So beyond the penetration test, we should perform security audits on the network devices to be sure
whether they are configured according to security criteria.
Typically, these audits will include password creation methods.
Identity management mechanism.
Access control lists.
SNP security.
And switch port security.
In Cisco routers.
There are two main methods to create passwords for users and services the password and the secret methods.
So let's see these methods and each of their features on the router.
So here we are in three and we're back on our network.
Right click the router and select console to reach the router unless it's already open.
If you have a console and you select the console option from the right click menu, it opens another
console.
Configure T to enter terminal configuration mode.
Let's create a new user.
Username.
I'll name it as Cisco one and I'll put a question mark to see the options to create a private authentication
keyword.
We have two options.
The first one is password and the second one is secret.
So I'll choose password for this example.
And lastly, the password we choose.
Can I identify the privilege here?
To understand this, just put a few letters of the keyword p r i right here and press tab.
So if it's completed, that means the word is allowed here.
If it wasn't completed, I'll just need to identify privilege as a separate command.
So just delete pre and hit enter.
So now we created the user Cisco one with the password.
One, two, three, four, five.
To identify privilege as we've seen before, just type username.
Cisco one.
Privilege one five.
Type exit and hit enter to exit the config mode.
And look at that, you'll see that we have an information message which says router has been configured.
Hmm.
Okay, now let's go to Cali and try to gather the router configuration as a pen tester or ethical hacker.
Open a terminal screen and run MSF console.
So we've already seen these before, so I'll just keep it fast.
Search for Cisco config keywords.
Use the auxiliary module.
Show the options and now set the options community.
Our host as the target router.
Let me ping the router.
Okay.
Output directory.
To save the result, I'll choose to save it to the desktop.
Our port is okay and the other options are good and their default.
Now we can run the module.
Oh, wait, the option is our hosts, not our host.
I said the our hosts option.
So let me run the module once again.
Okay, so that'll do for now.
The execution of the module completed and the output file, which is the config of our router has been
created.
Double click to open it.
And we have here the configuration of the router.
So scroll down a bit and here's a user we created just a couple of minutes ago, Cisco one.
Now, as we already know, the password is stored as clear text in this method so we can see the password
clearly.
Now, let's go one step further, shall we?
I'll go back to the router console and go into the configure terminal mode once again.
Type in service and put a question mark to see the service options.
There is an option here.
Password encryption to encrypt the system passwords.
So let's use it.
Exit from the configuration mode to let it rebuild the configuration.
Now we'll activate the password encryption.
So let's go on back to Cali and grab the router configuration again.
We already know how to run the auxiliary module, so just type run to run it.
The output file is created.
Double click to open it.
Scroll down a bit and here are the users.
As you can see, the password is stored encrypted now.
Excellent.
So does that mean it's okay now?
No, absolutely not.
Because the algorithm used to encrypt the passwords is very weak, which only takes a few seconds to
crack.
So now I'll copy the encrypted password.
Open a web browser.
Google Cisco password paste the hash and search.
I'll just click on the first link which says Cisco Password cracker.
Now be careful where you visit.
While studying hacking, you might just go face to face with some harmful websites and I want to strongly
caution you against that.
So I'll paste the password hash here and press crack Password.
Oh, man.
It took less than a second to crack it.
So what should we do to protect the passwords?
Now we'll go another step further.
I am back in the console of the router again.
Enter the configure terminal mode.
Now I'll create another user and let me use the secret method now.
Type in username.
Let the username be Cisco to secret and the password.
Press enter.
So identify the privilege username Cisco to privilege one five.
Exit the configuration mode and the config is saved.
Now let's go back to Cali and run the auxiliary module once again.
So I'll delete the previous output file first.
Okay.
The output file is created.
Double click to open it and scroll down a little.
The new user is here.
Cisco, too.
And as you can see, the password is now stored as a Linux like hash value.
Do you remember Linux hashes inside the shadow file?
They are the fields separated by the dollar sign.
The first field is the type of the hash algorithm.
The second part is the salt and the rest is the hash value.
Now we can say it's more secure.