0

I'm totally confused by this Cisco password format:

enable password level 15 encrypted 382fda4a4a26e6637edac0eb8b8ba4581087d32d

Overall string is 40 bytes long:

$ echo -n 382fda4a4a26e6637edac0eb8b8ba4581087d32d | wc -c
  40

Example of config with this password format can be seen e.g. here.

No special characters except for [a-z0-9]. It does not fall under any of Type X Cisco password taxonomy (Types 0,4,5,7,8,9). Hashcat does not include any available cracking mode for it.

What kind of voodoo is that? Is it secure? Should I be worried that original password string may be recovered?

P.S. There's suspicion that this is not hash, but encryption. This resource states that:

(use) password that is already encrypted from another configuration file of another device. This will allow you to configure the two switches with the same password.

In case if this is encryption, how new device can decrypt it then?

4
  • 1
    It's encrypted, not hashed in that format? – schroeder Oct 14 '20 at 19:52
  • Any hints what algorithm and where master key is stored? According to some information in web this format can be used to transform credentials across device configs. How other device knows master key in order to decrypt then? – dtrizna Oct 15 '20 at 6:50
  • 1
    That's a brand new question and not about security but about Cisco IOS. – schroeder Oct 15 '20 at 6:54
  • 1
    What version of Cisco IOS (or other OS) is this from? Can you add the output of show version to your question? – Jeff Wheeler Oct 15 '20 at 13:27
1

What purpose do you need the master key? This would be buried in the internal code somewhere besides. what your seeing a looks like a level of hashing with salts on the password.

The article your reference is quite old and also looks like its referencing a SG300 which is a different code train then the enterprise switches and are quirky.

If you dont already know...

  1. Don't use "password" its a level 7 hashing and can be decrypted online, and its being deprecated

https://www.ifm.net.nz/cookbooks/passwordcracker.html you can use this crack any level 7 password hash on Cisco switches its a known issues..

e.g.

enable secret "passphrase"

username myuser secret "password"

New contributor
onxx is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
2
  • Thanks, but this is not what I've asked. – dtrizna 2 days ago
  • To answer your question, Let me first ask why are you worried about people hacking your key, when they need that key to log into the switch in the first place? – onxx yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.