Kindle touch 5.1.0 SSH password

[Oneill]

Hi all,
i need an advice regarding SSH to my Kindle touch 5.1.0 firmware. All information at this forum were very usefull, I was able to jailbreak, install SSH and connect to device using putty.

Unfortunately neither mario nor fiona or fionaxxx with numbers works for me to get inside as root. I was able to get into device as framework user with mario password, but I cant change password for root using this account.

I tried passwd root but I get "Must be suid to work properly" message. Im more to windows environment then unix but this seems like framework account does not have sufficient rights.
After that I did cat /etc/shadow and run result through John The Ripper using dictionary attack containing fiona+3 digit number combinations. Unsuccessfuly
I also tried ;un password command via kindle web browser but this seems to have no effect. Am I doing something wrong here? Password should have been empty If I understood instructions correctly

Sorry if I messed something, this is my first post to this forum

[knc1]

As a new user of this forum...
Hint: Line breaks are cheap here, no extra charge if you use them in the body of your text.

[geekmaster]

The framework user account is VERY limited in what it can do. About the only useful thing is "cat /etc/shadow".

Question: did you ever CHANGE the password? If so, you may need a (lengthy) john brute-force cracking session (no wordlist)...

In case you ever changed the password to fionaXXXX (4 hex digits) I also have a wordlist with 4 hex digits (if the posted one is missing them).

[Oneill]

Hi geekmaster, thanks for reply. No I did not change the password. Why 4 hex digits? I thought that max pass length is 8 chars. Could you please provide me the list? I would like to give it a try. Thanks a lot.

@knc1: you are right indeed. I did some visual changes

[knc1]

Originally Posted by Oneill

@knc1: you are right indeed. I did some visual changes

Thanks.
Nothing personal, yours just happened to not be the first "mind dump" post that showed up here today.

[geekmaster]

Originally Posted by Oneill

Hi geekmaster, thanks for reply. No I did not change the password. Why 4 hex digits? I thought that max pass length is 8 chars. Could you please provide me the list? I would like to give it a try. Thanks a lot.

@knc1: you are right indeed. I did some visual changes

There are a lot of FALSE reports of kindles using fionaXXXX (including the PW generating javascript page). If somebody changes their password, it always stores the new password as a salted MD5 hash which encodes all characters entered, not just the first 8 characters like the simple DES hash used for default root passwords.

It would ONLY have 4 hex digits IF you changed your password to use 4 hex digits.

I just downloaded the wordlist and it contains all possible fionaXXX and fionaXXXX passwords. It does not contain "mario" though, so you may want to add that to your list. No need for a new list. If you used a different list, download it from master index / tools index.

If you did not change your password, this is the first reported case of amazon CHANGING a password, or the first reported case of a kindle coming with a DIFFERENT password (not mario or fionaXXX).

If you can send me your shadow file, I can try cracking it when I have time.

[Oneill]

Thank you for help! The problem was my password list. I generated one myself using C# and I forgot to put hex letters to lowercase All is working now, I got the password. Thanks again.

[geekmaster]

Originally Posted by Oneill

Thank you for help! The problem was my password list. I generated one myself using C# and I forgot to put hex letters to lowercase All is working now, I got the password. Thanks again.

You are welcome. Thank you for thanking me. It is always nice to feel appreciated (especially after being attacked by trolls in other forums).

Was your password DIFFERENT from the one generated by the kindle pw web page? If so, did you use all UPPERCASE serial number? The serial number is NOT printed on the case. It is in the settings menu.

[NiLuJe]

Did you end up with something different than from the info command of kindletool?

[Oneill]

final password for root was fiona1b6. I bought kindle just yesterday, so I did not have time to look through all forums and did not now that somebody already generated the list. I did my list in C# and when converting int to hex I forgot that it will be in uppercase. So my list contained fiona1B6, not fiona 1b6.

Yesterday when I found out that I must register device to make it fully functional I was pretty angry, had sleepless night so I did some reading on jailbreaking - will register manualy now, I dont mind the web browser. There is a lot stuff especially at this site, so I think you all are doing very good job. There are always few people who do not appreciate hard work, but the rest do

[geekmaster]

Originally Posted by Oneill

final password for root was fiona1b6. I bought kindle just yesterday, so I did not have time to look through all forums and did not now that somebody already generated the list. I did my list in C# and when converting int to hex I forgot that it will be in uppercase. So my list contained fiona1B6, not fiona 1b6.

Yesterday when I found out that I must register device to make it fully functional I was pretty angry, had sleepless night so I did some reading on jailbreaking - will register manualy now, I dont mind the web browser. There is a lot stuff especially at this site, so I think you all are doing very good job. There are always few people who do not appreciate hard work, but the rest do

You can also COMPUTE the password, where the 3 hex digits a cut from the middle of the md5sum of the serial number, using the same algorithm as the web page uses.

My questions are still unanswered:
1) Did you use an all uppercase serial number with the "kindle password" web page?
2) Is your password different from the one generated by the web page?

Try the web page again, and compare the results to your pw. If needed, we want to update the algorithm used by the web page.

[Oneill]

I did not use web page to get the code. I tried it now but I have 5.1.0 firmware and web page shows only up to version 4.

[geekmaster]

Originally Posted by Oneill

I did not use web page to get the code. I tried it now but I have 5.1.0 firmware and web page shows only up to version 4.

There are no reports that the pw algorithm changed on newer kindles. It works on my 5.1.0 kindle. You can ignore that obsolete "up to" version statement on the web page.

Please try the PW web page to see if the PW for your serial number matches what you found with John. If the web page does not provide your kindle PW, please let us know. Thanks.

EDIT: The password web page INCORRECTLY reports fionaXXXX (4 hex digit) passwords, when default root passwords should ALWAYS be fionaXXX (3 hex digits). It does not hurt to type the extra digit, but it only adds to the confusion. Also, the mario password is not always tied to a specific firmware version. You should try it if the fionaXXX password does not work. When I reported the mario password and fionaXXX corrections to the website owner, he added them as additional OPTIONS, and arbitrarily tied them to specific versions, contrary to my suggestions (which only complicated the web page rather than simplifying it as I wanted). It is not under my control so I could not fix it myself.

[aditya3098]

Considering you have usbnet installed, won't ;un password <password> in the search bar work?

[knc1]

Originally Posted by aditya3098

Considering you have usbnet installed, won't ;un password <password> in the search bar work?

Does not read as if it does:

Originally Posted by post number 1

I also tried ;un password command via kindle web browser but this seems to have no effect. Am I doing something wrong here?

Perhaps just did not use the correct format of the command.