Dictionary for EasyConnect, SETUP-, SPSETUP, XFSETUP, CBCI-, HOME-, SHAW- SSIDS

[FiosFiend]

I have been trying to run this dictionary (https://github.com/rhettrhett1/Technicolor-Router-Default-Passwords/tree/main) against the SSID SHAW-XXXX. I know the dictionary works, however it’s massive and takes an unreasonably long time to run. I rented 4x 5090 on vast.ai just to see, and it would still take 24+ hours to run the dictionary against 241 hashes. These passwords are the same as SSIDs EasyConnect, SETUP-, SPSETUP, XFSETUP, CBCI-, HOME-. So I collected the words from known WPA-SEC passwords and used them to create a much smaller dictionary. These wordlists (attached) can run in a reasonable amount of time and caught a surprising number of hits! Recovered 205/241 (85.06%) I have scraped eBay/FB listings for images and added them to the list as well, there are still a few known words I need to add. Then I pointed the dictionary back at the other WPA-SEC unknowns...

SETUP-XXXX 312/448 (69.64%)
SPSETUP-XXXX 13/27 (48.15%)
XPSETUP-XXXX 23/29 (79.31%)


This dictionary works for Technicolor CGM4331, CGM4141, and CGM4981 default passwords

 

[FiosFiend]

Here are the wordlists, and how to use them

Attack 1: 6letter+digits+5letter (67% success rate)
hashcat -a 1 -m 22000 yourhash.22000 6Lwords_numbers.txt 5Lwords.txt

Attack 2: 5letter+digits+6letter (if Attack 1 fails)
hashcat -a 1 -m 22000 yourhash.22000 5Lwords_numbers.txt 6Lwords.txt

Edit: It looks like you’ll have to add the numbers yourself since they are too big to share here

 

[FiosFiend]

Member @Sparton has generated an identical confirmed wordlists earlier, and independently of me. Therefore we think this is more than likely the complete dictionary.