I've got a copy of a Cisco ASA config and i want to crack the following example passwords

I've got the following lines in the config

ASA Version 8.4(2)


hostname ciscoasa

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted



So I want to try and crack the enable password, but i don't know what format it is or what tool i can use to brute force it. (Note the hash there is not the real hash, just a random hash i found online like the original)

I already know the password is “cisco” for passwd, but if that was different, how can i go about cracking it? Are these two passwords the same format/hash type (the first doesn't have any 'punctuation' but that might just be by chance.

I'm familiar with cracking the MD5 passwords, level/type 7 'secrets' etc but not cracking the enable password for IOS devices.

Extra Credit:

There are also the following lines with multiple usernames in it which i assume are the same format as above.


no threat-detection statistics tcp-intercept

ntp server


username test password hmQhTUMT1T5Z4KHC encrypted privilege 15


I tried adding the 'known' cisco hash into the PIX-MD5 in cain manually, but it didn't work (used a dict with cisco in it). See below: enter image description here

Hope someone can help, Thanks!

5 Answers 5


The Cisco ASA config you have provided appears to use CISCO PIX-MD5 hashes.

Both the VPN settings mentioned above and the enable/passwd are not salted, contrary to what the hashcat.net thread suggests in Peleus's post. It is worth while checking this site: Nitrix Hash Generator In there you can enter 'cisco' as the password and you'll recieve the common


hash back out as you have in the above config. You can repeat the process for blank

If you've used oclHashcat-plus before, the following command worked perfectly to crack it on windows for me.

cudaHashcat-plus64.exe --hash-type 2400 C:\Users\user\Desktop\hashes.txt C:\Users\user\Desktop\password.lst

On my machine i got about 70,000k/s with GPU acceleration. I always recommend using a good word-list like this: crackstation's list

  • Perfect! Thanks. I already had the Crackstation list but it didn't play well with cain... Hashcat's awesome. I just ran it and it found about 65% of the passwords. Do you know exactly how the PIX-MD5 hashes work/are created?
    – NULLZ
    Commented Feb 27, 2013 at 23:28
  • 1
    arstechnica.com/security/2013/03/… Just FYI anyone reading this.
    – NULLZ
    Commented Mar 20, 2013 at 0:31

The easiest way is to use an online tool. It may have already stored passwords and their hash: http://www.ibeast.com/content/tools/CiscoPassword/index.asp

Using Cain and Abel you should be able to crack your current password of 2KFQnbNIdI.2KYOU fairly fast with a dictionary or bruteforce. Not sure of the issue you are having with Cain but it should work (try bruteforce as well).

Below is the example to bruteforce the hash with cain:

Click on Cracker, Click on Cisco PIX-MD5 Hashes, Click the "+" button, add your hash. enter image description here

Select various options to use for the crack. Click Start. enter image description here

The cracked password is show in the text box as "cisco". enter image description here

The password shows up in the password field now. enter image description here

  • As mentioned in the question, i am NOT after a tool to reverse a type 7 password! Feel free to try and add "2KFQnbNIdI.2KYOU" into cain and see if it works anywhere. I've tried under two different machines and IOS-MD5 is the wrong length and PIX-MD5 does not crack to 'cisco'
    – NULLZ
    Commented Feb 26, 2013 at 10:34
  • @D3C4FF I have added a tutorial on how to crack the password with Cain. I am not sure what problem your having. Maybe it's a typo or an ancient version of Cain.
    – ponsfonze
    Commented Feb 27, 2013 at 5:26
  • 1
    Turns out it was just the dictionary attack that had issues with Cain. When I tried with the above method it worked as well. Thanks.
    – NULLZ
    Commented Feb 27, 2013 at 22:12

From what I can tell in the docs this is a "type 6" password and this seems to be related to encrypting a pre-shared key. "type 6" seems to be an improvement over "type 7" in that there is a per-device salt, though it is reversible.

I did some googling of the exact password line since you said its the default password, this article suggests running more system:running-config which will show you the preshared key (Reversing the preshared key). This was also noted in the CISCO documentation.

I am not sure if there is any rainbow table or reversing available for this.

From the Cisco forums:

Type-6 passwords are encrypted using AES cipher and user-defined master key. These passwords are much better protected and the additional difficulty in their decryption is given by the fact that also the master key is defined by the user and is never displayed in the configuration. Without knowledge of this master key, Type-6 keys are unusable. The disadvantage is that when backing up a configuration or migrating it to another device, the master key is not dumped and has to be configured again manually.


  • Unfortunately i don't have access to the device to run more system:running-config... :( There is no mention however of "type 6" passwords in the config that i can find. Please note there are two (potentially different) places i've sourced passwords from in the above question, one form the beginning of the config file and one from the VPN setup section. The VPN would be handy but i'm more concerned about the Enable password. Cheers,
    – NULLZ
    Commented Feb 26, 2013 at 2:19
  • Check out the link above titled "Reversing the preshared key" the exact enabled line from the top of your config is on that page. Type-6 passwords cannot be easily reversed because they depend upon the per device local key. I cannot recall which link it was know, but "8Ry2YjIyt7RRXU24" is the default for when a password is not set and "2KFQnbNIdI.2KYOU" is default indicating "cisco"
    – Eric G
    Commented Feb 26, 2013 at 2:22
  • For the sake of this question, i don't care about the PSK. You are correct, the enable password in the above example is 'blank'. I want to crack the passwords for the vpn USER accounts, not the VPN itself. And i want to crack the Cisco-PIX encrypted enable password, it appears that Cain does not do this as it appears to no longer be MD5
    – NULLZ
    Commented Feb 26, 2013 at 2:32
  • for the "test" account? It looks like its also the type-6
    – Eric G
    Commented Feb 26, 2013 at 2:35
  • Are you saying i need the VPN PSK to decrypt VPN user passwords? :/
    – NULLZ
    Commented Feb 26, 2013 at 2:41

8Ry2YjIyt7RRXU24 encrypted key is default but for cli it mean there is nothing set / no password. I guess that you are trying to access asa via cli. Just use enable command & press enter and you should be able to login

I have not come across any tool (especially free tool) that can help break MD5 hash. I'd love to know if you come across one.

Hope it helps!


  • You realise if you read the post you'd see this is NOT what he's asking...? Sighs
    – user173641
    Commented May 18, 2018 at 20:29

In this case google is quite literally your friend.

So the enable hash you've got it 8Ry2YjIyt7RRXU24

It looks a bit odd in Cain as it cracks instantly but if you google the hash value then the first result is this which tells us that that's the hash for a blank password...

FWIW when I try cracking that password in cain as a Cisco-PIX-MD5 hash it works just fine (of course there's nothing visible in the password box as it's a blank password)

  • I know its a blank password, and that the secondary password is Cisco. I pulled those values off other configs because of that. I've found the solution to my issues myself. It seems that cain doesn't like using the dictionary i supplied and that's why it didn't crack, when i tried using brute-force it worked fine. Additionally OCL-Hashcat-Plus works with GPU accel and cracks both the VM Passwords and enable/passwd passwords.
    – NULLZ
    Commented Feb 27, 2013 at 13:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .