1

I'm totally confused by this Cisco password format:

enable password level 15 encrypted 382fda4a4a26e6637edac0eb8b8ba4581087d32d

Overall string is 40 bytes long:

$ echo -n 382fda4a4a26e6637edac0eb8b8ba4581087d32d | wc -c
  40

Example of config with this password format can be seen e.g. here.

No special characters except for [a-z0-9]. It does not fall under any of Type X Cisco password taxonomy (Types 0,4,5,7,8,9). Hashcat does not include any available cracking mode for it.

What kind of voodoo is that? Is it secure? Should I be worried that original password string may be recovered?

P.S. There's suspicion that this is not hash, but encryption. This resource states that:

(use) password that is already encrypted from another configuration file of another device. This will allow you to configure the two switches with the same password.

In case if this is encryption, how new device can decrypt it then?

Improve this question
4
  • 1
    It's encrypted, not hashed in that format?
    – schroeder
    Commented Oct 14, 2020 at 19:52
  • Any hints what algorithm and where master key is stored? According to some information in web this format can be used to transform credentials across device configs. How other device knows master key in order to decrypt then?
    – dtrizna
    Commented Oct 15, 2020 at 6:50
  • 1
    That's a brand new question and not about security but about Cisco IOS.
    – schroeder
    Commented Oct 15, 2020 at 6:54
  • 1
    What version of Cisco IOS (or other OS) is this from? Can you add the output of show version to your question?
    – Jeff Wheeler
    Commented Oct 15, 2020 at 13:27

1 Answer 1

Reset to default
1

What purpose do you need the master key? This would be buried in the internal code somewhere besides. what your seeing a looks like a level of hashing with salts on the password.

The article your reference is quite old and also looks like its referencing a SG300 which is a different code train then the enterprise switches and are quirky.

If you dont already know...

  1. Don't use "password" its a level 7 hashing and can be decrypted online, and its being deprecated

https://www.ifm.net.nz/cookbooks/passwordcracker.html you can use this crack any level 7 password hash on Cisco switches its a known issues..

e.g.

enable secret "passphrase"

username myuser secret "password"

Improve this answer
4
  • Thanks, but this is not what I've asked.
    – dtrizna
    Commented Apr 8, 2021 at 7:12
  • To answer your question, Let me first ask why are you worried about people hacking your key, when they need that key to log into the switch in the first place?
    – onxx
    Commented Apr 8, 2021 at 16:49
  • There are many other threat models rather than leak to logged on users since the pattern specified in question resides in the config, and config might live in backups, git, etc.
    – dtrizna
    Commented Apr 12, 2021 at 10:45
  • @dtrizna you shouldn't be uploading your configuration to any non-secure locations in the first place, which is poor config management. As network configuration should always be considered as sensitive due to the type information thats present in the configs.
    – onxx
    Commented Apr 13, 2021 at 0:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.