(12-13-2017, 12:28 AM)fart-box Wrote: ... It seems people aren't too keen about sharing their personal stash of  information around here.

(12-14-2017, 12:51 AM)fart-box Wrote: The capital 'T', as well as the other six characters that surround it have me puzzled though. If that's supposed to be the password, I'm wondering where the capital 'T' comes from, because it's not in my character set. And if I recall, the video password was thirteen characters long, not seven, or even twelve.

(01-09-2018, 01:42 AM)fart-box Wrote: soxrok2212, if you're still working with that BASH script and wishing for a data base with MAC addresses and SN's this might help you a bit, or perhaps you already know.

NVG-599 - MAC address, converted to decimal, minus 1 = SN.

ex: MAC = 0xD404CDBE1C11 = 233117096746001, SN = 233117096746000

(06-28-2017, 03:19 AM)mrfancypants Wrote: I've finally worked out part of the algorithm for 589/599. Not enough to crack it (in fact, with what I worked out, it's totally possible that it's [effectively] uncrackable because they feed it from a RNG), but enough to understand how passwords are being constructed.

Consider the following. Actual parameters of a NVG599 off eBay:

SSID: ATTn3f64I2 
Wireless key: nyrip9=c5bgv 
Access key: 18?/72@@<3 
Second SSID: vATTvb%g?<&c
Second wireless key: #h,t)0(ZUwI0

Looks random, right? Now watch:

Code:

ssid_charset='23456789ABCDEFGHIJKMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz'
pw_charset='abcdefghijkmnpqrstuvwxyz23456789#%+=?'
ext_charset='!"#$%&\'()*+,-./:;<=?@[]_`{|}0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
def intpw(x):
   val=0
   for n in range(0,12):
           val+=pw_charset.find(x[n])*(37**(11-n))
   if (val%8)==7:
           val+=37**12
   return val
def intssid(x):
 val=0
 for n in range(0,7):
  val+=ssid_charset.find(x[n+3])*(56**(6-n))
 return val
def int_ext(x):
   val=0
   for n in range(0,len(x)):
           val+=ext_charset.find(x[n])*(90**(len(x)-1-n))
   return val

>>> '%x' % intssid('ATTn3f64I2')
'13c2a3ea400'
>>> '%x' % intpw('nyrip9=c5bgv')
'7a7b4bbbf4f69800'
>>> '%x' % int_ext("b%g?<&c")
'1f71654cac80'
>>> '%x' % int_ext("#h,t)0")
'3d6180c00'
>>> '%x' % int_ext("(ZUwI0")
'a98a65dc0'

I'll let you meditate on this for now and I'll explain later  (hint: consider positions of top and bottom set bits in '7a7b...')

(01-26-2018, 04:12 PM)needbmw Wrote: Pace 5268AC passwords always start from a numeric digit. Assuming the password is base-37 coded long int with unknown range and unknown charset is it possible that charset has numeric digits first?
I mean '23456789abcdefghijkmnpqrstuvwxyz#%+=?' or '23456789#%+=?abcdefghijkmnpqrstuvwxyz'.
Then applying some int ranging  we will always have first numeric digit in the password.

(01-28-2018, 01:03 AM)fart-box Wrote: I should also point out that there was no response confirming that Mr. Wolfe's password actually worked, so he could have just plucked it right out of the air.