First off, I'm well aware that this is a controversial topic. I can give my word as a sysadmin that I have the best of intentions (depending on how you view the next paragraph) but I understand that some people will take issue with this. It's your choice whether to answer privately (see profile for website/contact info) or not at all.
We have an older Linux-based appliance that's developed some issues, and unfortunately is still relatively critical to one of our services. It's an older x86 Linux "white box" appliance, and the vendor has, apparently, closed up shop a few years ago, so no support at all.We've exhausted every option other than trying to root the box and fix it ourselves, and unfortunately, instead of a normal IDE disk, it has some weird soldered-on-board flash drive.
I managed to use a (long-known, never patched) URL argument vulnerability in their web UI (Perl CGI script) to dump /etc/passwd (not shadowed - go figure), and have the crypted (salted MD5) hashes for root and a user named "support". Any suggestions on where to go from here? I don't really know much about the "other side" of security. The most exposure I've had to password cracking is running John the Ripper on /etc/passwd to check for dictionary words - but I installed it on a 16-core box, and I assume it'll take weeks (if it ever succeeds) to get us a result, especially since it's only using one core.
Any suggestions for how to do this? Short of asking some crypto guys to take a few weeks to write something... does anyone know of (reputable) software for this task? Or can anyone recommend a reputable company that will... "recover" the password?