14

Does anyone have a pointer to code (or just the algorithm) that Cisco uses to generate their password hashes for things like "enable secret"?

I'm not trying to break into anything; I'm trying to generate the appropriate "enable secret" line given a clear text password, not decode an existing "enable secret" line with a hashed password. I need this for an automated config-file generator that I'm working on (Netomata Config Generator).

Basically, what I want is the Cisco equivalent of the "htpasswd" command used for web servers.

For example, when I put the following command with clear-text password into a Cisco config:

enable secret foobar

then when I do a 'show config' command (assuming I have "service password-encryption" enabled), what I see is something like this:

enable secret 5 $1$pdQG$0WzLBXV98voWIUEdIiLm11

I want code that translates "foobar" to "5 $1$pdQG$0WzLBXV98voWIUEdIiLm11", so that I can generate the already-hashed passwords in my config-generation tool, rather than putting cleartext passwords in the generated configs and waiting for the router to generate the hash.

I presume that the "5" in the hashed result is some sort of hash algorithm identifier. If there are other hash algorithms that Cisco currently or has historically used, then I'd like to have the code for those algorithms as well.

1

6 Answers 6

18

As per this website, the OpenSSL command line utility appears to provide the functionality you need:

$ openssl passwd -1 -salt pdQG -table foobar
foobar  $1$pdQG$0WzLBXV98voWIUEdIiLm11
$

And there is presumably an equivalent function in the library itself.

I'm not sure if IOS requires you to use specific salt values, but technically there is no reason why it should as long as the string you provide in your 'enable secret' command is a valid MD5 password digest. If you have the opportunity to test, I'd be interested to know your results.

0
11

Cisco appears to require a 4-character salt. By default, without the "-salt salt" argument, openssl will generate an 8-character salt.

You can use openssl to generate a Cisco-compatible hash of "cleartext" with an appropriate random 4-character salt, however, like so:

openssl passwd -salt `openssl rand -base64 3` -1 "cleartext"

The "openssl rand -base64 3" sub-command generates 3 random bytes and then encodes them in base64 format, which gives you 4 printable characters (exactly what you need for a Cisco-compatible salt).

Thanks to Murali Suriar for the answer (elsewhere on this page) which got me started down the right path to this solution.

3

Here's a great reference http://haxcess.com/2008/10/21/cisco-password-recovery/

Bottom line is the hash is broken down into a few parts

  -> Indicates MD5 algorithm
 |   -> Salt
 |  |     -> Salt + Password Hash
 |  |    |
$1$mERr$RchIrJirmCXltFBZ2l50l/

Here's a Perl solution that has worked wonders for me in the past. Put this baby in a loop and let it run.

#!/usr/bin/perl
use Crypt::PasswdMD5;
my $hash = unix_md5_crypt('password','salt')
2

5 I believe refers to the fact that it's type 5, which uses MD5, which means you are going to need 300 playstation 3s. Type 7 is easily cracked and they even have scripts on websites for it. This might be better asked on Stackoverflow.

2
  • 1
    +1 for the funny answer :) Oddly, this also gives me some hope that maybe now, using that article I can start getting my boss to buy us playstations.. Jun 15, 2009 at 21:50
  • 1
    I realize this answer was added mainly for its comedic value, but it doesn't actually answer the question which asked for a way to generate the hash from cleartext, not cracking hash into cleartext :)
    – piit79
    Jun 21, 2021 at 14:17
1

'5' means that the clear password has been converted to cisco password type 5. Type 5 password is a MD5 based algorithm (but I can't tell you how to compute it, sorry). Type 7 that is used when you do a "enable password" is a well know reversible algorithm. "service password-encryption" just ensure that password will not be stored in clear (type 0)

Take a look to http://en.wikipedia.org/wiki/Crypt_(Unix)#MD5-based_scheme and good luck :)

EDIT: You may also look http://www.h4x3d.com/md5-and-crypt-password-generator/, http://www.koders.com/c/fid530E8983791E1CB2AB90EAA69A68789FA2A83A6D.aspx and http://www.cryptgenerator.de/

0

This question is old, but I find myself looking for a similar solution...

In python, you can generate cisco-esque "Type 5" hashes with passlib.hash.md5_crypt:

>>> from passlib.hash import md5_crypt
>>> cleartext = "foobar"
>>> cisco_type5_hash = md5_crypt.using(salt_size=4).hash(cleartext)
>>> cisco_type5_hash
'$1$qVo5$2M9hwNJKOaeCsnDlx3aDS0'
>>>

These days, cisco has a much stronger Type 9 SCRYPT hash, but as of this writing, there are no open-source implementations of the type 9 cisco password hash.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .