Password recovery from firmware build

[shaman79]

Hi there, so it happened that I flashed my device with firmware build that had web password set using #WEB_PASSWORD variable during build.
Unfortunately I forgot the password and I do not have the used user_override.h file, but I have the firmware build.

Is there a way to extract the web admin password from the firmware file?

[HofeBY]

Try from browser with active Device

http://DeviceIPv4/ufs/.settings

if downloded file arrived, look with text editor.

[sfromis]

Sure, that worked for you, but it is very common that people are using ESP8266 devices without such details available. That's why I posted a UFSD link as an option with higher chance of success, if there even is a file system (which is not on most ESP8266 devices).

Hence my "most devices", where your suggestions just cannot work.

Even with a standard precompiled ESP32 build, your suggestion did not work in a quick test....

[HofeBY]

@sfromis
It was a try to get the password on an easy way.
shaman79 has it´s used firmware.bin and if not it is possible to download it from the physical device.
than it is possible to inspect it by a Hexeditor.

[shaman79]

Yep, the only thing I have is the .bin file. Web password is probably hashed or somehow encoded during build. It is not visible anywhere in the bin file.

[sfromis]

No, it is in plain text in the binary, and very visible, as long as you are not looking at a compressed .gz file.

[Jason2866]

exactly, Tasmota firmware and all settings are not encrypted. The devices needs to be secured against unwanted people access of the hardware.

[HofeBY]

I don't want to emphasize it too much.
But even if you protect web access with a password, the authentication is done via http and can therefore be read by the man in the middle in promiscuous mode.

[sfromis]

Right, it is not anywhere "real security". Of course, if you already have intruders on your network, you may have a lot worse problems to deal with than a Tasmota device.