Although you should be using MD5 or SHA256 for password security, Type 7 passwords are still in use and so I thought this would be a fun learning exercise.

The ‘service password-encryption‘ or Type 7 password is based on a known proprietary weak encryption algorithm using XOR and can be recognized in the configuration file as,

password 7 030752180500

Note: Type 5 uses MD5 and looks similar to this,

enable secret 5 $1$OB1J$tNsFgEZ4kD1qituaAeYfa0

There are plenty of scripts or websites that can crack Type 7 passwords in less than a second, including one on Cisco’s website. This example will show how this can be done with just pen and paper.

First, an overview of the XOR operation and encryption is needed. The XOR operator returns a 1 when the value of either the first bit or the second bit is a 1 and returns a 0 when neither or both of the bits is 1. Notice the chart below,

First Bit	Second Bit	Result
0	0	0
0	1	1
1	0	1
1	1	0

Converting plaintext to ciphertext using XOR : Starting with the plaintext, “Go“, convert the ASCII representation into binary format.  G = 01000111   and   o = 01101111.

To convert this into ciphertext we will XOR with a key. For example, key = A = 01000001.

Plain Text : G	Key : A	Cipher Text
0	0	0
1	1	0
0	0	0
0	0	0
0	0	0
1	0	1
1	0	1
1	1	0

Plain Text : o	Key : A	Cipher Text
0	0	0
1	1	0
1	0	1
0	0	0
1	0	1
1	0	1
1	0	1
1	1	0

The Ciphertext is now represented by, 00000110 00101110, or in hex 06 2E. Decrypting the Ciphertext is just reversing the process using the same key. Work the problem yourself to prove you can get the original Plaintext.

In our example, we will try to decrypt the following cisco password,

password 7 030752180500

The first two bytes, 03 , are a randomly generated index into the known cisco key. The remaining bytes in ascii-hex represent the encrypted password. Spacing out the string, 07 52 18 05 00 , you can see the password is 5 characters long. Remember, each character consists of 8 bits. You must XOR each of these with the key in order to get the plaintext.

The key is derived from the following “Magic block” shown in hexadecimal,

0x64, 0x73, 0x66, 0x64, 0x3b, 0x6b, 0x66, 0x6f,
0x41, 0x2c, 0x2e, 0x69, 0x79, 0x65, 0x77, 0x72,
0x6b, 0x6c, 0x64, 0x4a, 0x4b, 0x44

Each one is numbered starting with zero, so the index 03 would be the forth number in the list or 0x64. The index will be incremented by 1 each time you XOR the key against the ciphertext.

After converting the hex numbers into binary, the first computation would be,

Cipher Text : 0x07	Key : 0x64	Plain Text
0	0	0
0	1	1
0	1	1
0	0	0
0	0	0
1	1	0
1	0	1
1	0	1

The result of the Plaintext 01100011 in ascii would be the letter ‘c‘.  Incrementing the index to the next key 0x3b and XOR’ing with the next Ciphertext 52 yields,

Cipher Text : 0x52	Key : 0x3b	Plain Text
0	0	0
1	0	1
0	1	1
1	1	0
0	1	1
0	0	0
1	1	0
0	1	1

The result of the Plaintext 01101001 in ascii would be the letter ‘i‘. Continuing the process and incrementing the index and XOR’ing the remaining Ciphertext reveals,

CipherText : 0x18 = 00011000     0x05 = 00000101     0x00 = 00000000
 Key       : 0x6b = 01101011     0x66 = 01100110     0x6f = 01101111
 PlainText          01110011            01100011            01101111
 Ascii                's'                 'c'                  'o'

The final results show the password string 030752180500  equals the word ‘cisco‘.