Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Does anyone have a pointer to code (or just the algorithm) that Cisco uses to generate their password hashes for things like "enable secret"?

I'm not trying to break into anything; I'm trying to generate the appropriate "enable secret" line given a clear text password, not decode an existing "enable secret" line with a hashed password. I need this for an automated config-file generator that I'm working on (Netomata Config Generator).

Basically, what I want is the Cisco equivalent of the "htpasswd" command used for web servers.

For example, when I put the following command with clear-text password into a Cisco config:

enable secret foobar

then when I do a 'show config' command (assuming I have "service password-encryption" enabled), what I see is something like this:

enable secret 5 $1$pdQG$0WzLBXV98voWIUEdIiLm11

I want code that translates "foobar" to "5 $1$pdQG$0WzLBXV98voWIUEdIiLm11", so that I can generate the already-hashed passwords in my config-generation tool, rather than putting cleartext passwords in the generated configs and waiting for the router to generate the hash.

I presume that the "5" in the hashed result is some sort of hash algorithm identifier. If there are other hash algorithms that Cisco currently or has historically used, then I'd like to have the code for those algorithms as well.

share|improve this question

5 Answers 5

5 I believe refers to the fact that it's type 5, which uses MD5, which means you are going to need 300 playstation 3s. Type 7 is easily cracked and they even have scripts on websites for it. This might be better asked on Stackoverflow.

share|improve this answer
1  
+1 for the funny answer :) Oddly, this also gives me some hope that maybe now, using that article I can start getting my boss to buy us playstations.. –  Greg Meehan Jun 15 '09 at 21:50

'5' means that the clear password has been converted to cisco password type 5. Type 5 password is a MD5 based algorithm (but I can't tell you how to compute it, sorry). Type 7 that is used when you do a "enable password" is a well know reversible algorithm. "service password-encryption" just ensure that password will not be stored in clear (type 0)

Take a look to http://en.wikipedia.org/wiki/Crypt_(Unix)#MD5-based_scheme and good luck :)

EDIT: You may also look http://www.h4x3d.com/md5-and-crypt-password-generator/, http://www.koders.com/c/fid530E8983791E1CB2AB90EAA69A68789FA2A83A6D.aspx and http://www.cryptgenerator.de/

share|improve this answer

As per this website, the OpenSSL command line utility appears to provide the functionality you need:

$ openssl passwd -1 -salt pdQG -table foobar
foobar  $1$pdQG$0WzLBXV98voWIUEdIiLm11
$

And there is presumably an equivalent function in the library itself.

I'm not sure if IOS requires you to use specific salt values, but technically there is no reason why it should as long as the string you provide in your 'enable secret' command is a valid MD5 password digest. If you have the opportunity to test, I'd be interested to know your results.

share|improve this answer
up vote 9 down vote accepted

Cisco appears to require a 4-character salt. By default, without the "-salt salt" argument, openssl will generate an 8-character salt.

You can use openssl to generate a Cisco-compatible hash of "cleartext" with an appropriate random 4-character salt, however, like so:

openssl passwd -salt `openssl rand -base64 3` -1 "cleartext"

The "openssl rand -base64 3" sub-command generates 3 random bytes and then encodes them in base64 format, which gives you 4 printable characters (exactly what you need for a Cisco-compatible salt).

Thanks to Murali Suriar for the answer (elsewhere on this page) which got me started down the right path to this solution.

share|improve this answer

Here's a great reference http://haxcess.com/2008/10/21/cisco-password-recovery/

Bottom line is the hash is broken down into a few parts

  -> Indicates MD5 algorithm
 |   -> Salt
 |  |     -> Salt + Password Hash
 |  |    |
$1$mERr$RchIrJirmCXltFBZ2l50l/

Here's a Perl solution that has worked wonders for me in the past. Put this baby in a loop and let it run.

#!/usr/bin/perl
use Crypt::PasswdMD5;
my $hash = unix_md5_crypt('password','salt')
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.