Decrypt Cisco VPN group password

I have a customer how has broken his Cisco VPN Client profiles. But the group password encrypted was still fine.

So I found out that it was pretty easy to crack this encryption.

The algorithm
The algorithm which is used to encrypt a given user/group password is shown below (for further details just consult the source code):

  • The current date as a string is retrieved (e.g. Mon Sep 19 20:00:00 2005)
  • Then a SHA-1 Hash h1 is computed (20 Bytes)
  • h1 is modified and a new Hash h2 is calculated
  • h1 is again modified and h3 is calculated
  • the 3DES key is made of h2 and the first 4 bytes of h3
  • The password is encrypted using 3DES in CBC Mode. The IV consists of the first 8 bytes from h1.
  • The algorithm computes a last hash h4 from the encrypted password
  • The key “enc_UserPassword” in our profile file now looks like this: h1|h4|encrypted password

Jan Newger has made a programs witch can crack the password automatically, you can download it here: newgre.net/passwordrevealer#download

You may also like...

1 Response

  1. May 10, 2009

    […] by CaseyP 21 days ago1 votesDRM Technologies – DRM (Part 2)>> saved by henna13 23 days ago5 votesDecrypt Cisco VPN group password>> saved by sev7eno 27 days ago1 votesToolME Java ME Utilities>> saved by hurtpolishgirl 29 days […]

Leave a Reply

Your email address will not be published. Required fields are marked *