{"id":5254,"date":"2023-07-06T22:50:47","date_gmt":"2023-07-07T03:50:47","guid":{"rendered":"https:\/\/www.incredigeek.com\/home\/?p=5254"},"modified":"2023-07-06T22:50:47","modified_gmt":"2023-07-07T03:50:47","slug":"information-on-the-mcuser-on-ubiquiti-radios","status":"publish","type":"post","link":"https:\/\/www.incredigeek.com\/home\/information-on-the-mcuser-on-ubiquiti-radios\/","title":{"rendered":"Information on the mcuser on Ubiquiti Radios"},"content":{"rendered":"\n<p>Who is this mcuser on ubiquiti devices?  Nothing shows up in the radio config file about it, but the user shows up in \/etc\/passwd<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/07\/image-1.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1012\" height=\"75\" src=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/07\/image-1.png\" alt=\"\" class=\"wp-image-5278\" srcset=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/07\/image-1.png 1012w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/07\/image-1-300x22.png 300w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/07\/image-1-768x57.png 768w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/07\/image-1-1000x75.png 1000w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/07\/image-1-500x37.png 500w\" sizes=\"auto, (max-width: 1012px) 100vw, 1012px\" \/><\/a><\/figure>\n\n\n\n<p>mcuser is used for AirControl2.  If we look what is in the passwd file, we&#8217;ll notice that there is a ! at the beginning of the hash.  Meaning that this password is disabled as the hash is not a proper hash.  It&#8217;s only 10 characters long instead of the normal 13 for Unix DES hashes.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">mcuser:!VvDE8C2EB1:0:0::\/etc\/persistent\/mcuser:\/bin\/sh<\/pre>\n\n\n\n<p><a href=\"https:\/\/community.ui.com\/questions\/Virus-atack-v2\/be924ab6-5cb0-4f9b-a4f7-246025196cc0?page=10\">https:\/\/community.ui.com\/questions\/Virus-atack-v2\/be924ab6-5cb0-4f9b-a4f7-246025196cc0?page=10<\/a><\/p>\n\n\n\n<p>There is a valid ssh key, so the mcuser can ssh to the device without a password and do what it needs to do.  Doing an ls on a device shows the following.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/07\/image-3.png\"><img loading=\"lazy\" decoding=\"async\" width=\"714\" height=\"384\" src=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/07\/image-3.png\" alt=\"\" class=\"wp-image-5280\" srcset=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/07\/image-3.png 714w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/07\/image-3-300x161.png 300w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/07\/image-3-500x269.png 500w\" sizes=\"auto, (max-width: 714px) 100vw, 714px\" \/><\/a><\/figure>\n\n\n\n<p>Refer to the following article on removing AirControl Provisioning<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-wp-embed is-provider-incredigeek wp-block-embed-incredigeek\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"wp-embedded-content\" data-secret=\"zn4fqRUT58\"><a href=\"https:\/\/www.incredigeek.com\/home\/remove-aircontrol-provisioning-from-ubiquiti-radio-via-ssh\/\">Remove AirControl provisioning from Ubiquiti radio via SSH<\/a><\/blockquote><iframe loading=\"lazy\" class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" title=\"&#8220;Remove AirControl provisioning from Ubiquiti radio via SSH&#8221; &#8212; Incredigeek\" src=\"https:\/\/www.incredigeek.com\/home\/remove-aircontrol-provisioning-from-ubiquiti-radio-via-ssh\/embed\/#?secret=Pt3JS9Gihf#?secret=zn4fqRUT58\" data-secret=\"zn4fqRUT58\" width=\"584\" height=\"329\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe>\n<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Who is this mcuser on ubiquiti devices? Nothing shows up in the radio config file about it, but the user shows up in \/etc\/passwd mcuser is used for AirControl2. If we look what is in the passwd file, we&#8217;ll notice &hellip; <a href=\"https:\/\/www.incredigeek.com\/home\/information-on-the-mcuser-on-ubiquiti-radios\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,1144],"tags":[687,1527,503,221,131,132,974],"class_list":["post-5254","post","type-post","status-publish","format-standard","hentry","category-ubiquiti","category-ubiquiti-command-line","tag-hash","tag-mcuser","tag-security","tag-ssh","tag-ubiquiti-2","tag-ubnt","tag-ui"],"_links":{"self":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/5254","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/comments?post=5254"}],"version-history":[{"count":1,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/5254\/revisions"}],"predecessor-version":[{"id":5281,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/5254\/revisions\/5281"}],"wp:attachment":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/media?parent=5254"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/categories?post=5254"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/tags?post=5254"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}