Router configs leak — TFTP backups, a git repo, an old device on eBay, a helpful "here's our config" email. What an attacker (or you, on an authorized engagement) gets out depends entirely on how the secret was stored. Some are reversible in a second; some are a hashcat job; some hide in plain sight. Know which is which.
This is post-exploitation / password-audit tradecraft for authorized engagements — a pentest with scope, a device you own, a CTF, or auditing your own backups. Recovering credentials from systems you don't have permission to test is illegal. The point here is defensive as much as offensive: knowing how weakly a config protects its secrets is exactly why you rotate to strong storage and guard your backups.
A device configuration is a bag of secrets: the enable password, local users, SNMP communities, TACACS/RADIUS keys, VPN pre-shared keys, wireless PSKs. Vendors "protect" these with a spread of schemes ranging from trivially reversible obfuscation to memory-hard hashes that laugh at your GPU. The single most useful skill when a config lands in your lap is reading the marker and knowing instantly whether you're looking at a one-second decode, an overnight hashcat run, or a wall.
This is the offensive companion to Attacking Cisco Gear and Attacking MikroTik Gear. It assumes you already have the config — from a backup, a TFTP grab, a repo, or a decommissioned box — and want the plaintext.
hashcat / john, a decent wordlist (rockyou + rules), a GPU helpsciscot7)01
Every stored Cisco secret carries a type number that tells you exactly how much trouble it is. This table is the whole game.
| Marker | Scheme → how to attack |
|---|---|
| type 0 | Cleartext. password 0 hunter2 — just read it. |
| type 7 | Vigenère obfuscation, fixed key. Instantly reversible, not a hash. |
| type 4 | Deprecated unsalted SHA-256 (buggy). Rare; hashcat -m 5700. |
| type 5 | MD5-crypt $1$. hashcat -m 500. Crackable with a wordlist. |
| type 8 | PBKDF2-SHA256 $8$. hashcat -m 9200. Slower, still crackable. |
| type 9 | scrypt $9$. hashcat -m 9300. Memory-hard — the wall. |
So enable secret 5 $1$mERr$... is a hashcat job; enable password 7 0822455D0A16 is a free win; secret 9 $9$... means go find another way in. The presence of type 7 anywhere is also a tell that service password-encryption is on — which does nothing but type 7.
02
Type 7 is the most dangerous kind of security: the kind that looks like security. It's a Vigenère cipher with a key baked into every IOS image — reversible offline, no cracking involved.
# The whole config is full of these once 'service password-encryption' is on: # snmp-server community 0822455D0A16 RO # tacacs-server key 7 121A0C041104 # ppp chap password 7 060506324F41 $ python3 -c 'import ciscot7; print(ciscot7.decrypt("0822455D0A16"))' hunter2 # No wordlist, no GPU, no network. The key is public and constant.
The high-value loot is rarely the enable secret — it's the type-7 keys next to it: the TACACS/RADIUS shared secret (pivot to the AAA server), the SNMP RW community (reconfigure the device), the VPN pre-shared key (stand up your own tunnel), the OSPF/BGP auth key. These are almost always type 7 because they can't be one-way hashed — the router needs the plaintext to use them. One leaked config often hands you lateral movement, not just a login.
03
Type 5/8/9 are genuine one-way hashes — no decode, only guess-and-check. Wordlist plus rules gets most human passwords; the hash type decides how fast.
# Pull the hashes into a file, one per line, then pick the mode by marker. $ hashcat -m 500 -a 0 type5.txt rockyou.txt -r best64.rule # $1$ MD5crypt $ hashcat -m 9200 -a 0 type8.txt rockyou.txt -r best64.rule # $8$ PBKDF2 $ hashcat -m 9300 -a 0 type9.txt rockyou.txt # $9$ scrypt (slow) # Type 5 falls fast; type 8 is slower; type 9's memory-hardness means a # small, targeted wordlist is your only realistic shot — big lists crawl.
The fix mirrors the attack. Store enable and user secrets as type 9 (enable algorithm-type scrypt secret ...), never enable password. Accept that service password-encryption (type 7) protects nothing and move real keys out of the running config where you can (key chains, external AAA). And treat any config that has ever left the box — a backup, a ticket attachment, a repo — as having leaked every type-0 and type-7 secret in it. Rotate them.
04
RouterOS plays it differently: a plain /export hides sensitive values, but a full backup and the user database do not protect them the way you'd hope — especially from older versions.
# On a box you already control, you don't crack — you ask. show-sensitive # dumps RADIUS secrets, PPP secrets, wireless PSKs, VPN keys in CLEARTEXT: [admin@rtr] > /export show-sensitive # The offline loot is the binary backup and the user database: # * a .backup file is only ENCRYPTED if saved with password=... ; # otherwise it's merely obfuscated and parses open. # * /rw/store/user.dat holds the local user credentials. [admin@rtr] > /system backup save name=cfg password="" # unencrypted = readable
Before v6.43, RouterOS kept local user passwords in user.dat in a form that public tools decode straight back to plaintext — a decommissioned or dumped box from that era gives up its admin password offline. v6.43+ moved to a stronger scheme, but two things still bite: an unencrypted backup hands over RADIUS/PPP/wireless secrets to anyone with a parser, and an admin who reused that password elsewhere is now your lateral move. Always backup save password=..., keep backups off world-readable storage, and treat an old MikroTik's user.dat as burned.
Takeaways
service password-encryption is cosmetic.-m 500 / 9200 / 9300) — a wordlist + rules; type 9's memory-hardness forces small, targeted lists./export hides secrets; show-sensitive, backups and user.dat don't — and pre-6.43 user passwords decode offline.Weak password storage and unprotected backups are quiet findings until someone's config leaks. I audit Cisco and MikroTik estates for reversible secrets, weak hash types and exposed backups — and fix them before they matter.
Book a Discovery Call →