Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've got a copy of a Cisco ASA config and i want to crack the following example passwords

I've got the following lines in the config

ASA Version 8.4(2)

!

hostname ciscoasa

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

So I want to try and crack the enable password, but i don't know what format it is or what tool i can use to brute force it. (Note the hash there is not the real hash, just a random hash i found online like the original)

I already know the password is “cisco” for passwd, but if that was different, how can i go about cracking it? Are these two passwords the same format/hash type (the first doesn't have any 'punctuation' but that might just be by chance.

I'm familiar with cracking the MD5 passwords, level/type 7 'secrets' etc but not cracking the enable password for IOS devices.

Extra Credit:

There are also the following lines with multiple usernames in it which i assume are the same format as above.

!

no threat-detection statistics tcp-intercept

ntp server

webvpn

username test password hmQhTUMT1T5Z4KHC encrypted privilege 15

!

I tried adding the 'known' cisco hash into the PIX-MD5 in cain manually, but it didn't work (used a dict with cisco in it). See below: enter image description here

Hope someone can help, Thanks!

share|improve this question

5 Answers 5

up vote 4 down vote accepted

The Cisco ASA config you have provided appears to use CISCO PIX-MD5 hashes.

Both the VPN settings mentioned above and the enable/passwd are not salted, contrary to what the hashcat.net thread suggests in Peleus's post. It is worth while checking this site: Nitrix Hash Generator In there you can enter 'cisco' as the password and you'll recieve the common

2KFQnbNI­dI.2KYOU

hash back out as you have in the above config. You can repeat the process for blank

If you've used oclHashcat-plus before, the following command worked perfectly to crack it on windows for me.

cudaHashcat-plus64.exe --hash-type 2400 C:\Users\user\Desktop\hashes.txt C:\Users\user\Desktop\password.lst

On my machine i got about 70,000k/s with GPU acceleration. I always recommend using a good word-list like this: crackstation's list

share|improve this answer
    
Perfect! Thanks. I already had the Crackstation list but it didn't play well with cain... Hashcat's awesome. I just ran it and it found about 65% of the passwords. Do you know exactly how the PIX-MD5 hashes work/are created? –  NULLZ Feb 27 '13 at 23:28
1  
arstechnica.com/security/2013/03/… Just FYI anyone reading this. –  NULLZ Mar 20 '13 at 0:31

This should point you in the right direction, I won't repeat all that's written there however.

http://hashcat.net/forum/thread-1664.html

share|improve this answer
    
I think that appears to be correct with the usernames (in the webvpn setup) but there is no username for enable mode?? –  NULLZ Feb 26 '13 at 2:01
2  
Please do repeat, see the FAQ and How to Answer - link only answers tend to degrade over time and are not of much value. Please quote the key points (assuming they allow such use). –  AviD Feb 26 '13 at 7:15

The easiest way is to use an online tool. It may have already stored passwords and their hash: http://www.ibeast.com/content/tools/CiscoPassword/index.asp

Using Cain and Abel you should be able to crack your current password of 2KFQnbNIdI.2KYOU fairly fast with a dictionary or bruteforce. Not sure of the issue you are having with Cain but it should work (try bruteforce as well).

Below is the example to bruteforce the hash with cain:

Click on Cracker, Click on Cisco PIX-MD5 Hashes, Click the "+" button, add your hash. enter image description here

Select various options to use for the crack. Click Start. enter image description here

The cracked password is show in the text box as "cisco". enter image description here

The password shows up in the password field now. enter image description here

share|improve this answer
    
As mentioned in the question, i am NOT after a tool to reverse a type 7 password! Feel free to try and add "2KFQnbNIdI.2KYOU" into cain and see if it works anywhere. I've tried under two different machines and IOS-MD5 is the wrong length and PIX-MD5 does not crack to 'cisco' –  NULLZ Feb 26 '13 at 10:34
    
@D3C4FF I have added a tutorial on how to crack the password with Cain. I am not sure what problem your having. Maybe it's a typo or an ancient version of Cain. –  ponsfonze Feb 27 '13 at 5:26
    
Turns out it was just the dictionary attack that had issues with Cain. When I tried with the above method it worked as well. Thanks. –  NULLZ Feb 27 '13 at 22:12

From what I can tell in the docs this is a "type 6" password and this seems to be related to encrypting a pre-shared key. "type 6" seems to be an improvement over "type 7" in that there is a per-device salt, though it is reversible.

I did some googling of the exact password line since you said its the default password, this article suggests running more system:running-config which will show you the preshared key (Reversing the preshared key). This was also noted in the CISCO documentation.

I am not sure if there is any rainbow table or reversing available for this.

From the Cisco forums:

Type-6 passwords are encrypted using AES cipher and user-defined master key. These passwords are much better protected and the additional difficulty in their decryption is given by the fact that also the master key is defined by the user and is never displayed in the configuration. Without knowledge of this master key, Type-6 keys are unusable. The disadvantage is that when backing up a configuration or migrating it to another device, the master key is not dumped and has to be configured again manually.

References:

share|improve this answer
    
Unfortunately i don't have access to the device to run more system:running-config... :( There is no mention however of "type 6" passwords in the config that i can find. Please note there are two (potentially different) places i've sourced passwords from in the above question, one form the beginning of the config file and one from the VPN setup section. The VPN would be handy but i'm more concerned about the Enable password. Cheers, –  NULLZ Feb 26 '13 at 2:19
    
Check out the link above titled "Reversing the preshared key" the exact enabled line from the top of your config is on that page. Type-6 passwords cannot be easily reversed because they depend upon the per device local key. I cannot recall which link it was know, but "8Ry2YjIyt7RRXU24" is the default for when a password is not set and "2KFQnbNIdI.2KYOU" is default indicating "cisco" –  Eric G Feb 26 '13 at 2:22
    
For the sake of this question, i don't care about the PSK. You are correct, the enable password in the above example is 'blank'. I want to crack the passwords for the vpn USER accounts, not the VPN itself. And i want to crack the Cisco-PIX encrypted enable password, it appears that Cain does not do this as it appears to no longer be MD5 –  NULLZ Feb 26 '13 at 2:32
    
for the "test" account? It looks like its also the type-6 –  Eric G Feb 26 '13 at 2:35
    
Are you saying i need the VPN PSK to decrypt VPN user passwords? :/ –  NULLZ Feb 26 '13 at 2:41

In this case google is quite literally your friend.

So the enable hash you've got it 8Ry2YjIyt7RRXU24

It looks a bit odd in Cain as it cracks instantly but if you google the hash value then the first result is this which tells us that that's the hash for a blank password...

FWIW when I try cracking that password in cain as a Cisco-PIX-MD5 hash it works just fine (of course there's nothing visible in the password box as it's a blank password)

share|improve this answer
    
I know its a blank password, and that the secondary password is Cisco. I pulled those values off other configs because of that. I've found the solution to my issues myself. It seems that cain doesn't like using the dictionary i supplied and that's why it didn't crack, when i tried using brute-force it worked fine. Additionally OCL-Hashcat-Plus works with GPU accel and cracks both the VM Passwords and enable/passwd passwords. –  NULLZ Feb 27 '13 at 13:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.