I have a customer how has broken his Cisco VPN Client profiles. But the group password encrypted was still fine.
So I found out that it was pretty easy to crack this encryption.
The algorithm which is used to encrypt a given user/group password is shown below (for further details just consult the source code):
- The current date as a string is retrieved (e.g. Mon Sep 19 20:00:00 2005)
- Then a SHA-1 Hash h1 is computed (20 Bytes)
- h1 is modified and a new Hash h2 is calculated
- h1 is again modified and h3 is calculated
- the 3DES key is made of h2 and the first 4 bytes of h3
- The password is encrypted using 3DES in CBC Mode. The IV consists of the first 8 bytes from h1.
- The algorithm computes a last hash h4 from the encrypted password
- The key “enc_UserPassword” in our profile file now looks like this: h1|h4|encrypted password
Jan Newger has made a programs witch can crack the password automatically, you can download it here: newgre.net/passwordrevealer#download