FLIR password list - Page 1
Forum section: electronics / general

author: Fraser
author_rank: Super Contributor
timestamp: September 14, 2020, 09:55:12 pm
content: I thought it might be a good idea to collect together the passwords that are used in connection with FLIR Cameras.The best known login and password combination on the forum is likely that used to gain access to the FLIR E4 for upgrading it via an IP link and FTP transfer.If we could please create a new post for each Login - Password combination to avoid confusion. Please detail which camera it is applicable to, and for what purpose. I will kick it off with the ones I know.Thank youFraser

author: Fraser
author_rank: Super Contributor
timestamp: September 14, 2020, 09:56:50 pm
content: Camera : Ex series, Exx series ... many others !Purpose : Accessing camera files via FTP over IPLogin : flirPassword : 3vligAdditional Notes: None

author: Fraser
author_rank: Super Contributor
timestamp: September 14, 2020, 10:02:22 pm
content: Camera: FLIR One Gen 2 and Gen 3Purpose : Accessing camera via the serial portLogin : rootPassword : indigoAdditional Notes :Serial Port pinout is : GND TX RX (see attached image)Serial Port Configuration : 115200 BaudAttribution: Information provided by forum member : tmbinc

author: Fraser
author_rank: Super Contributor
timestamp: September 14, 2020, 10:19:09 pm
content: Camera : Not defined but includes early Exx seriesPurpose : Unlocking the EEPROM from the service menuLogin : flirPassword : 1235Additional Notes : Tread carefully if modifying the eeprom contents !

author: Fraser
author_rank: Super Contributor
timestamp: September 14, 2020, 10:20:52 pm
content: Camera : Not defined but several camera models are known to use thisPurpose : Accessing Camera files via FTP over IPLogin : flirPassword : IRCAMAdditional Notes : None

author: Fraser
author_rank: Super Contributor
timestamp: September 14, 2020, 10:29:12 pm
content: Camera : SC6000 & SC4000 Science camerasPurpose : Unlocking the hidden Manufacturing mode of the “Big GUI”Login : None - Password challenge.Password : indigoAdditional Notes :Run SC6000 GUI and press Ctrl-Shift-M to activate Password Challenge free text box.

author: Fraser
author_rank: Super Contributor
timestamp: September 14, 2020, 10:33:51 pm
content: Camera : TAU CNV Low light camera (not thermal)Purpose : Unlocking the hidden Manufacturing mode of the TAU CNV GUILogin : None - Password challengePassword :www.flir.comAdditional Notes :Run TAU CNV GUI and press Ctrl-Shift-M to activate Password Challenge free text boxThe FLIR TAU CNV low light camera uses a different GUI to the TAU thermal camera.

author: Fraser
author_rank: Super Contributor
timestamp: September 15, 2020, 12:08:42 am
content: Camera : Ex series and likely many othersPurpose : Camera Recovery - Accessing Camera files via FTP over IP without booting the camera. Limited privileges.Login : anonymousPassword : NcFTP@Additional Notes :This is used to access a FLIR camera without booting it. Detail from “Bud” reproduced here.....“ Ex cameras can be switched to RNDIS after connecting to USB and without booting the camera by using FLIRInstallNet.exe from Flir Tools software. You launch the exe, select the camera which is in MSC mode and run the attached .fif file, which will switch the camera temporarily to RNDIS until you boot it.So after you upload the .fif , do ping 192.168.0.2 to make sure it worked, then connect using ftp with the following credentials:user: anonymouspass: NcFTP@this gives access to the filesystem without booting the camera.”I have attached the RNDIS file in case it is needed.Attribution: This information was harvested from posts by forum member : Bud

author: Fraser
author_rank: Super Contributor
timestamp: September 15, 2020, 01:34:00 am
content: Camera : TAU plus others that use the same GUIPurpose : Unlocking the hidden Manufacturing mode of the TAU GUILogin : None - Password challengePassword :www.flir.comAdditional Notes :Run TAU GUI and press Ctrl-Shift-M to activate Password Challenge free text boxMy thanks to a fellow forum member "VGN" who investigated the password string in the TAU GUIUPDATE:I have been advised that the Manufacturing mode in the TAU GUI has been edited by FLIR to remove the useful functionalityMaybe a very old version of the GUI retains that functionality. Since the E4 upgrade discovery, FLIR have been removing service modes from cameras and this policy appears to extend to hidden engineering modes in public release utilities.I have some older GUI’s for the TAU, Photon and OMEGA (FLIR M10) cores and will have to check them for manufacturing mode content.

