05-28-2022, 12:59 AM
Well, I've completed looking under the streetlight with hashcats' MD5 algorithm.
The best fit I've found is:
wju-zohnhy132161N11499300D09E with 'wju-zohnhy' being the prefix and '00D09E' being the suffix to the SN (132161N114993).
MD5 of wju-zohnhy132161N11499300D09E is A8A6D3D67B2FD81C4BF9D73FA2AA9987
Modulus 8 on the first digest and 37 on the next 11 gives: 0 18 26 29 12 10 31 28 1 27 30 26
Project that onto the default charset (abcdefghijkmnpqrstuvwxyz23456789#%+=?) gives '2u47nk96b589' with the reminder that the actual password we're looking for is '2u47nk96b58m' so all but the last letter.
Of course all of this is pure chance, because as soon as you change the serial number to another routers', you get no match at all.
Also nothing so far with my homebrew SHA1 using just a suffix string. It's slower going as that runs on my CPU threads.
Still working on a prefix to some router specific value (SN, AC, MAC) with SHA1. I can only do 8 characters, so cross your fingers that's what was used!
The best fit I've found is:
wju-zohnhy132161N11499300D09E with 'wju-zohnhy' being the prefix and '00D09E' being the suffix to the SN (132161N114993).
MD5 of wju-zohnhy132161N11499300D09E is A8A6D3D67B2FD81C4BF9D73FA2AA9987
Modulus 8 on the first digest and 37 on the next 11 gives: 0 18 26 29 12 10 31 28 1 27 30 26
Project that onto the default charset (abcdefghijkmnpqrstuvwxyz23456789#%+=?) gives '2u47nk96b589' with the reminder that the actual password we're looking for is '2u47nk96b58m' so all but the last letter.
Of course all of this is pure chance, because as soon as you change the serial number to another routers', you get no match at all.
Also nothing so far with my homebrew SHA1 using just a suffix string. It's slower going as that runs on my CPU threads.
Still working on a prefix to some router specific value (SN, AC, MAC) with SHA1. I can only do 8 characters, so cross your fingers that's what was used!