cisco7crack
Cisco type 7 is reversible obfuscation. cisco7crack decodes it without a wordlist. A type 5 enable secret is a different format: MD5-crypt needs candidate-password testing. The report uses both approaches.
Identify the stored type
username labuser password 7 <TYPE7_HEX>
enable secret 5 <MD5CRYPT_RECORD>These are placeholders, not sample hashes. Review a copy of the configuration and preserve wrapped values as a single uninterrupted record.
Decode one type 7 value
cisco7crack -h
cisco7crack '<TYPE7_HEX>'The positional value is only the hexadecimal string, without password 7. Malformed input and line wrapping can produce failure or nonsense. Do not send type 5 records to this tool.
Test a type 5 value separately
Save the complete $1$... record to enable-secret.hash:
john --format=md5crypt --wordlist=lab-candidates.txt enable-secret.hash
john --format=md5crypt --show enable-secret.hashSuccess: a decoded or recovered value is confirmed against its original configuration role. Any reuse on another service is a separate finding. Replace type 7 protection and weak secrets with supported strong password storage, limit configuration access, and rotate exposed values.
Classify configuration lines before choosing a tool
| Storage marker | Typical meaning | First action |
|---|---|---|
password 0 | Plaintext | Treat the visible value as disclosed |
password 7 | Reversible Cisco obfuscation | Decode the full stored string |
secret 5 / $1$ | MD5-crypt | Test candidates with the matching format |
secret 8 | PBKDF2-based storage | Confirm a type-8-aware cracker format |
secret 9 | scrypt-based storage | Confirm a type-9-aware cracker format |
Find candidate lines in a copied configuration:
rg -n '(^username |password [0789] |secret [589] |enable (password|secret))' router-config.txtKeep the command context: a line-console password, VTY login password, local username and enable secret can authorise different actions. A RADIUS/TACACS configuration can change which value a real login uses.
Use a local round-trip fixture
# Encode a fictional password, then paste the returned value into the decoder
cisco7crack -q -c 'LabOnlyPassword!'
cisco7crack -q -d '<TYPE7_VALUE_FROM_PREVIOUS_COMMAND>'The second result should be the exact fictional password. This checks your tool invocation without contacting a device. The initial two characters encode the seed/index; do not strip them. Keep the remaining characters intact and remove only display wrapping introduced during copying.
Keep type 5 shell quoting intact
# Placeholder only: replace with the complete original $1$ record
printf '%s\n' '$1$<SALT>$<DIGEST>' > enable-secret.hash
john --format=md5crypt --wordlist=lab-candidates.txt enable-secret.hash
john --format=md5crypt --show enable-secret.hashSingle quotes preserve $ characters. An unquoted hash can be silently changed by variable expansion before John reads it. Neither type 8 nor type 9 is converted to type 5 by changing the configuration marker.
Diagnose and validate
| Result | Interpretation |
|---|---|
| Type 7 prints plausible text | Decoding worked; associate it with the original line |
| Type 7 prints nonsense | Check seed, truncation, record type and copied characters |
| Type 5 loads but exhausts candidates | No tested candidate matched |
| Login accepts the value | Validate which AAA identity/role was selected |
| Enable mode accepts another value | Separate privileged-mode access from initial login |
Use one agreed authentication check after identifying the role; decoding itself does not require a device login. Report configuration disclosure, weak storage and demonstrated credential reuse separately. For type 8/9 modes consult hashcat’s format examples.
Related learning
How attacks work. Examples use fictional lab values; replace placeholders only with values from the system you are testing.