, not just the number.