netopia 'factory' passwords

Martyr

it was mentioned in another thread that there was a backdoor in netopia routers, what was found: a username of 'tommy' and password of 'orange' which probably only works on some older model..

the other was 'factory' 'mqrrkcnd' - but this last password is just encoding of the mac..probably known by many already, so i've uploaded source + win32 exe for anyone who wants to test it out.

Netopia 'Factory' Password Generator v1.0
        *****************************************

        this is a simple tool which generates 'factory' passwords
        for Netopia routers..
        
        its for when you can't remember your 'admin' password,
        obviously.

        a very simple algorithm encodes a given MAC address
        and displays it on the console.
        
        you must use a telnet client to login to router, web access
        won't play.

        tested and confirmed to work on the following
        model of router with firmware installed:

              2008, 2247-02, firmware 7.8.0 (build r2)
              2006, 2247-02, firmware 7.7.0 (build r3)
              2005, 3347NWG, firmware 7.5.0

[URL="http://weiss.u40.hosting.digiweb.ie/netopia/nimdaten.zip"]binary + source[/URL]

the preparation of mac is almost identical to that when creating WEP keys, except this program will handle extra models too.

[php]
void mac2pass(u8 *password, u32 mac)
{
u32 i;
u32 serial = mac;

for(i = 0;i < 8;i++) {
password = (serial mod 26) + 'a';
serial >>= 2;
}
}
[/php]

[php]
switch(oui)
{
case 0xfcc:
serial |= 0x1000000;
break;
case 0x1d6b:
serial |= 0x2000000;
break;
default:
serial |= (oui << 24);
}
[/php]