search

sarnau / Inside-The-Loxone-Miniserver

Inside The Loxone Miniserver – various documentation about the Loxone Link/Tree protocol and hardware
195 stars 53 forks source link

Password hash #13

Closed croghostrider closed 4 years ago

croghostrider commented 4 years ago

Hi sanau, amazing work!!! do you know which hash algorithm Loxone use for saving the passwords? thanks regards

sarnau commented 4 years ago

Yes, I do.

In older versions (9 and earlier?) it was just obfuscated. Loxone now uses a one-way hash with a salt. That said, they still use an RC6 obfuscation to protect entries being copied from one user to the next, instead of hashing that information as well.

Not sure why you are interested in this, because you can reset passwords with no problem. Finding out a giving password based on the config file requires breaking SHA1, which pretty much is a brute force attack on the config file. Possible, if you know the algorithm, but not practical.