author: tmbinc
author_rank: Frequent Contributor
timestamp: September 15, 2020, 10:26:34 am
content: Flir One: "indigo" works on both Gen2 and Gen 3. I have not observed differences between various models. Baudrate is 115200.

author: Fraser
author_rank: Super Contributor
timestamp: September 15, 2020, 10:54:10 am
content: Thank you. I have added the additional information

author: Fraser
author_rank: Super Contributor
timestamp: September 15, 2020, 11:45:27 am
content: At this point it may be worth me explaining some of the passwords used in FLIR equipment.Some are intended to reduce the chances of users accidentally damaging the cameras performance by ‘fiddling’ with settings, whilst others are intended to prevent access for corporate reasons.“3vlig”This is a Swedish password that comes from the Ex AGEMA (Sweden) staff of FLIR. The Swedish word is actually Trevlig which means “Nice” in EnglishFLIR bought AGEMA and the rights to its designs. The AGEMA passwords remained in software and products. Later cameras developed by the Ex AGEMA team continued to use The Swedish passwords. It was almost a protest to say AGEMA may have been “Borged” by the American FLIR company, but the Swedish heart still beats within its products ! A sort of in-house joke maybe ? It is no secret that AGEMA, Inframetrics and Indigo staff were less than thrilled at being absorbed into FLIR !“indigo”This is a password from the days when Indigo were the manufacturer of very capable and compact thermal imaging cameras. FLIR bought Indigo and absorbed the very knowledgeable staff into FLIR. It is no surprise that “Indigo” is found in software that FLIR now uses. The TAU series of cores are direct descendants of the Indigo Omega and Photon cores.“www.flir.com”This password brings me nicely to trying obvious passwords if one is not known. Many manufacturers used to use the company name, or a variant of it, as engineering passwords. It is not uncommon to find that an engineering password is the company name in reverse ! In the case of the Faxitron X-Ray machine I owned, the password fir advanced menu access was NORTIXAF (all upper case) Guessing such a password is not trivial however as a mixture of upper and lower case can be used, plus variations on the company name As FLIR have done in the case of “www.flir.com” ! If you go hunting for plain text entries in software using a Hex editor, you may strike lucky if you see a possible password candidate thoughThere is another Swedish password used in a FLIR camera but sadly I have forgotten itFLIR is an amalgamation of several very capable companies so it is no surprise that remnants of those individual companies creep into password usage. AGEMA were a very reputable and capable thermal camera manufacturer. They were based in Sweden so it is no surprise that the engineering team used Swedish words, or variants of such, as engineering passwords. That does make life harder to spot the password in a text search of software though. Inframetrics were a USA based company that FLIR bought. I have not seen any Inframetrics passwords however so no clues as to what format they are or if in some way connected with Inframetrics history. Indigo, as has already been stated, were a very important acquisition fir FLIR. They had a great design team and many still work fir FLIR. Some left to form Seek Thermal. Many of the Indigo camera designs and techniques gave birth to FLIR’s current camera offerings. The roots of the Ex and Exx series are in Indigo technology and knowledge.It is well worth reading any, and all technical documentation for a manufacturers cameras, especially documents like the ICD or firmware update processes. You sometimes find login and password information ‘hidden’ in such documents as some users need such to configure a camera for their needs. This applies mainly to Industrial cameras however. In the case of FLIR I have found login and password information within Technical Installation guides and amongst Technical Support answers in camera FAQ’s and firmware patching instructions.Sadly Passwords are never easy to guess without at least some hint as to the format and likely options. There are very clever members of this forum who know far more than me about finding passwords in software or circumventing such protection. This thread is really just a collection of passwords that are already in the public domain.Fraser

author: tmbinc
author_rank: Frequent Contributor
timestamp: September 15, 2020, 01:31:54 pm
content: I guess now is the time to add 'JohanL & LennieA' to the list.

