Daily Archives: August 27, 2008

HTC touch pro

Mobilsiden har testede HTC Touch Pro, og de afslutter deres artikle med at den første indtryk er mere end godkendt. Den skulle have størrer batteri end Diamond og have mulighed for at udvide den indbyggede huklommelse med sd kort.

Jeg var ellers lige ved at hoppe fra den da nogle af mine kollega har fået diamonden men brokkede sig meget over batteri levetiden. Den skulle være blevet bedre.

Læs mobilsiden’s test her: http://www.mobilsiden.dk/?aId=6603/

Decrypt Cisco VPN group password

I have a customer how has broken his Cisco VPN Client profiles. But the group password encrypted was still fine.

So I found out that it was pretty easy to crack this encryption.

The algorithm
The algorithm which is used to encrypt a given user/group password is shown below (for further details just consult the source code):

  • The current date as a string is retrieved (e.g. Mon Sep 19 20:00:00 2005)
  • Then a SHA-1 Hash h1 is computed (20 Bytes)
  • h1 is modified and a new Hash h2 is calculated
  • h1 is again modified and h3 is calculated
  • the 3DES key is made of h2 and the first 4 bytes of h3
  • The password is encrypted using 3DES in CBC Mode. The IV consists of the first 8 bytes from h1.
  • The algorithm computes a last hash h4 from the encrypted password
  • The key “enc_UserPassword” in our profile file now looks like this: h1|h4|encrypted password

Jan Newger has made a programs witch can crack the password automatically, you can download it here: newgre.net/passwordrevealer#download