Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

username ... secret 9 ... is not correct for C9300-48P IOS-XE 17.03.04 #4

Open
jifox opened this issue Nov 23, 2021 · 1 comment
Open

Comments

@jifox
Copy link

jifox commented Nov 23, 2021

When using this python script the switch will not accept the calculated hash

# Program output
[3]  Type 8 (PBKDF2-HMAC-SHA256)
[4]  Type 9 (Scrypt)
[5]  Exit

Your selection: 4

Enter a Plain Text Password to convert: TestText

Your Cisco Type 9 password hash is: $9$icj5vfNlTumwNB$64epo7fnBl03uRLMQT0Q5VWaOvHPipqZLFFsCbYdl4Y


# Switch output
TEST(config)# username test privilege 15 secret 9 $9$icj5vfNlTumwNB$64epo7fnBl03uRLMQT0Q5VWaOvHPipqZLFFsCbYdl4Y
ERROR: The secret you entered is not a valid encrypted secret.
To enter an UNENCRYPTED secret, do not specify type 9 encryption.
When you properly enter an UNENCRYPTED secret, it will be encrypted
@jifox
Copy link
Author

jifox commented Nov 23, 2021

I've tried to use the salt that the switch has stored as a constant and calculated the hash. The has value calculated is the same as the hash in cisco running config.

                    for _ in range(14):
                        salt_chars.append(random.choice(cisco_b64chars))
                    salt = "".join(salt_chars)
                    salt = "pPsCfoFx0krK.E"  # <------------

####################################################

[4]  Type 9 (Scrypt)
[5]  Exit

Your selection: 4

Enter a Plain Text Password to convert: TestText

Your Cisco Type 9 password hash is: $9$pPsCfoFx0krK.E$yMeHAVYfOMb4yLYg9CkQyKaXkDH01slV9KdvNx7Afg

####################################################

# Switch output from running config
TEST(config)# TEST(config)#do show run | i ....
username .... privilege 15 secret 9 $9$pPsCfoFx0krK.E$yMeHAVYfOMb4yLYg9CkQyKaXkDH01slV9KdvNx7Afg2

It seems that the salt is not a random value for IOS-XE 17.03.04

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant