RE: Cisco Catalyst 4006 CatOS Password Hash

From: Joey Peloquin (jpelo1_at_jcpenney.com)
Date: 12/10/03

  • Next message: Alex Zimin: "RE: Inprotect software announcement." 
    Date: Wed, 10 Dec 2003 12:04:14 -0600
To: "'Paul Bakker'" <bakker@fox-it.com>, pen-test@securityfocus.com

    Hey Paul,

    According to the crypt(3) man page [1], $2$ is blowfish. A cursory
    search at google located BestCrypt [2], by Jetico, as a possible cracker
    for it.

    Hope it helps.

    Joey Peloquin

    [1] http://www.gsp.com/cgi-bin/man.cgi?section=3&topic=crypt
    [2] http://www.password-crackers.com/crack3.html

    -----Original Message-----
    From: Paul Bakker [mailto:bakker@fox-it.com]
    Sent: Wednesday, December 10, 2003 5:33 AM
    To: pen-test@securityfocus.com
    Subject: Cisco Catalyst 4006 CatOS Password Hash

    During a pentest/audit I received from the client the configurations for
    their Cisco Catalyst 4006 and their other Cisco IOS switches.

    The passwords in the Cisco IOS configuration file are in in the known
    usual format of the FreeBSD MD5 hash... Like $1$xxxx$xxxxxxxxxxxxxxxxxxx

    These are easily crackable/recognized by both John the Ripper and
    Cain&Abel.

    The passwords on the Catalyst are in the same format (for the eye), but
    instead of starting with $1$ they start with $2$..... Both John and Cain
    do not recognize these hashes.

    Can anybody shed some light on the hash function used to create these
    and any tools that can be used to eudit the password strenght of these
    passwords (Or how John or Cain can be sed for this...) 

    --
Paul Bakker
------------------------------------------------------------------------
---
------------------------------------------------------------------------
----

    The information transmitted is intended only for the person or entity to
    which it is addressed and may contain confidential and/or privileged
    material. If the reader of this message is not the intended recipient,
    you are hereby notified that your access is unauthorized, and any review,
    dissemination, distribution or copying of this message including any
    attachments is strictly prohibited. If you are not the intended
    recipient, please contact the sender and delete the material from any
    computer.

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

  • Next message: Alex Zimin: "RE: Inprotect software announcement."

    Relevant Pages

    • auditing nt hash
      ... I'm trying to figure out the nt hash vs lm hash. ... I dump the hash with pwdump2 and then run John against it. ... 4-8 characters and it finds the passwords relatively quickly. ...
      (Security-Basics)
    • Re: Password hashes
      ... NTLM hash as the key. ... There is however no locally stored NTLMV2 hash of passwords. ... Auditing and reviewing the security logs ... secure their network and data and the documentation to do such at TechNet ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Windows XP / 2K3 Default Users
      ... Cracking the 'passwords' has never been ... The gist of the 'technique' is the "Modifying Windows NT Logon Credential" ... existing windows applications that use the hash currently set to ... and then re-use those hashes to try to get authenticated access to other ...
      (Pen-Test)
    • Re: Pidgin IM Client Password Disclosure Vulnerability.
      ... because we need to be able to generate the hash a given ... Some protocols can ask for different types of hashes at ... passwords stored in it ... lost, you have much bigger problems than lost IM passwords. ...
      (Bugtraq)
    • Re: Decrypt fails
      ... I am creating a MD5 hash data and then using it to derive a key ... (CALG_RC2 encryption algorithm). ... My requirement concerns more with not storing passwords in plain ... > that he provided and compare it to the hash in the database. ...
      (microsoft.public.platformsdk.security)