Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I know that when setting up VTP across switches in a network you should set a secret/password to prevent unauthorized requests. My question is I know that this uses an MD5 hash to ensure that attackers don't falsify any requests, but I haven't been able to find a decent explanation of how this hash is calculated. Is it salted with the domain of the network? Is it a request salted with the password sent to the VTP server? Is it even salted at all? All i have seen when digging through Cisco documentation is stuff along the lines of "Requests are secured using a MD5 hash," but I have yet to see a decent explanation of how this hash is actually calculated.

Edit: I am attempting to crack a VTP password given a captured VTP packet. Hence why I want to know how the md5 hash is salted.

share|improve this question

1 Answer 1

For general understanding, vtp allows central management of vlan domains, id and other attributes. It governs how other switches learn and understands vlan. Any updates related to vtp management is sent by the vtp server.

Here, the risk lies when the md5 hash is known either by compromising the switch and running commands such as e.g show command, show vtp password or by looking at the vlan.dat file an attack can force a digest change for the entire domain thus a new vtp server can be setup (a rogue) which then allow unauthorized access to previously blocked / disabled vlans allowing addition of new unauthorized switches in the network.

As with version 3.0 of vtp the two options: hidden and secret provide mitigation to recovery of message digest. For more info. Look at the link below http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/solution_guide_c78_508010.html

UPDATE based upon the excerpt taken from the article . MD5 hash is calculate and is equal only when the domains names are the same along with taking in consideration other vtp configurations. The above link , the author of that article has performed tests to confirm just this.

share|improve this answer
    
How is that hash calculated though? I am attempting to find a way to crack it given a captured VTP packet. Also yes before anyone asks yes I own the network and I do already have the password. –  Jannu Apr 10 '13 at 16:30
    
Alright got a decent guess based on the link provided by Saladin. The MD5 digest appears to be a hash of all the VTP information which will include the password with it. The switch then appears to hash this and send it with the update to the other routers. The new switch then hashes the new values with their password in their configuration and if the digest matches they accept the update else they reject the update. That said I don't have anything hard and fast yet because it appears Cisco themselves have failed to publish documentation on this or at least ensure it's distributed. –  Jannu Apr 10 '13 at 17:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.