Kenneth Qvistgaard Dalbjerg, IT Konsulent i århus
Citrix Certified

Decrypt Cisco VPN group password

August 27th, 2008 Posted in Cisco, Computer

I have a customer how has broken his Cisco VPN Client profiles. But the group password encrypted was still fine.

So I found out that it was pretty easy to crack this encryption.

The algorithm
The algorithm which is used to encrypt a given user/group password is shown below (for further details just consult the source code):

  • The current date as a string is retrieved (e.g. Mon Sep 19 20:00:00 2005)
  • Then a SHA-1 Hash h1 is computed (20 Bytes)
  • h1 is modified and a new Hash h2 is calculated
  • h1 is again modified and h3 is calculated
  • the 3DES key is made of h2 and the first 4 bytes of h3
  • The password is encrypted using 3DES in CBC Mode. The IV consists of the first 8 bytes from h1.
  • The algorithm computes a last hash h4 from the encrypted password
  • The key “enc_UserPassword” in our profile file now looks like this: h1|h4|encrypted password

Jan Newger has made a programs witch can crack the password automatically, you can download it here: newgre.net/passwordrevealer#download

Share and Enjoy:
  • Print
  • Digg
  • StumbleUpon
  • del.icio.us
  • Facebook
  • Twitter
  • Google Bookmarks
  • PDF
  • email
  • RSS
If you like this content, please support me and press the google adsense in the top of this post, thank you



  1. 1 Trackback(s)

  2. May 10, 2009: User links about "decrypt" on iLinkShare

Post a Comment