author: Fraser
author_rank: Super Contributor
timestamp: September 15, 2020, 06:19:18 pm
content: Tmbinc,“JohanL & LennieA”Can you add some context to those entries please ?Fraser

author: oPossum
author_rank: Super Contributor
timestamp: September 15, 2020, 06:20:26 pm
content: That is the key for the Autoliv NV2

author: calel
author_rank: Regular Contributor
timestamp: September 15, 2020, 07:59:23 pm
content: ok so can someone explain the reason why Flir engineers would put a password on the customer's own camera? (other than being complete aholes)2nd question: how were those passwords found out: were they public (as in, disclosed by FLIR) in the first place (in which case I take back what I said) or did some hacker figure them out?last question: if it's meant to be a true password to prevent customer from accessing their own cam, how come it's the same password for all cameras of same model? ie. why do all E4's have same password, instead of a different password for each serial number?

author: Fraser
author_rank: Super Contributor
timestamp: September 15, 2020, 08:58:10 pm
content: Calel,Please will you start another thread for such a discussion. This one needs to be kept to just Passwords please, rather than debating why manufacturers use them.Thank youFraser

author: calel
author_rank: Regular Contributor
timestamp: September 15, 2020, 09:50:30 pm
content: well my question was about flir passwords so it is still rather ontopic but I'll make a new topic '_'

author: Fraser
author_rank: Super Contributor
timestamp: September 15, 2020, 10:39:53 pm
content: Nope, this is the “FLIR PasswordLIST” and not a FLIR password discussion threadThank you for starting a new thread and I have answered your questions there.Fraser

author: agiorgitis
author_rank: Regular Contributor
timestamp: September 16, 2020, 02:18:41 pm
content: Flir E75username: rootpassword: Z2jciRI don't know whether this password is specific to my camera (per camera password) or is common on all Ex5 series.Maybe someone else can try...

author: stereoti
author_rank: Newbie
timestamp: December 14, 2020, 09:56:50 am
content: root:Z2jciR does not appear to work on E75 (FW 6.22.68) or at least not on SSH and Web login. I did however manage to login asfliruserwith the good old3vligand was able to find some bcrypt hashes from users.db inside /home/rootdeveloper$2y$10$LBNcMBC/Bn3VVnhlI1j7huOZ.UOykGaq3VZ.YAgu0mAZXAQ8q36uGservice$2y$10$syAL0yMLBfN/8.sciVnCE.kBto6mtVvjrmyhPQAo7oV3rq8X8pBkeviewer$2y$10$lxA0o325EuUtVAaTItBt.OSpZSfxIrT56ntm7326FQ/fTBc0ODWqquser$2y$10$O5Ybml6qN9caTjezQR0f8.z230PavQYUwmZCzMVxL6BMeNvLWEr9qadmin$2y$10$/J/KDhh0.UDg5pbwtPG9B.W2gEWrS36qHji1scgxO7uiTk1GuAa.KUPDATE:The root password hash was world-readable and is $1$T5f7njVX$itbwBbH5SnomehGVWTQ5y/ and according to hashcat the matching password is AjKXT7. I will try this on an actual device before christmas.

author: Logan
author_rank: Frequent Contributor
timestamp: December 14, 2020, 02:38:39 pm
content: Sorry if it’s a bit off topic here.But while I’m excited waiting for Ex5 hacking to progress, I just checked Flir’s website for their price. To my surprise, Flir “refreshed” their product name again. All Ex5 pages shows “The product has been discontinued. Recommended replacement: XXX”. Which are E54, E76, E86, E96. Even the E95 they just released less than a month, which enable the full VGA resolution, has been discontinued (or just changed a name?)Just for reference:https://flir.netx.net/file/asset/32481/original/attachment

author: stereoti
author_rank: Newbie
timestamp: December 22, 2020, 04:21:40 pm
content: Some new findings: It appears that Exx series from model year 2017 onwards do not have the same root passwords for all models. It could be either model related or in the most inconvenient way, serial number dependent. I will continue my research.Here is the hash for E54: $1$.s9Ja..s$gM4OdlyS9ky05TfsA3qeL0UPDATE:It is now confirmed that the root passwords for the FLIR Linux models are camera specific. No longer able to hack'em without brute force. The password seems to be however quite short so if you've got some GPU force you could gain root in a matter of hours. At the moment of writing this, it seems to be a six character long uppercase-lowercase-number combination. Now trying to figure out what to do with root in this very limited BusyBox driven command line...

