Hello! I am also struggling to get the credentials for the /c******* . I tried many different ways such as try to guess, default credentials, bruteforcing with different wordlists and common usernames, and also I wrote a python script in order to bypass the CSRF protection, if this was the problem but with no luck either.. There is a password that no matter the username, gives you a different response (403) but isn't helpful because you can't use-access the required url's for the public exploit.. Most of the people say they have just guessed it.. I really don't know how to move on.. Could you help me find the right credentials? Am I on the right direction or not? Thanks in advance!