Password Recovery on a Cisco Router

In this post I'll demonstrate how to perform password recovery on a Cisco router, and I'll also show you how to prevent password recovery.

Password recovery might be necessary for legtimate needs or it could be used by an attacker for nefarious purposes such as to gain access to router or switch configurations. Physical access is required for password recovery so if your routers (or switches) are in an accessible area and cannot be physically secured you may want to use the command listed below for preventing password recovery (if your router supports it that is).



Password Recovery

The process is quite simple.

• Enter ROMMON mode and change the configuration register to bypass the startup-configuration (0x2142) & restart the router.
  
• Log into the router which now has no configuration and copy the startup-config to running-config.
• Change the enable password, any user passwords or anything else that needs changing.
• Set the configuration register to boot back from the startup-config (0x2102).
• Save the running-config back to startup-config and reload.
• Access the router with your updated credentials.

So here's how this sort of looks on the router. I've cut some of the router output to save on text but it's pretty easy to follow.

To start with I connect up to the console port and reboot the router. During the very first part of boot up I press Ctrl+Break. This brings me to ROM monitor mode.


System Bootstrap, Version 12.2(8r)YN, RELEASE SOFTWARE (fc1)
TAC Support: http://www.cisco.com/tac
Copyright (c) 2002 by cisco Systems, Inc.
C800/SOHO series (Board ID: 29-129) platform with 49152 Kbytes of main memory

rommon 1 > confreg 0x2142
You must reset or power cycle for new config to take effect
rommon 2 > reset

Cisco C831 (MPC857DSL) processor (revision 0x300) with 44237K/4915K bytes of memory.
Processor board ID AMB07430HLJ (3718955443), with hardware revision 0000
Chassis serial number AMB07430HLJ
CPU rev number 7
3 Ethernet interfaces
4 FastEthernet interfaces
128K bytes of NVRAM.
16384K bytes of processor board System flash (Read/Write)
2048K bytes of processor board Web flash (Read/Write)

--- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]: no

Press RETURN to get started!

Router>enable
Router#copy startup-config running-config
Destination filename [running-config]?

1477 bytes copied in 2.252 secs (656 bytes/sec)

R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#username syn password letmein
R1(config)#enable secret letmein
R1(config)#config-register 0x2102
R1(config)#exit
R1#copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]
R1#reload
Proceed with reload? [confirm]

User Access Verification
Username: syn
Password:
R1>enable
Password:
R1#


So we can see that I was able to log in and access privileged mode with my new credentials.


Password Recovery Prevention

Okay, so how do we prevent this password recovery business? Before using this method you should be warned (and IOS will warn you!) that if you forget the password you cannot recovery the password in any way and you will have to go to Cisco with your tail between your legs! So only use this if absolutely necessary and use with caution.

R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#no service password-recovery
R1(config)#exit


What IOS is basically doing after setting this option is enabling ROMMON security which prevents you going into ROMMON mode and telling the router to bypass the Startup-config.

ROMMON security can be turned off from with IOS by issuing the following:

R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#service password-recovery
R(config)#exit



Useful Links
Cisco Password Recovery
Cisco ROMMON Security

Password Auditing with Fgdump, John the Ripper & PowerShell

As a break from my Cisco studying I thought I'd post how I perform a password audit in a Windows 2003 environment using freely available tools and a PowerShell script.


fgdump

I dump the password hashes from AD using fgdump and the command below. Password history is also dumped out. Checking out users password history can be very useful at predicting future password choice as it will reveal patterns in password selection.

fgdump.exe -h Server01 -u home\administrator -p MySuperPassword -T 5

In the command above -h is the host I'm grabbing the passwords from. The -u and -p are valid username and password. -T 5 is running 5 threads to speed things up a bit.

The passwords are dumped out to Server01.pwdump in the same directory as where fgdump is located. From there I open the PWDump file with notepad and remove all the computer accounts from the bottom of the file so I am just left with usernames and password hashes.



