How to recover my Kindle root password?

[recoco]

Due to my fault, I lost my Kindle root password.Now I can not login in my Kindle in diagnosis mode using USB Network and can not login through WIFI SSH.Is there a way to recover it?I try to boot into recovery mode but no luck.
Thanks in advance!

[tomsem]

Call Amazon CS. Recovery will probably require resetting the device, and re-loading your content.

[giorgio130]

Did you change it from the default one?

[recoco]

Originally Posted by giorgio130

Did you change it from the default one?

No.First, I changed root password from the default one that is mario.In this case I can login in USB Net mode using new root password, but I can not login in SSH using the same password.Then I stupidly upgrade the firmware to 4.0.1.Now I can not login in USB Net mode and of course in SSH
BTW, Both the password generate by the Python script and the password Changed by myself dont work.

[dionoea]

You could try the NFS hack mentioned here to run a script which would change the password (or install an ssh public key to allow password less logins): https://www.mobileread.com/forums/sho...&postcount=216

This is a bit complex to execute but it doesn't require working ssh access.

Edit: I've found an easier solution which doesn't require ssh access: https://www.mobileread.com/forums/sho...40#post1915440

[geekmaster]

There is a simpler way. Just login as user framework and password mario. Then change your root password.

I just cracked it (again) with john to verify it. Then I successfully tested it using SSH over wifi to my K4NT:

ssh framework@<K4NT.wifi.ip.addr>

Use password mario.

If SSH was not working I would use the tar exploit, but in this case SSH does work so I would recommend the simpler way shown above.

UPDATE:

login user = framework, password = mario confirmed working on the following Kindle models:

DX - Kindle DX
DXG - Kindle DX Graphite
K3 - Kindle 3
K4NT - Kindle 4 (Non Touch)
KT - Kindle Touch

Somebody please test this login password on these models and report back here:

K1 - Kindle 1
K2 - Kindle 2

It looks like we have a universal login.

[recoco]

@geekmaster, great!
I'll try it.My kindle firmware is 4.0.1.

update:
Wow!It works on K4(NT) 4.0.1.

[geekmaster]

Originally Posted by recoco

@geekmaster, great!
I'll try it.My kindle firmware is 4.0.1.

update:
Wow!It works on K4(NT) 4.0.1.

It works on ALL kindles (K1 and K2 not tested yet). But it is a user mode login (not root). It is really only good for looking around and making backup copies. No root write access from the framework user account.

A better way in your case is to put ENABLE_DIAGS on the USB Drive and reboot, then in diags, follow the instructions for installing developer mode, but instead of adding files to /usr/local, you want to fix your root password in /etc/shadow.

[geekmaster]

After some questions appeared in the irc channel about this, I did a test on my touch.

While logged in as user framework:

ssh framework@192.168.15.244

I was able to see the contents of /etc/shadow:

cat /etc/shadow

Only the root and framework accounts had a string of "random" password characters in them.

The easy way to copy this file out so it can be cracked with john is through the clipboard. Copy what you see on the screen after the "cat" command. Then paste it in a file on the host PC, save it, and crack it with "John the Ripper".

The whole reason for this thread was the the original poster changed the root password and forgot what it was.

So, here are two solutions:

On k4nt only, boot from diags and start ssh, login as root, and fix or copy and crack /etc/shadow.

On any kindle, login as user framework with password mario, cat and copy /etc/shadow to the clipboard, then on the host PC paste the clipboard to a file, save it, and crack it. Then you will know your forgotten root password. Or it would be simple to edit shadow and copy the hashed password from diags root to main root. Whatever you want, you know? You have the power!

Originally Posted by geekmaster

...
For general poking around, or for making backups, all kindles let you login to a user account (no write access): username framework, password mario. It works on all my kindles.

After some questions appeared in the IRC channel about this:

01:15 < dionoea> and permissions were more what I was worried about. 
                 /etc/shadow is usually only readable by the shadow group 
                 and writable by the root user
01:17 < geekmstr> dionoea : framework has read-only access. That would 
                  let you copy shadow and use john to crack it.
01:17 < geekmstr> on any kindle.
01:18 < dionoea> and the framework user has sufficient rights to read 
                 /etc/shadow?

... I did a test on my kindle touch. While logged in as user framework:

ssh framework@192.168.15.244

I was able to see the contents of /etc/shadow:

cat /etc/shadow

Only the root and framework accounts had a string of "random" password characters in them.

The easy way to copy this file out so it can be cracked with john is through the clipboard. Copy what you see on the screen after the "cat" command. Then paste it in a file on the host PC, save it, and crack it with "John the Ripper".

The whole reason for this thread was the the original poster changed the root password and forgot what it was.

So, two solutions:

On k4nt only, boot from diags and start ssh, login as root, and fix or copy and crack /etc/shadow.

On any kindle, login as user framework with password mario, cat and copy /etc/shadow to the clipboard, then on the host PC paste the clipboard to a file, save it, and crack it. Then you will know your forgotten root password. Or it would be simple to edit shadow and copy the hashed password from diags root to main root. Whatever you want, you know? You have the power!

P.S. I posted similar content in another thread, because it "needed it", you know?

[ernalve]

Hi, I think I have a similar problem. I set up my password using ;un password "PASSWORD_HERE" and after that i lost all my permissions to cut or paste files to my kindle.

I'm using ubuntu and this happened while I was trying to complete the screensaver hack, more precisely when I tried to unrar the xterm extension. Permission denied.

Any help?

thanks!

[geekmaster]

Originally Posted by ernalve

Hi, I think I have a similar problem. I set up my password using ;un password "PASSWORD_HERE" and after that i lost all my permissions to cut or paste files to my kindle.

I'm using ubuntu and this happened while I was trying to complete the screensaver hack, more precisely when I tried to unrar the xterm extension. Permission denied.

Any help?

thanks!

A similar problem should have a similar solution. What were your results when you tried the suggestions in my previous post?

[nathansuchy]

Setup ssh to login with private key then typein passwd root and set a password thats how i setup my kindle keyboard root account

[rgm]

Hi,

After trying many different methods
Nothing else only "telnet" works for me to gain root access to Kindle NT4:

telnet 192.168.15.244
Connected to 192.168.15.244.
Escape character is '^]'.

Welcome to Kindle!

Then make root fs writeable and change root password!

[root@kindle root]# mntroot rw
system: I mntroot:def:Making root filesystem writeable
/dev/mmcblk0p1 on / type ext3 (rw,noatime,nodiratime)
[root@kindle root]# passwd
Changing password for root

I changed to a simple root password.

Then opening another terminal

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 root@192.168.15.244

ssh login works...

then make rootfs read only: mntroot r
then reboot.

After reboot enable wifi and ssh thru wifi with

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 root@192.168.178.25

ip addres is shown in this screen from Kindle 4 NT
There is an easy way of retrieving the WiFi IP address:

1. Open the menu by pressing the menu button
2. Select “Settings”
3. Press and hold the keyboard button
4. Press the right Page Forward key (the “711 Page” will open)
5. Page forward to page 2 of 3

[ambivalence_ru]

just registered to share another solution. I wasn't able to connect via telnet (only ssh) and my /etc/shadow had no proper info about root password. I copypasted its content into some hash-decoder and I got only «framework» user data.

however! it's even easier to solve this way: when you create new ssh keys you can save public/private keys on your disk, so just use the private one to unlock your root access. you can attach it in putty's auth options. no hacks needed. hope it will help someone.