Home› AMX User Forum› AMXForums Archive Threads› AMX Hardware

Procedure - How to reset the security on a NXC-ME260

mushmush Posts: 287
in AMX Hardware
G'day all,

For some time now I've had three NXC-ME260 masters sitting in my garage not being used as they had security set on telnet, HTTP, FTP and the serial (program) port. I purchased them on eBay and was unable to obtain the passwords.
Today I had a crack, after reading some forum entries and getting some ideas, at resetting the security and I had success. I found a security loop-hole in an older version of firmware.

All the commands entered below are via terminal over an RS232 connection (except the firmware transfers).
The procedure is..
1. Type “clean disk”
2. reboot the master
3. Load firmware v2.10.85
4. Type “security setup” a list of options is presented
5. Select option 4 ‘Edit User’ and hit enter
6. Then Select 2, which should be the ‘NetLinx’ user account
7. Then select 6 ‘Change Access Rights’ and hit enter
8. The select 6 ‘Security Configuration Access’ and hit enter
9. Then hit enter twice to return to the main Security menu.
10. Select option 4 ‘Edit User’ and hit enter
11. This time select 1, which should be the administrator account.
12. Select 1 ‘Change User Password’
13. Change the password to whatever you want
14. Hit enter to return to the main Security Menu
15. Enter 13 to save the changes
16. Reload the latest firmware (v2.31.139)
17. Reboot
17. All done!

This worked on all 3 masters so I'm fairly confident it should work for anyone. The only problem that I can see is if the NetLinx user has been deleted.
Anyway, I would love to hear of any results. Please post them here.

Cheers

Comments

  • John NagyJohn Nagy Posts: 1,742
    So if security was on for telnet, and you didn't have the passwords, where are you typing?

    If the previous user had the good sense not to lock out the program port with security, you can connect a serial cable and talk with NLStudio Terminal and do this same thing with any firmware. Security setup used to be available in telnet in old firmware, now just in serial terminal.
  • jjamesjjames Posts: 2,908
    Or you could spend months looking for the password to the backdoor login without success.
  • mushmush Posts: 287
    John Nagy wrote: »
    So if security was on for telnet, and you didn't have the passwords, where are you typing?
    .
    I was typing in Terminal - Thanks for picking that up. I've amended the procedure.
    John Nagy wrote: »
    If the previous user had the good sense not to lock out the program port with security, you can connect a serial cable and talk with NLStudio Terminal and do this same thing with any firmware. Security setup used to be available in telnet in old firmware, now just in serial terminal.
    All access, except for sending programs, had been blocked. Hence my need for a work around.
  • [Deleted User][Deleted User] Harman Integrated Technologies Group (ITG) Posts: 0
    Did you try 'reset factory' through terminal? My guess would be that if you are physically connected to the device via programming cable, you have made it through any type of physical building security the premises may have to offer. As John pointed out, your NI Master had security turned on for other forms of communication but not for terminal. had that been activated, I suspect you would not have been able to change the settings. In short, I do not think you found an exploit but rather found a section of your master that did not have security activated by the previous owner.

    Another tip for those looking to clean a NI master is to use 'clean disk -f'. The -f handler will clean out all folders and directories to include bound Duet Module files that are otherwise left on the master during a normal 'clean disk' because they are no longer in the user directory. Using 'clean disk -f' will erase everything like 'reset factory' does, but it will leave your other permissions settings in place like security and more importantly network configuration.
  • jjamesjjames Posts: 2,908
    AMX_Chris wrote: »
    Another tip for those looking to clean a NI master is to use 'clean disk -f'. The -f handler will clean out all folders and directories to include bound Duet Module files that are otherwise left on the master during a normal 'clean disk' because they are no longer in the user directory. Using 'clean disk -f' will erase everything like 'reset factory' does, but it will leave your other permissions settings in place like security and more importantly network configuration.
    Nice! I forgot about that one, and could have used it a few days ago.

    Thanks for the reminder!
  • mushmush Posts: 287
    AMX_Chris wrote: »
    Did you try 'reset factory' through terminal? My guess would be that if you are physically connected to the device via programming cable, you have made it through any type of physical building security the premises may have to offer. As John pointed out, your NI Master had security turned on for other forms of communication but not for terminal. had that been activated, I suspect you would not have been able to change the settings. In short, I do not think you found an exploit but rather found a section of your master that did not have security activated by the previous owner.

    Another tip for those looking to clean a NI master is to use 'clean disk -f'. The -f handler will clean out all folders and directories to include bound Duet Module files that are otherwise left on the master during a normal 'clean disk' because they are no longer in the user directory. Using 'clean disk -f' will erase everything like 'reset factory' does, but it will leave your other permissions settings in place like security and more importantly network configuration.

    G'day Chris,
    Thanks for your input, nice to have some official advice. I'm always glad to see someone from the 'front lines' taking the time to see what's going on in the forums.

    Access to all 3 masters was limited to connection via NLS only. I could change firmware, dump code and change configuration settings.
    If I tried to connect via HTTP, Telnet or Terminal I was presented with the 'Login:' prompt.
    I tried the generic username password combinations, administrator|password and NetLinx|password, but the passwords had been changed.
    So, in this situation, I could not try 'factory rest' or 'clean disk'.