John The Ripper

Now I use JTR to crack the Lan Manager hashes. I could use bruteforce or dictionary attacks againast the hashes but in the command below I'm just going to use bruteforce. All LM hashes cracked will display in uppercase, but the actual passwords will like be of mixed case depending on the security policy. Passwords over 14 characters long will display as "No Password" as these are stored as NTLM Hashes.

john --incremental=lanman --session=September Server01.pwdump

Pressing the spacebar whilst JTR is cracking will give you an update on the progress. If I need to abort the session (Ctrl-C) I can restore it later using:

john --restore=September

I can view the cracked passwords and output them to a file using:

john --show Server01.pwdump >Server01-Sept-Cracked.txt

The above command will output a list of all the accounts including those not cracked (password will be ???????). If I just wanted the passwords I would just pipe Johns output to the find command.

john --show Server01.pwdump >Server01-Sept-Cracked.txt | find /i /v "?????" >Server01-Sept-CrackedOnly.txt



PowerShell

Ok. So I have my cracked password file and I'm good to go. I've created a script that I run which prompts me for my cracked password file and gives me the following options:

• Find a users password
• Find a users password with history
• View top 20 popular passwords
• Search for occurrences of a particular password
• Password count (not including history)

Password-Audit.ps1

#This Section Imports Passwords from JTR file
Cls
"`n"
$result = New-Object System.Collections.ArrayList;
get-content (read-host "Enter path to JTR export file. Large files may take a few minutes to import") |
Foreach-object {
$arr = $_.Split("/:");
$temp = ('' | Select-Object Name,Password);
$temp.Name=$arr[0];
$temp.Password=$arr[1];
$result.Add($temp) | Out-Null
}

#This is the Menu Section

Function Menu {
"`n"
Write-Host "Press 1 to find a users password" -ForegroundColor Yellow
Write-Host "Press 2 to see a users password with history" -ForegroundColor Yellow
Write-Host "Press 3 to see top 20 popular passwords. This may take a few minutes" -ForegroundColor Yellow
Write-Host "Press 4 to search for occurrances of a particular password" -ForegroundColor Yellow
Write-Host "Press 5 for Password count (not including history)" -ForegroundColor Yellow
Write-Host "Press any other key to quit" -ForegroundColor Yellow
"`n"

$Number = Read-Host "Select an Option"

switch ($Number) {
1 {
Write-Host "Users Password" -ForegroundColor Red
$Name = read-host "UserName?"
$Result | where { $_.Name -match "$Name" }| where { $_.Name -notmatch "_history_" }
Menu
}

2 {
Write-Host "Users Password with history" -ForegroundColor Red
$HistoryName = read-host "UserName?"
$Result | where { $_.Name -match "$HistoryName" }
Menu
}

3 {
Write-Host "Top 20 Passwords" -ForegroundColor Red
$result | group password | sort count -Descending | select Count,Name -First 20
Menu
}

4 {
Write-Host "Weak Passwords" -ForegroundColor Red
$Password = read-host "Password?"
$Result | where { $_.Password -match "$Password" }
Menu
}

5 {
Write-Host "Total Passwords (Not including History)" -ForegroundColor Red
($Result | where { $_.Name -notmatch "_history_" }).count
Menu
}

default {
"You pressed something else. Goodbye"
}
}}
#Runs the menu
Menu


From here I can educate particular users regarding password choice or tailor user education to focus on problem areas.


I may well extend the script to look for other useful information when I have more time. The only thing I don't like is the output format if I choose option 3 (top 20 passwords) first.

Password Auditing with Fgdump, John the Ripper & PowerShell

As a break from my Cisco studying I thought I'd post how I perform a password audit in a Windows 2003 environment using freely available tools and a PowerShell script.


fgdump

I dump the password hashes from AD using fgdump and the command below. Password history is also dumped out. Checking out users password history can be very useful at predicting future password choice as it will reveal patterns in password selection.

fgdump.exe -h Server01 -u home\administrator -p MySuperPassword -T 5

In the command above -h is the host I'm grabbing the passwords from. The -u and -p are valid username and password. -T 5 is running 5 threads to speed things up a bit.

The passwords are dumped out to Server01.pwdump in the same directory as where fgdump is located. From there I open the PWDump file with notepad and remove all the computer accounts from the bottom of the file so I am just left with usernames and password hashes.



