Category Archives: Cisco

Recovery IOS image with help of serial (console) and xmodem

This guide is only for recovery of a broken IOS image on you Cisco switch!.

First download a new image from Cisco. Is require a Cisco login, ask you dealer for a login for Cisco or a IOS image for you switch.

  1. Download Tera Term Pro: http://hp.vector.co.jp/authors/VA002416/teraterm.html
  2. Connect to the serial port in Tera Term Pro – Setup -> Serial port.
    Port: Com2 (Or what you serial port number is)
    Baud rate: 9600
    Data: 8 bit
    Parity: none
    Stop: 1 bit
    Flow control: none

    Then press OK

  3. Now you are connect to the switch and the switch shows “switch: “, here type:
    flash_init
    set BAUD 115200
  4. Now the serial speed is set to 115200, so the transfer will go a lot faster, so we just need to disconnect tera term and connect again with the new baud rate.
    In Tera term go to File – Disconnect
  5. Now we need to setup a new connection – Setup -> Serial port.
    Port: Com2 (Or what you serial port number is)
    Baud rate: 115200
    Data: 8 bit
    Parity: none
    Stop: 1 bit
    Flow control: none

    Then press OK.

  6. Now we are connect with baud rate 115200, then type:
    copy xmodem: flash:image_filename.bin
    Where image_filename.bin, is the filename of the image, if you image lastname is .tar you need to unpack it first. Use 7zip for that. http://www.7-zip.org/download.html
  7. Then wee need to send the image to switch choise File -> transfer -> send in tera term.
    And pick up you new image file, and wait for tera term to finish.
  8. After the upload has finish type:
    boot flash:image_filename.bin
  9. Then the image will boot. Now you need to setup the switch so it will boot automatic on that image everytime you reboot the switch, go to configure terminal (conf t)
  10. Here you type:
    boot system flash:image_filename.bin
    And maybe you want to set the baud rate to default 9600 agian
    line con 0
    speed 9600
  11. exit the configure terminal and type:
    wr mem

Now you are finish recovery you switch.

Network Policy Server problems

I have a network policy server that din’t work. There was nothing standing in the Event viewer. I have install Wireshack and could se the packets was incoming and a reject was coming back to the Radius Client.

I was search around to see howthis error was occurring, but i could fine nothing.

I then found the program IAS Log Viewer, and its told me that is what the Connection Request Policy that was the error, as i Delete that and created a new standard one everything was working fine.

The program can be downloaded here: http://www.deepsoftware.com/iasviewer/index.html

Decrypt Cisco VPN group password

I have a customer how has broken his Cisco VPN Client profiles. But the group password encrypted was still fine.

So I found out that it was pretty easy to crack this encryption.

The algorithm
The algorithm which is used to encrypt a given user/group password is shown below (for further details just consult the source code):

  • The current date as a string is retrieved (e.g. Mon Sep 19 20:00:00 2005)
  • Then a SHA-1 Hash h1 is computed (20 Bytes)
  • h1 is modified and a new Hash h2 is calculated
  • h1 is again modified and h3 is calculated
  • the 3DES key is made of h2 and the first 4 bytes of h3
  • The password is encrypted using 3DES in CBC Mode. The IV consists of the first 8 bytes from h1.
  • The algorithm computes a last hash h4 from the encrypted password
  • The key “enc_UserPassword” in our profile file now looks like this: h1|h4|encrypted password

Jan Newger has made a programs witch can crack the password automatically, you can download it here: newgre.net/passwordrevealer#download

Upgrade a Cisco Catalyst 2950 Switch

First you need to download a new firmware on Cisco homepage to that you need a cisco login.

Then you need a tftp server. Klever’s pumpkin is free.

Then we need to take backup of the cisco switch before upgrading.
Login to enable mode.
wr mem
copy running-config tftp://192.168.0.1/config
copy flash:vlan.dat tftp://192.168.0.1/vlan.dat
copy flash:c2950-i6q4l2-mz.121-22.EA6.bin tftp://192.168.0.1/c2950-i6q4l2-mz.121-22.EA6.bin

Then we need to delete old HTML files.
delete /r /f flash:html
Then we need to get the new software on the Cisco router.
archive tar /xtract tftp://192.168.0.1/c2950-i6q4l2-tar.121-22.EA10a.tar flash:

And then you just need to reload the cisco router.
reload