#!/usr/bin/perl
####################################################
#
#   (c) citrin, 2003.
#   Decrypts cisco "encrypted" passwords
#   like username test password 7 071B245F5A 
#
####################################################

use strict;

my $usage = "Usage $0 hiden_password\n";
my $pad = "dsfd;kfoA,.iyewrkldJKDHSUB";

die $usage if $#ARGV != 0;

my $pass = shift;

$pass =~ /^(\d{2})(.*)$/;

my $offset = $1;
my $h_pass = $2;

$h_pass =~ s/(\w\w)/$1:/ig;
my $s_pass;

foreach my $hex (split /:/, $h_pass){
        $s_pass .= chr(hex($hex));
}
my $pass = $s_pass ^ substr($pad, $offset);
$pass = substr $pass, 0, length($s_pass);
print "$pass\n";


# this script based on shell-script ciscocrack.pl
# from site http://hack.com.ru
# which don't work, bat have good comments:
# When "service password-encryption" is configured into a cisco router and
# the configuration subsequently viewed, the passwords are no longer printed
# as plaintext but as strings of randomish-looking garbage.  Analysis of
# several samples reveals the scrambling algorithm to be trivially weak.

# Dr. Delete derived and published an analysis and decryption program some
# time ago, but since that didn't seem to be generally available at the time
# I went looking for it, here is an independent explanation.  This was worked
# out on PAPER over a plate of nachos in a hotel bar in downtown LA, but
# still illustrates where a general-purpose "xor" handler can be useful for
# quickly cracking lame "proprietary" algorithms of this genre.

# Passwords can be up to eleven mixed-case characters.  In the "encrypted"
# representation, the first two bytes of the long string are a random decimal
# offset between 0 and 15 into a magic block of characters, and the remaining
# bytes are ascii-hex representations of the password bytes xored against
# the character-block bytes from the given offset on down.  The character
# block is "dsfd;kfoA,.iyewrkldJKDHSUB", which is enough for a maximum-length
# password at the maximum offset.

# Another character block consisting of "sgvca69834ncxv9873254k;fg87" is
# located after the first one in the IOS image, which may be relevant to
# something else and is simply mentioned here for posterity.  It is also
# interesting to note that the strings "%02d" and "%02x" occur immediately
# afterward, which in light of the above is another clue.