John The Ripper

Now I use JTR to crack the Lan Manager hashes. I could use bruteforce or dictionary attacks againast the hashes but in the command below I'm just going to use bruteforce. All LM hashes cracked will display in uppercase, but the actual passwords will like be of mixed case depending on the security policy. Passwords over 14 characters long will display as "No Password" as these are stored as NTLM Hashes.

john --incremental=lanman --session=September Server01.pwdump

Pressing the spacebar whilst JTR is cracking will give you an update on the progress. If I need to abort the session (Ctrl-C) I can restore it later using:

john --restore=September

I can view the cracked passwords and output them to a file using:

john --show Server01.pwdump >Server01-Sept-Cracked.txt

The above command will output a list of all the accounts including those not cracked (password will be ???????). If I just wanted the passwords I would just pipe Johns output to the find command.

john --show Server01.pwdump >Server01-Sept-Cracked.txt | find /i /v "?????" >Server01-Sept-CrackedOnly.txt



PowerShell

Ok. So I have my cracked password file and I'm good to go. I've created a script that I run which prompts me for my cracked password file and gives me the following options:

• Find a users password
• Find a users password with history
• View top 20 popular passwords
• Search for occurrences of a particular password
• Password count (not including history)

Password-Audit.ps1

#This Section Imports Passwords from JTR file
Cls
"`n"
$result = New-Object System.Collections.ArrayList;
get-content (read-host "Enter path to JTR export file. Large files may take a few minutes to import") |
Foreach-object {
$arr = $_.Split("/:");
$temp = ('' | Select-Object Name,Password);
$temp.Name=$arr[0];
$temp.Password=$arr[1];
$result.Add($temp) | Out-Null
}

#This is the Menu Section

Function Menu {
"`n"
Write-Host "Press 1 to find a users password" -ForegroundColor Yellow
Write-Host "Press 2 to see a users password with history" -ForegroundColor Yellow
Write-Host "Press 3 to see top 20 popular passwords. This may take a few minutes" -ForegroundColor Yellow
Write-Host "Press 4 to search for occurrances of a particular password" -ForegroundColor Yellow
Write-Host "Press 5 for Password count (not including history)" -ForegroundColor Yellow
Write-Host "Press any other key to quit" -ForegroundColor Yellow
"`n"

$Number = Read-Host "Select an Option"

switch ($Number) {
1 {
Write-Host "Users Password" -ForegroundColor Red
$Name = read-host "UserName?"
$Result | where { $_.Name -match "$Name" }| where { $_.Name -notmatch "_history_" }
Menu
}

2 {
Write-Host "Users Password with history" -ForegroundColor Red
$HistoryName = read-host "UserName?"
$Result | where { $_.Name -match "$HistoryName" }
Menu
}

3 {
Write-Host "Top 20 Passwords" -ForegroundColor Red
$result | group password | sort count -Descending | select Count,Name -First 20
Menu
}

4 {
Write-Host "Weak Passwords" -ForegroundColor Red
$Password = read-host "Password?"
$Result | where { $_.Password -match "$Password" }
Menu
}

5 {
Write-Host "Total Passwords (Not including History)" -ForegroundColor Red
($Result | where { $_.Name -notmatch "_history_" }).count
Menu
}

default {
"You pressed something else. Goodbye"
}
}}
#Runs the menu
Menu


From here I can educate particular users regarding password choice or tailor user education to focus on problem areas.


I may well extend the script to look for other useful information when I have more time. The only thing I don't like is the output format if I choose option 3 (top 20 passwords) first.

Why Physical Access Wins

I have just had a job explaining to friend that allowing physical access to a PC can reveal quite alot. Even if the PC is off. His problem was understanding that not only can an attacker access all of the information on that PC he can also extract the passwords of anyone who has logged onto it in the past.

So in the scenario where an administrator has logged onto a laptop in the workplace, then the employee takes the laptop home and an unauthorized person has access to the laptop it is relatively easy to reset the local admin password to provide the attacker with admin access to the laptop and from there he can load up some free software and pull off the cached credentials of anyone who has accessed the laptop, such as the administrator from the office.

Obviously it's not just attackers who could do this, a rogue employee could quite easily create a situation where someone with higher levels of access must log onto their PC and then take that laptop home and extract the password that was used.


Tools

• NTPasswd
• Cain & abel

So if the attacker was the employee, he can see who and when another user has logged on to their PC by looking at the Documents and Settings folder and seeing what profiles are created.


Next (this is assuming a standard employee doesn't have admin rights to the PC), after creating a boot disk for a utility such as NTpasswd the PC can be booted with it and the local administrator password can be changed.



