John,

one of my senior tech , was able to get the config form the router . he said that since there is an ftp enable on one of the router , he was able to get the config from there , then use

http://www.ifm.net.nz/cookbooks/passwordcracker.html

to crack the password

do you know what exactely was done ..

Thanks

As it explains in the URL, the type 7 enable password can be decrypted easily with a readily available password cracking utility. I guess it was fortunate for you that you were not using the enable secret password, since it cannot be decrypted in the same manner.

the queston is how he got the ftp server to get the config from the router. not how password is decrypted. I think everyone that is working w/ cisco knows that type 7 can be decrypted , Thanks for your input.

Ocporburst,

If I understand your question, you can have an ftp server enabled on some IOS versions. I don't have any versions on my network that support it, but it can be configured with "ftp-server enable." Then you share the top directory to share through ftp.

Here's some documentation:

http://www.cisco.com/en/US/docs/ios/11_3/feature/guide/ftpserve.html

I have to tell you that I would see this as a major security risk. It may have helped you in this instance, but should this router ever get compromised, the same thing that helped could wreak major havoc on your network. I would recommend disabling the ftp service.

HTH,

John

John

Thanks a lot for your explanation, there is a radius configured as welll as a firewall b4 you can acccess the network router. so we got that part covered "I think". as always .Thanks for taking the time to help out....

any one can help ???

I did find this link. I tried to follow the steps but no luck/

http://www.cisco.com/en/US/tech/tk648/tk362/technologies_configuration_example09186a0080094aa6.shtml#NetPro

can you help.

Thanks

Ocporbust,

You won't be able to write the snmp value unless you have RW enabled on the router. If you have the config file, look at your "snmp-server " line and see if you have an RO or RW after, or possibly different communities with RO and RW:

snmp-server public RO

snmp-server private RW

If you don't have one that has the RW after it, you won't be able to write your snmp string to change the password.

I thought the password has been changed, or at least figured out from the ftp transfer and decryption?

HTH,

John

John- here is what I have as far as snmp community..

snmp-server community homeboy RO 99

snmp-server community homenut RW 99

snmp-server ifindex dogfight

snmp-server enable traps tty

ocporbust,

The "99" at the end of this line is an acl. Do you know if this acl allows the host/subnet that you're coming from to write to the router? I can set a lab up and see if I can change a password if your acl clearly shows that you have access to write to it.

HTH,

John

yes I can write to the router and do config change if I want to. Hope this helps

Thanks

Hi,

wouldn't it be easier to udelete/repair your deleted password sheet file?

BR,

Milan

did not uderstand your question ?

I deleted the file from my pc . what is you question or suggestion ?