KB ID 0000940 Dtd 08/04/14
Decrypt Type 7 Cisco Passwords
The Internet is full of sites that have something like the tool below, tap your ‘encrypted’ password in and it will reveal the Cisco password.
As you can see I’ve specifically written ‘obfuscated’ above, because the password isn’t actually encrypted at all. All that happens is the Vigenere algorithm is used to obfuscate the password. While tools like the one above are all well and good, your Cisco router will do exactly the same for you, to demonstrate, paste the following into the tool above.
Hopefully you will get the password Sup3rS3cr#tP@ssword.
Your router can also convert that to clear text for you;
Petes-Router# Petes-Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Petes-Router(config)#key chain decrypt Petes-Router(config-keychain)#key 0 Petes-Router(config-keychain-key)#key-string 7 107D1C09560521580F16693F14082026351C1512 Petes-Router(config-keychain-key)#exit Petes-Router(config-keychain)#exit Petes-Router(config)#exit Petes-Router# *Mar 1 00:04:48.691: %SYS-5-CONFIG_I: Configured from console by console Petes-Router#show key chain decrypt Key-chain decrypt: key 0 -- text "Sup3rS3cr#tP@ssword" accept lifetime (always valid) - (always valid) [valid now] send lifetime (always valid) - (always valid) [valid now] Petes-Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Petes-Router(config)#no key chain decrypt
So whats the point of these type 7 passwords? Well the only real benefit of them is if someone is looking over your shoulder while you are looking at the config, they can’t see actual passwords in the config.
The passwords in my config are in clear text? That’s because there are three levels of password storage 0 (not encrypted), 7 (weakly encrypted), and (5 strongly encrypted). If you want to convert your config to display them as 7 you need to enter the service password-encryption command;
Petes-Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Petes-Router(config)#service password-encryption Petes-Router(config)# Before username pete password 0 Password123 After username pete password 7 142713181F13253920796166
If Type 7 passwords are so weak, how do I use Type 5 passwords? When creating accounts use the secret command like so;
Petes-Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Petes-Router(config)#username petelong secret Password123 Petes-Router(config)#
Displays in the config as;username petelong secret 5 $1$VkQd$Vma3sR7B1LL.v5lgy1NYc/
Decrypting Type 5 Cisco Passwords
Decrypting a Type 5 Cisco password is an entirely different ball game, they are considered 'secure' because they are 'salted' (have some random text added to the password to create an MD5 hash) however that random salt is shown in the config.
username attackme secret 5 $1$TMnL$iAFs16ZXx7x18vR1DeIp6/
Well armed with the salt and the hash, we can use exactly the same method that Cisco use to create the encrypted password, by brute force attacking the password, this might sound like a difficult piece of hacking ninja skill, but we simply use openssl on a Linux box (here I'm using CentOS 6.5), all you need is a wordlist.txt file (search the Internet).
Feed openssl the salt, and a piece of the hash (see the example above), and it will run through, (grep) the wordlist until it finds a match, where it spits out the decrypted password an the original hash like so;
[root@pnl-server1 ~]# openssl passwd -1 -salt TMnL -table -in wordlist.txt | grep 8vR1DeIp6 SECRETPASSWORD $1$TMnL$iAFs16ZXx7x18vR1DeIp6/ [root@pnl-server1 ~]#
The decrypted password is SECRETPASSWORD
Note: The limitation here is the password has to be in the wordlist.txt file,but if you are adept at searching the Internet there are some impressive wordlist files out there, just make sure you use one that has full line breaks. Also remember, the longer the wordlist, the longer it takes.
Related Articles, References, Credits, or External Links