After booting up and logging in as the local administrator, the attacker could load a tool such as Cain & Abel and extract the hashes of the cached credentials from that PC.





And then crack them using a number of different methods.



It really is that simple.

Another great tool (although not free) for extracting cached credentials is Elcomsoft's Proactive System Password Recovery tool.

Below is a screenshot of that tool in action on the same PC.





Prevention

Well it's really hard to prevent a rogue employee from doing things like this but things like not giving Domain Admin rights to IT support personnel, and only have an account with domain admin rights to perform domain admin tasks will help. Extra strong password on those accounts is also a really good option. For unauthorized people accessing those laptops, BIOS and boot passwords will make the job harder for them and of course full disk encryption would help loads.

Thats it for this short post.


Links
http://home.eunet.no/pnordahl/ntpasswd/
http://www.oxid.it/
http://www.elcomsoft.com/pspr.html

Password Attacks in Windows

Okay there are plenty of tools to launch password attacks within Windows but I like this one because it needs no tools other than those that are native to Windows.

The only difficult bit is getting the wordlist together. If anyone knows of a funky way to generate one using native windows tools and existing files on a PC I would love to hear from you. In lieu of a funky solution and without a wordlist that I have got to the box by other means I make my list by creating a file with popular passwords and hope for the best. Remember, if you are making the wordlist, tune it for the company or organisation you are pentesting against.

This attack is going to bruteforce a password using a FOR loop and a text file with some passwords in.


How it Works

Make sure you have a wordlist or create one with possible password in. The password file just needs to be a normal test file with a word on each line.



At the command prompt on one line type:

FOR /F "tokens=1*" %i in (passwords.txt) do net use \\192.168.1.1\IPC$ %i /u:Administrator

The password.txt file must be in the same directory that you run the command from.

Whats happening here is the command attempting to connect to the IPC$ share on 192.168.1.1 and is going through the file password.txt trying every word as a password for the Administrator account.

You don't have to specify the IPC$ share. If there is another share available you can use that.

Obviously this attack can be done on other accounts but remember that they may be subject to lockout after so many failed logins. The Administrator account does not get locked out.

If you find that the account lock out policy is not enforced then you can create a password file with usernames and password in (separated by a space), then throw the file at it using a FOR loop shown in my screenshot.



If you have found a successful pair the outcome will be a open session (net use) and the file out.txt will list the valid credentials.


Lessons learned for Admins

• Pick a good Administrator password that will not be in a dictionary. and enforce complex passwords for users.
• Make sure that account lock out policies are enforced.
• Educate users and helpdesk staff. If they notice that accounts are constantly locked out and the user is not too stupid then they might be your early warning system that something is wrong.
• Check logs. Account lockouts should be logged and you should be seeing this type of activity in you daily log monitoring routine.

Password Attacks

The purpose of this post is to demonstrate how an attacker may use free tools to bruteforce passwords and gain access to sensitive information.

The tools I use in this example are from BackTrack3.

Tools

• Backtrack
• NMap
• HydraGTK (using John's wordlist)
• Medusa
• snmpcheck.pl
  

The Attack

1. If I don't already have a list of targets and services I would use nmap to scan for services and systems that I know I can perform an attack against.

nmap 192.168.2.2 -T 4 -sV -P0 -n



Remember, In an attack scenario it is can be a good idea to scan only those services that you have working exploits for or that you know your tools can run password lists against.

2. Following a rather unstealthy scan I see that my target has a FTP Server and some NETBIOS ports open (139 & 445). These service are perfect for my tools, I know that I can peform a bruteforce attack on either one.

Listed below are all the protocols and services that Hydra can perform attacks against:

TELNET, FTP, HTTP-GET, HTTP-HEAD, HTTPS-GET, HTTP-HEAD, HTTP-PROXY,
HTTP-PROXY-NTLM, HTTP-FORM-GET HTTP-FORM-POST, HTTPS-FORM-GET,
HTTPS-FORM-POSTLDAP2, LADP3, SMB, SMBNT, MS-SQL, MYSQL, POSTGRES,
POP3-NTLM, IMAP, IMAP-NTLM, NNTP, PCNFS, ICQ, SAP/R3, Cisco auth,
Cisco enable, SMTP-AUTH, SMTP-AUTH-NTLM, SSH2, SNMP, CVS, Cisco AAA,
REXEC, SOCKS5, VNC, POP3 and VMware-Auth

Either using hydra (commandline) or HydraGTK (GUI) I enter a known or likely username or specify a list of valid or likely usernames if I have them (there is more on this in the following SNMP section).




