Re: [PEN-TEST] Router Password Recovery

[Robert van der Meulen <rvdm () CISTRON NL>]

Hi,

Quoting Randy Williams (randyw () SHORE NET):
> Be careful about what's called "encrypted" here. Cisco's normal encryption
> (referred to as "Cisco 7", for it's ridiculous 7-bit hash) is easily
> cracked. Using an MD5-based hash (referred to as "enable secret"
> passwords), the encryption is uncrackable. As mentioned before, you'll
> have to reset the password.
Be careful with using terms like 'uncrackable'.
MD5-based hashes are currently mostly uncrackable in a
mathematically-infeasable kind of way, but are very much not so when using
attacks like dictionary-based ones.
I have successfully used dictionary attacks against md5 hashes in the past,
and probably will in the future.

To take this even further, i tend to substitute terms like 'uncrackable' ,
'unbreakable', and 'impossible to decode without the key' for terms like
'weak' or the like in descriptions of (often proprietary)
crypto-implementations from commercial vendors, and it doesn't seem off in
lots of the cases.

Greets,
        Robert
--
                                Linux Generation