I have a customer how has broken his Cisco VPN Client profiles. But the group password encrypted was still fine.

So I found out that it was pretty easy to crack this encryption.

The algorithm
The algorithm which is used to encrypt a given user/group password is shown below (for further details just consult the source code):

• The current date as a string is retrieved (e.g. Mon Sep 19 20:00:00 2005)
• Then a SHA-1 Hash h1 is computed (20 Bytes)
• h1 is modified and a new Hash h2 is calculated
• h1 is again modified and h3 is calculated
• the 3DES key is made of h2 and the first 4 bytes of h3
• The password is encrypted using 3DES in CBC Mode. The IV consists of the first 8 bytes from h1.
• The algorithm computes a last hash h4 from the encrypted password
• The key “enc_UserPassword” in our profile file now looks like this: h1|h4|encrypted password

Jan Newger has made a programs witch can crack the password automatically, you can download it here: newgre.net/passwordrevealer#download