author: agiorgitis
author_rank: Regular Contributor
timestamp: May 16, 2021, 12:14:27 pm
content: Quote from: stereoti on December 14, 2020, 09:56:50 amThe above hashes are the same for all.viewer:viewer, user:user, admin:admin.Question is what's the passwords for developer and service, unfortunately bcrypt takes years to be calculated, at least on my pc (6 chars, lower, upper, numbers = 12 years)

author: KaneTW
author_rank: Frequent Contributor
timestamp: February 21, 2022, 06:41:05 pm
content: Flir E76 has /etc/shadow no longer world-readable, but you are a member of "disk" as "fliruser". You can use that to access the storage devices directly and extract everything.

author: tcq1000
author_rank: Contributor
timestamp: January 10, 2024, 08:57:56 am
content: Hello!Can you tell me how to obtain Hash? Insert the device into SD, connect USB to PC, read the content files of the SD card, such as FLIRCurr. dir, FLIRVers. rsc, and then retrieve the hash of the file? What kind of software is used to obtain Hash?Quote your message：Here is the hash for E54: $1$.s9Ja..s$gM4OdlyS9ky05TfsA3qeL0

author: nikitasius
author_rank: Regular Contributor
timestamp: January 16, 2024, 08:20:03 am
content: well, just ran hashcat onCode:$1$.s9Ja..s$gM4OdlyS9ky05TfsA3qeL0$1$T5f7njVX$itbwBbH5SnomehGVWTQ5y/it found `$1$T5f7njVX$itbwBbH5SnomehGVWTQ5y/:AjKXT7` as stereoti told (found it almost at the end lol).but `$1$.s9Ja..s$gM4OdlyS9ky05TfsA3qeL0` aren't [a-zA-Z0-9] for 5 or 6 symbols. So it's probably longer or contain other symbols.

author: nikitasius
author_rank: Regular Contributor
timestamp: January 17, 2024, 07:56:02 am
content: Well folks, `$1$.s9Ja..s$gM4OdlyS9ky05TfsA3qeL0` islongerthan 6 times `?a` in hashcat (meanallcharacters 6 long password).So blind bruteforce is the last what folks need to do. Better to build adictionary+ somecustom rules. I stopped mine (cause i rented a vps w/ Tesla GPU inside).if someone have a RTX GPU 3080ti/3090 4080/4090 and wanna do someblindbruteforce:1) download hashcat2) run `hashcat -I` and see message probably about missing CUDA stuff3) download CUDA from Nvidia's website, if hashcat says no devices which support CUDA but you know that you have, well install also video drivers (case on servers usually)4) create a file put inside `$1$.s9Ja..s$gM4OdlyS9ky05TfsA3qeL0` (w/o `) name it `flir.hashes.txt`5) create a file put inside and name it `flir.charset.txt````?a,?1?1?1?1?1?1?1?a,?1?1?1?1?1?1?1?1?a,?1?1?1?1?1?1?1?1?1?a,?1?1?1?1?1?1?1?1?1?1```It's bruteforce mask for 7,8,9 & 10 symbols. But much better is to make a dictionary & run some more precision attack.6) run hashcat `hashcat -m 500 -O -w 4 --session flir -o flir.found.txt -a 3 flir.hashes.txt flir.charset.txt`7) to see actual status press `s`, to save progress and stop press `c`8 ) to continue saved via `c` session called `flir` run `hashcat --session flir --restore` and it will continue the session.it will run sesson `flir` using full resources (-w 4, while default is -w 2) and optimised (-O), if it will find something it will save it into `flir.found.txt`.`-m 500` mean md5 unix hashes. If you wanna hack passwords fromhttps://www.eevblog.com/forum/thermal-imaging/flir-password-list/msg3369218/#msg3369218you need to place them inside your `hash txt file` and change `-m 500` to `-m 3200`. But blind bruteforcing bcrypt heavily sucks, so better as i said to try dictonary attack. At least old passwords are dictionary friendly (except`AjKXT7`, sure).Here is a great base for dictionary attackshttps://github.com/duyet/bruteforce-databasewhich combined w/ custom rules in hashcat can be pretty useful.

author: ixfd64
author_rank: Frequent Contributor
timestamp: July 04, 2025, 09:18:28 pm
content: I found a website that lists "fliradmin" as a default password:https://a1securitycameras.com/blog/default-username-passwords-ip-addresses-for-surveillance-camerasIt seems to be for home security cameras, but it may still be worth testing it against thermal imagers.