Tools/ciscocrack.c

   1 /*
   2  * descambles cisco IOS type-7 passwords
   3  * found somewhere on the internet, slightly modified, anonymous@segfault.net
   4  *
   5  * gcc -Wall -o ciscocrack ciscocrack.c
   6  * ./ciscocrack 01178E05590909022A
   7  *
   8  */
   9
  10 #include <stdio.h>
  11 #include <ctype.h>
  12
  13 char xlat[] = {
  14         0x64, 0x73, 0x66, 0x64, 0x3b, 0x6b, 0x66, 0x6f,
  15         0x41, 0x2c, 0x2e, 0x69, 0x79, 0x65, 0x77, 0x72,
  16         0x6b, 0x6c, 0x64, 0x4a, 0x4b, 0x44, 0x48, 0x53,
  17         0x55, 0x42
  18 };
  19
  20
  21 int
  22 cdecrypt(char *enc_pw, char *dec_pw)
  23 {
  24         unsigned int seed, i, val = 0;
  25
  26         if(strlen(enc_pw) & 1)
  27                 return(-1);
  28
  29         seed = (enc_pw[0] - '0') * 10 + enc_pw[1] - '0';
  30
  31         if (seed > 15 || !isdigit(enc_pw[0]) || !isdigit(enc_pw[1]))
  32                 return(-1);
  33
  34         for (i = 2 ; i <= strlen(enc_pw); i++) {
  35                 if(i !=2 && !(i & 1)) {
  36                         dec_pw[i / 2 - 2] = val ^ xlat[seed++];
  37                         val = 0;
  38                 }
  39
  40                 val *= 16;
  41
  42                 if(isdigit(enc_pw[i] = toupper(enc_pw[i]))) {
  43                         val += enc_pw[i] - '0';
  44                         continue;
  45                 }
  46
  47                 if(enc_pw[i] >= 'A' && enc_pw[i] <= 'F') {
  48                         val += enc_pw[i] - 'A' + 10;
  49                         continue;
  50                 }
  51
  52                 if(strlen(enc_pw) != i)
  53                         return(-1);
  54         }
  55
  56         dec_pw[++i / 2] = 0;
  57
  58         return(0);
  59 }
  60
  61 void
  62 usage()
  63 {
  64         fprintf(stdout, "Usage: ciscocrack <encrypted password>\n");
  65 }
  66
  67 int
  68 main(int argc, char *argv[])
  69 {
  70     char passwd[65];
  71
  72     memset(passwd, 0, sizeof(passwd));
  73
  74     if(argc != 2)
  75     {
  76           usage();
  77           exit(1);
  78     }
  79
  80     if(cdecrypt(argv[1], passwd)) {
  81           fprintf(stderr, "Error.\n");
  82           exit(1);
  83     }
  84     printf("Passwd: %s\n", passwd);
  85
  86     return 0;
  87 }