    When I downgraded the firmware to v2.10.85, I am no longer presented with the 'Login:' prompt when accessing HTTP, Telnet or Terminal.
    So from this point I can access 'security setup'. I am unable to change the administrator password as I still have to login to do that, but I am able to modify the NetLinx account. So all I have to do is change the password and access rights to the NetLinx account and then I'm able to login and change the administrator account.
    After completing the changes and upgrading the firmware to the latest (v2.31.139) the security settings are retained.

    Obviously, having performed the same procedure 3 times, I was fairly confident that I was correct but to prove it to myself I turned the security on and went through the whole process again and it all worked fine.

    I tried 'reset factory' but this command is not available in v2.*.* firmware. It would appear that it was implemented in build 414.
    The 'clean disk' -f handler does not work on build 85 an error is generated.

    Cheers
  • wbphelpswbphelps Posts: 5
    Interesting. So what does one do with an ni-3100 that has had passwords changed, including rs232 access?
  • vincenvincen Posts: 526
    wbphelps wrote: »
    Interesting. So what does one do with an ni-3100 that has had passwords changed, including rs232 access?
    Return to AMX for full reset, no other option I'm afraid :(
  • wbphelpswbphelps Posts: 5
    I was coming to that conclusion, thanks for confirming it. I have to say I am quite surprised by this - I can completely reprogram the box, and upgrade the firmware, but I can't reset it. Seems pretty silly.
  • Joe HebertJoe Hebert Posts: 2,159
    wbphelps wrote: »
    I was coming to that conclusion, thanks for confirming it. I have to say I am quite surprised by this - I can completely reprogram the box, and upgrade the firmware, but I can't reset it. Seems pretty silly.
    What about a downgrade of firmware? I'm not sure but maybe there are earlier versions that didn't have all the security? Just guessing...
  • jjamesjjames Posts: 2,908
    While there are legitimate reasons to unlock a master, can you imagine if there was a way to get into a master using a "backdoor" password or routine? Anyone then would be able to get into anyone else's master.

    I would suggest that if there was ever such a way to remove a password that it also destroy the program as well - essentially a factory default.
  • wbphelpswbphelps Posts: 5
    jjames wrote: »
    While there are legitimate reasons to unlock a master, can you imagine if there was a way to get into a master using a "backdoor" password or routine? Anyone then would be able to get into anyone else's master.
    I would suggest that if there was ever such a way to remove a password that it also destroy the program as well - essentially a factory default.

    I'm not asking for a backdoor password. Note that I can already access the box via the programming port, download the source that was in it, replace the program, and change the IP configuration.

    A way to reset the box is EXACTLY what I need, and I would be shocked if it doesn't actually exist. I'm sure there is a way to do this that AMX hasn't told us about. There are jumpers on the board...
  • John NagyJohn Nagy Posts: 1,742
    wbphelps wrote: »
    I'm not asking for a backdoor password. Note that I can already access the box via the programming port, download the source that was in it, replace the program, and change the IP configuration.

    A way to reset the box is EXACTLY what I need, and I would be shocked if it doesn't actually exist. I'm sure there is a way to do this that AMX hasn't told us about. There are jumpers on the board...

    AMX re-images the flash card when you return it for this service. You can't do this yourself because the image includes the unique serial number info.
  • jjamesjjames Posts: 2,908
    wbphelps wrote: »
    A way to reset the box is EXACTLY what I need, and I would be shocked if it doesn't actually exist. I'm sure there is a way to do this that AMX hasn't told us about. There are jumpers on the board...
    Depending on the firmware - 'reset factory' via telnet should do the trick.
    John Nagy wrote: »
    AMX re-images the flash card when you return it for this service. You can't do this yourself because the image includes the unique serial number info.
    No, that is not correct. The flash card can be replaced by anyone. Now, the on-board flash memory, well that's a different story.
  • wbphelpswbphelps Posts: 5
    jjames wrote: »
    Depending on the firmware - 'reset factory' via telnet should do the trick.

    I don't know of anyway to enter this command if all ports are password protected. Do you?
  • wbphelpswbphelps Posts: 5
    John Nagy wrote: »
    AMX re-images the flash card when you return it for this service. You can't do this yourself because the image includes the unique serial number info.

    I do not believe the login passwords are kept on the CF card. Otherwise we could just replace the CF card, no? Lots cheaper than shipping the box in..

    (Hi, John! Been a long time...)
  • jjamesjjames Posts: 2,908
    Write a Duet module and use com.amx.duet.core.master.SystemConfig.reset2defaults()?
  • John NagyJohn Nagy Posts: 1,742
    jjames wrote: »
    Depending on the firmware - 'reset factory' via telnet should do the trick.


    No, that is not correct. The flash card can be replaced by anyone. Now, the on-board flash memory, well that's a different story.

    Yes, that makes more sense and is probably what was meant when it was explained to me by support some time ago. I misunderstood or misremembered.
Sign In or Register to comment.