Breaking into an operational UniFi Cloud Key

A fellow on a group I follow was taking over from another group who was managing a RV Park's UniFi network. The old group wouldn't provide credentials for the onsite cloud key (a good reason to be rid of them).

Rather than go to each device and reset it in order to adopt them, another user (John Goggan at RFM Tech) suggested the following:

1. Reset the Cloudkey by holding down the reset button for more than 5 seconds.
2. SSH to the CK -- login with default ubnt/ubnt. Leave this sitting for now.
3. Log into the CK (not Controller) web interface with the default ubnt/ubnt. It'll force you to put in a new password -- do that.
4. Stop the Unifi Service.
5. Restore the latest backup -- there should be one there.
6. Start the Unifi Service back up.

The web interface should now show options to log into the CK or the Controller side. Cloudkey login is still ubnt and the password you set above. The Controller password is still unknown, but is up and running from that latest backup you just restored.

Now you go back to that SSH session that you opened earlier that is just sitting there and reset the password on the admin account. First, you find the admin login with this from a SU prompt:

mongo --port 27117 ace --eval "db.admin.find().forEach(printjson);"

That will give a list of all admin accounts (often just one). You then force a new password into that account with something like this:

mongo --port 27117 ace --eval 'db.admin.update( { "name" : "[User Found Above]" }, { $set : { "x_shadow" : "$6$9Ter1EZ9$lSt6/tkoPguHqsDK0mXmUsZ1WE2qCM4m9AQ.x9/eVNJxws.hAxt2Pe8oA9TFB7LPBgzaHBcAfKFoLpRQlpBiX1" } } )'

Note that you need to put the admin account into the "[User Found Above]" spot. And that hashed password above in my example is actually the word "password" literally.

You've now found the admin login and reset the admin password on the Controller to "password". Go back to the main web interface and log into the Controller GUI using those.
You're now logged into the Controller as the admin. You can then do whatever you want as usual, whether that is to continue using the on-site Cloud Key or migrate the the client to a cloud-based Controller.