So beyond the penetration test, we should perform security audits on the network devices to be sure
whether they are configured according to security criteria.
Typically, these audits will include password creation methods.
Identity management mechanism.
Access control list.
SNP security.
And switch port security.
In Cisco routers, there are two main methods to create passwords for users and services, the password
and the secret methods.
So let's see these methods and each of their features on the router.
So here we are in Jeunesse three and we're back on our network.
Right, click the router and select console to reach the router unless it's already open.
If you have a console and you select the console option from the right click menu, it opens another
console.
Configured T to enter terminal configuration mode, let's create a new user.
Username, I'll name it, is Cisco one, and I'll put a question mark to see the option to create a
private authentication keyword.
We have two options.
The first one is password and the second one is secret.
So I'll choose a password for this example.
And lastly, the password we choose.
Can I identify the privilege here to understand this, just put a few letters of the keyword PR I write
here and press tab, so if it's completed, that means the word is allowed here.
If it wasn't completed, I'll just need to identify privilege as a separate command.
So just delete prai and hit enter.
So now we created the user, Cisco, one with the password, one, two, three, four or five.
To identify privilege, as we've seen before, just type username.
Siska one.
Privilege one five.
Type exit and hit enter to exit the config mode.
And look at that, you'll see that we have an information message which says Rueter has been configured.
Hmm.
OK, now let's go to Collie and try to gather the router configuration as a pin tester or ethical hacker.
Open internal screen and run MSF console.
So we've already seen these before, so I'll just keep it fast.
Search for Cisco config keywords.
Use the auxiliary module.
So the options and now set the options community.
Our host as the target router.
Let me ping the router.
Output Directorate is, say, the result of juice.
Save it at the desktop.
Our report is OK and the other options are good and their default.
Now we can run the module.
Or where the option is our hosts, not our host, I said the are hosts option.
So let me run the module once again.
OK, so that'll do for now the execution of the module completed and the output file, which is the
config of our router, has been created, click to open it.
And we have here the configuration of the router, so scroll down a bit and here's a user we created
just a couple of minutes ago, Sasko one, as we already know, the password is stored, is clear text
in this method so we can see the password clearly.
Now, let's go one step further, shall we?
I'll go back to the router console and go into the configure terminal node once again.
Type in service and put a question mark to see the service options.
There is an option here, password encryption to encrypt the system passwords, so let's use it.
Exit from the configuration mode to let a rebuild the configuration now will activate the password encryption.
So let's go on back to Cali and grab the router configuration again.
We already know how to run the auxiliary module, so just type run to run it.
The output file is created double click to open it, scroll down a bit, then here are the users.
As you can see, the password is stored, encrypted now.
Excellent.
So does that mean it's OK now?
Mm hmm.
No, absolutely not, because the algorithm used to encrypt the passwords is very weak, which only
takes a few seconds to crack.
So now I'll copy the encrypted password.
Open a Web browser.
Google, Cisco, password paste, the hash and search.
I'll just click on the first language, says Cisco password cracker.
Now be careful where you visit while studying hacking, you might just go face to face with some harmful
websites.
And I want to strongly caution you against that.
So I'll paste the password hash here and press crack password.
Oh, man, it took less than a second to crack it.
So what should we do to protect the passwords?
Now, we'll go another step further, I am back in the console of the router again.
Enter the configure terminal mode.
Now I'll create another user and let me use the secret method now.
Type in username, let the user name be Cisco to secret and the password.
Presenter.
So identify the privilege username Cisco to privilege one five.
Exit the configuration mode and the configures say.
Now let's go back to Collie and run the auxiliary module once again, so I'll delete the previous output
file first.
OK.
The output file is created double click to open it and scroll down a little.
The new users here, Cisco, too, and as you can see, the password is now stored as a Linux like hash
value.
Do you remember Linux hashes inside the shadow file?
They are the fields separated by the dollar sign.
The first field is the type of the hash algorithm.
The second part is the salt and the rest is the hash value.
Now we can say it's more secure.