Decrypt Cisco VPN group password

I have a customer how has broken his Cisco VPN Client profiles. But the group password encrypted was still fine.

So I found out that it was pretty easy to crack this encryption.

The algorithm
The algorithm which is used to encrypt a given user/group password is shown below (for further details just consult the source code):

  • The current date as a string is retrieved (e.g. Mon Sep 19 20:00:00 2005)
  • Then a SHA-1 Hash h1 is computed (20 Bytes)
  • h1 is modified and a new Hash h2 is calculated
  • h1 is again modified and h3 is calculated
  • the 3DES key is made of h2 and the first 4 bytes of h3
  • The password is encrypted using 3DES in CBC Mode. The IV consists of the first 8 bytes from h1.
  • The algorithm computes a last hash h4 from the encrypted password
  • The key “enc_UserPassword” in our profile file now looks like this: h1|h4|encrypted password

Jan Newger has made a programs witch can crack the password automatically, you can download it here: newgre.net/passwordrevealer#download

Share this:
Share this page via Email Share this page via Stumble Upon Share this page via Digg this Share this page via Facebook Share this page via Twitter

You may also like...

1 Response

  1. May 10, 2009

    […] by CaseyP 21 days ago1 votesDRM Technologies – DRM (Part 2)>> saved by henna13 23 days ago5 votesDecrypt Cisco VPN group password>> saved by sev7eno 27 days ago1 votesToolME Java ME Utilities>> saved by hurtpolishgirl 29 days […]

Leave a Reply

Your email address will not be published. Required fields are marked *