3. Now I enter the IP or name of your target and I select a service that was available on the target when I performed my nmap scan. I have chosen ftp for this example.




4. Now I give hydra a wordlist. I have just given it johns wordlist here (on BackTrack3 in /usr/local/john-1.7.2/password.lst) For better results I would usually give hydra a bigger list. I have also chosen to try null passwords and try the username as the password.



5. The next tab gives me options for tuning Hydra. I can tell Hydra to stop checking after is has found a match, this may restrict the number of valid usernames and passwords found but it will be quieter. Proxy settings can also be set here.



6. Specific options can be set on the next tab.



7. Now I have all my settings configured I kick it off and await the joy.



Any results can be save to a file.


If I had wanted to perform the same attack from the commandline I would have used the following syntax:

hydra 192.168.2.2 -l administrator -P /usr/local/john-1.7.2/password.lst -t 36



Obviously this is slightly quicker but the GUI is fun and useful to become familiar with Hydra.

Below is another successful attack on the smb protocol (port 139)




SNMP

Supposing I don't have any username but I find that port 161 UDP is open? Well that usually means that SNMP is up. Hydra can then be used to bruteforce the SNMP community strings and if successful I can get to the entire config on the server including a complete list of users. Here's how.


The Attack

1. I configure hydra with no username and as a password i use "public" which is the default. If that fails I give hydra a password list to try.



2. Following a successful guess I use the SNMP string with another tool from BackTrack called snmpcheck.pl

./snmpcheck-1.6.pl -t 192.168.2.2 -c secret -l -v 2



This tool will now pull down all the info on my target and i can extract the user names into a file to feed back into Hydra as valid usernames




How To Protect Yourself

Having an account lockout policy is one protection available, but I often wonder if after several attacks someone would get pissed off with locked out accounts and remove the policy.

Also, SNMP should not use the default community strings and can be locked down so only certain devices talk to each other. SNMP traffic can also be encrypted.

Another weakness this tool exploits is weak passwords. If users have strong passwords they may still be cracked however, the attacker may need to get a little noisier and you may just see him in the logs. You are checking the logs aren't you?

Oh, and one last thing on passwords. Remember to change the default passwords on all devices.

Note: I will update this post with other useful tools as i find time.

Creating Custom Password Lists

This blog entry is on how to quickly create a custom wordlist to use with a password cracker. This is something I have been wanting to learn for a while but was unsure how to do it. I learned this technique from a video created by pur3h4t3. I link to his blog can be found at the bottom of this entry.

You may want to create a custom wordlist using a companies website. What the method I am demonstrating will do is take a website, synjunkie.blogspot.com in this example, and create a wordlist using all the words on that site. Hopefully these words may be relevant to my target.

I will cover how to use this list with a password cracker in a later blog entry.


Tools
All tools i use are on the backtrack3 CD.

• wget
• wyd.pl
• pw-inspector

Creating the Wordlist

1. First I create a directory that I am going to download a copy of the website into. After changing to that directory I quickly grab the site using wget.

wget - r http://synjunkie.blogspot.com



2. After grabbing the site I use wyd.pl to extract all the words from the site into a single file.

wyd.pl -n -o /root/sj/wordlist.txt /root/sj/synjunkie.blogspot.com/




3. I then cat the file that I have created out, piping it through sort and uniq, to put it in order and remove any duplicate words.

cat wordlist.txt | sort | uniq > wordlist2.txt



This then gives me a file called wordlist2.txt that is a bit smaller as the duplicates have been removed.

4. Next I use pw-inspector to go through the file and remove any words that do not meet the criteria.

cat wordlist2.txt | pw-inspector -m 1 -M 20 >customlist.txt

The criteria I have set here is words should be a minimum of 1 letter and a maximum of 20. If you know that your target hes a minimum password legnth of 8 characters you could remove all words with less than 8 characters using this tool.



6. The result is a file called customlist.txt that contains words that may be more relevant to a target.

cat customlist.txt





Links
http://pur3h4t3.blogspot.com/
http://www.remote-exploit.org/backtrack.html