c7decrypt 0.0.1

data/lib/c7decrypt.rb

@@ -0,0 +1,83 @@
+# A Ruby-based implementation of a Cisco Type-7 Password Decrypter
+#
+# Author: Jonathan Claudius (Twitter/GitHub: @claudijd)
+#
+# This code is based on Daren Matthew's cdecrypt.pl found here:
+#   http://mccltd.net/blog/?p=1034 ("Deobfuscating Cisco Type 7 Passwords")
+
+#Class Implementation
+class C7Decrypt
+
+  # Vigenere translation table (these are our key values for decryption)
+  VT_TABLE = [
+    0x64, 0x73, 0x66, 0x64, 0x3b, 0x6b, 0x66, 0x6f, 0x41, 0x2c, 0x2e,
+    0x69, 0x79, 0x65, 0x77, 0x72, 0x6b, 0x6c, 0x64, 0x4a, 0x4b, 0x44,
+    0x48, 0x53, 0x55, 0x42, 0x73, 0x67, 0x76, 0x63, 0x61, 0x36, 0x39,
+    0x38, 0x33, 0x34, 0x6e, 0x63, 0x78, 0x76, 0x39, 0x38, 0x37, 0x33,
+    0x32, 0x35, 0x34, 0x6b, 0x3b, 0x66, 0x67, 0x38, 0x37
+  ]
+
+  # Regexes for extracting hashes from configs
+  TYPE_7_REGEXES = [
+    /enable password 7 ([a-zA-Z0-9]+)/,
+    /username [a-zA-Z0-9]+ password 7 ([a-zA-Z0-9]+)/,
+    /password 7 ([a-zA-Z0-9]+)/
+  ]
+
+  # The Decryption Method for Cisco Type-7 Encrypted Strings
+  # @param [String] the Cisco Type-7 Encrypted String
+  # @return [String] the Decrypted String
+  def decrypt(pw)
+    r = ""
+    pw_bytes = pw.scan(/../)
+    vt_index = pw_bytes.first.hex - 1
+    pw_bytes.each_with_index do |byte,i|
+      r += (byte.hex^VT_TABLE[(i + vt_index) % 53]).chr  
+    end
+    return r.slice(1..-1).rstrip
+  end
+
+  # A helper method to decrypt an arracy of Cisco Type-7 Encrypted Strings
+  # @param [Array>String] an array of Cisco Type-7 Encrypted Strings
+  # @return [Array>String] an array of Decrypted Strings
+  def decrypt_array(pw_array)
+    pw_array.collect {|pw| decrypt(pw)}
+  end
+
+  # This method scans a raw config file for type 7 passwords and decrypts them
+  # @param [String] a string of the config file path that contains Cisco Type-7 Encrypted Strings
+  # @return [Array>String] an array of Decrypted Strings
+  def decrypt_config(file)
+    f = File.open(file, 'r').to_a
+    decrypt_array(f.collect {|line| type_7_matches(line)}.flatten)
+  end
+
+  # This method scans a config line for encrypted type-7 passwords and returns an array of results
+  # @param [String] a line with potential encrypted type-7 passwords
+  # @return [Array>String] an array of Cisco type-7 encrypted Strings
+  def type_7_matches(string)
+    TYPE_7_REGEXES.collect {|regex| string.scan(regex)}.flatten.uniq
+  end
+
+  # A short-hand version of the descrypt method
+  # @param [String] the Cisco Type-7 Encrypted String
+  # @return [String] the Decrypted String
+  def d(pw)
+    decrypt(pw)
+  end
+
+  # A short-hand version of the descrypt_array method
+  # @param [Array>String] an array of Cisco Type-7 Encrypted Strings
+  # @return [Array>String] an array of Decrypted Strings
+  def d_a(pw_array)
+    decrypt_array(pw_array)
+  end
+
+  # A short-hand version of the decrypt_config method
+  # @param [String] a string of the config file path that contains Cisco Type-7 Encrypted Strings
+  # @return [Array>String] an array of Decrypted Strings
+  def d_c(file)
+    decrypt_config(file)
+  end
+
+end

metadata

@@ -0,0 +1,65 @@
+--- !ruby/object:Gem::Specification 
+name: c7decrypt
+version: !ruby/object:Gem::Version 
+  hash: 29
+  prerelease: 
+  segments: 
+  - 0
+  - 0
+  - 1
+  version: 0.0.1
+platform: ruby
+authors: 
+- Jonathan Claudius
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2012-09-07 00:00:00 Z
+dependencies: []
+
+description: 
+email: claudijd@yahoo.com
+executables: []
+
+extensions: []
+
+extra_rdoc_files: []
+
+files: 
+- lib/c7decrypt.rb
+homepage: http://rubygems.org/gems/c7decrypt
+licenses: []
+
+post_install_message: 
+rdoc_options: []
+
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.8.10
+signing_key: 
+specification_version: 3
+summary: Ruby based Cisco Type 7 Password Decryptor
+test_files: []
+