2 * descambles cisco IOS type-7 passwords
3 * found somewhere on the internet, slightly modified, anonymous@segfault.net
5 * gcc -Wall -o ciscocrack ciscocrack.c
6 * ./ciscocrack 01178E05590909022A
14 0x64, 0x73, 0x66, 0x64, 0x3b, 0x6b, 0x66, 0x6f,
15 0x41, 0x2c, 0x2e, 0x69, 0x79, 0x65, 0x77, 0x72,
16 0x6b, 0x6c, 0x64, 0x4a, 0x4b, 0x44, 0x48, 0x53,
22 cdecrypt(char *enc_pw, char *dec_pw)
24 unsigned int seed, i, val = 0;
26 if(strlen(enc_pw) & 1)
29 seed = (enc_pw[0] - '0') * 10 + enc_pw[1] - '0';
31 if (seed > 15 || !isdigit(enc_pw[0]) || !isdigit(enc_pw[1]))
34 for (i = 2 ; i <= strlen(enc_pw); i++) {
35 if(i !=2 && !(i & 1)) {
36 dec_pw[i / 2 - 2] = val ^ xlat[seed++];
42 if(isdigit(enc_pw[i] = toupper(enc_pw[i]))) {
43 val += enc_pw[i] - '0';
47 if(enc_pw[i] >= 'A' && enc_pw[i] <= 'F') {
48 val += enc_pw[i] - 'A' + 10;
52 if(strlen(enc_pw) != i)
64 fprintf(stdout, "Usage: ciscocrack <encrypted password>\n");
68 main(int argc, char *argv[])
72 memset(passwd, 0, sizeof(passwd));
80 if(cdecrypt(argv[1], passwd)) {
81 fprintf(stderr, "Error.\n");
84 printf("Passwd: %s\n", passwd);