Github

All of my tools are now published on Github:

https://github.com/theevilbit

Tool: Cisco Type 7 Password Decrypter

I made a small tool to decrypt Cisco IOS type 7 passwords, it can also encrypt clear text passwords if required. 

You can find how the passwords are encrypted / decrypted in the following article from SANS:

http://pen-testing.sans.org/resources/papers/gcih/cisco-ios-type-7-password-vulnerability-100566

I made this script in order to practice, and I realized that Cisco passwords can be custom long, and none of the existing tools has a full XLAT table to make the decryption. I made very long (50+ characters) passwords, made from the same letter. I realized that after 51 characters the encryption is the same, meaning that the full XLAT table is 51 size long, and if the password is longer it will start from the beginning. Based on this, I got the full table:

xlat = [0x64, 0x73, 0x66, 0x64, 0x3b, 0x6b, 0x66, 0x6f, 0x41, 0x2c, 0x2e, 0x69, 0x79, 0x65, 0x77, 0x72, 0x6b, 0x6c, 0x64

, 0x4a, 0x4b, 0x44, 0x48, 0x53, 0x55, 0x42, 0x73, 0x67, 0x76, 0x63, 0x61, 0x36, 0x39, 0x38, 0x33, 0x34, 0x6e, 0x63,

0x78, 0x76, 0x39, 0x38, 0x37, 0x33, 0x32, 0x35, 0x34, 0x6b, 0x3b, 0x66, 0x67, 0x38, 0x37]

The tool usage:

c:\>ciscot7.py --help

Usage: ciscot7.py [options]

Options:

  -h, --help            show this help message and exit

  -e, --encrypt         Encrypt password

  -d, --descrypt        Decrypt password. This is the default

  -p PASSWORD, --password=PASSWORD

                        Password to encrypt / decrypt

  -f FILE, --file=FILE  Cisco config file, only for decryption

If we specify a config file, it will look for all type 7 passwords in it.

License: MIT

You can download it from: https://sites.google.com/site/csabyblog/home/ciscot7

Tool - PickAx Password Finder

A PAX file is an encrypted image format, where Blowfish is used as the encryption algorithm. The tool, called Pick Ax, was developed by Smaller Animals, but it's not accessible anymore from the original website (http://www.smalleranimals.com/pickaxe.htm), but you can find it here:

http://windows.softwareweb.com/download-file/100581616/freeware/pick-ax-1.0/

The image header signature is: "PAX" (0x50 0x41 0x58) in the first 3 bytes.

I made a script, which can simply try passwords from a wordlist (or you can specify a single one) against a given image. It requires _ISource50.dll, which contains a function to check for the password, it's downloadable from Smaller Animal's website:

http://www.smalleranimals.com/isource.htm

http://www.smalleranimals.com/zips/ImgSource5/isource50.zip

Using the tool is really simple:

Usage: pickaxpwfinder.py [options]

Options:
  -h, --help            show this help message and exit
  -p PASSWORD, --password=PASSWORD
                        Password to try
  -d DICTIONARY, --dictionary=DICTIONARY
                        Specify dictionary (wordlist)
  -f FILE, --file=FILE  Chose PAX file to crack

I also made an encrypted PAX image to play with, the password is "password".

It can be downloaded from my site:
https://sites.google.com/site/csabyblog/home/pickaxpwfinder

Tool: Total Commander FTP Password Recovery

I made a simple Python script, which can recover Total Commander stored FTP passwords.

The usage of the tool is very simple:

Usage: tcpwrecovery.py [options]

Options:
  -h, --help            show this help message and exit
  -c, --common          Search wcx_ftp.ini in common places
  -f FILE, --file=FILE  File to decrypt
  -p PASSWORD, --password=PASSWORD
                        Password to decrypt

It can search in some common places for the INI file, you can explicitly specify the location or you can simply supply the encrypted password. Sample output:

c:\tcpwrecovery>tcpwrecovery.py -c
-> Trying: C:\Users\user1\AppData\Roaming\GHISLER\wcx_ftp.ini
-> Found: C:\Users\user1\AppData\Roaming\GHISLER\wcx_ftp.ini
-> Decrypting: C:\Users\user1\AppData\Roaming\GHISLER\wcx_ftp.ini

[connections]
1=example.com
default=example.com
[example.com]
host=example.com
username=fakeusername
password=fakepassword
pasvmode=0
MLSD=-1
[default]
pasvmode=0

-> Trying: C:\Windows\wcx_ftp.ini
-> Not found: C:\Windows\wcx_ftp.ini

-> Trying: wcx_ftp.ini
-> Not found: wcx_ftp.ini

License: MIT

Downloadable from my site: https://sites.google.com/site/csabyblog/home/tcpwrecovery

Tool - TrueCrypt Search and Decrypt (tcsandd)

I developed this python script / tool for the 2013 DC3 Forensic Challenge. It will search for TC encrypted files in a folder or drive, and then will try to decrypt them.

I used some of the source codes from the following resources:

https://code.google.com/p/tcdiscover/

http://blog.bjrn.se/2008/01/truecrypt-explained.html

http://blog.bjrn.se/2008/02/truecrypt-explained-truecrypt-5-update.html

The codes above were rewritten to support TrueCrypt version 7, keyfile support was added.

The tool is very fast in searching TC volumes. The search logic is the following:

a. The suspect file size modulo 512 must equal zero.

b. The suspect file size is at least 256kB in size (this is the size of the headers + backup headers)

c. The suspect file must not contain a common file header.

d. The suspect file has entropy more then 7.6.

The search is actually looking for encrypted files, as it’s impossible to tell if a file is a TC volume until the correct password is supplied. Thus it can be used to look for other encrypted files like FreeOTFE.

Based on these rules, the search will find any possible encrypted file, not only TC. Proving that a file is actually a TC volume is impossible without decryption. If running it on the entire file system, it will find about 300 files, which are not real TC volumes at all, which is a very good false positive rate, considering that there are more than 200.000 files on a normal computer. (This is only if we have the provided foremost configuration file set, to filter out known headers). An example Foremost header configuration file provided with the source code.

The password tries are very slow compared to other tools like OTFBrutus (http://www.tateu.net/software/dl.php?f=OTFBrutusGUI), and the reason is that the hash and encryptions implemented in python are not so optimal. If we have only a couple of passwords to try, then the tool is good, but if not it will run for long time. The tool can decrypt an entire TC volume (hidden as well) once the password is found.

Available at my site: https://sites.google.com/site/csabyblog/

Tool - extractmd5

I made a small script a while back, which will extract MD5 strings from a given file, and print them out.

It's downloadable from my new site: https://sites.google.com/site/csabyblog/