<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I've received a few messages off list regarding the possibility of recovering (as opposed to just resetting) a cluster security password from a non-rooted, patched UCOS 6.x-9.x host. Short answer; yes, it's possible, contrary to the official responses...<div><a href="https://supportforums.cisco.com/thread/2164756" target="_blank" style="font-size: 12pt;">https://supportforums.cisco.com/thread/2164756</a><div><br></div><div><div><div><div>Disclaimer:</div><div>What's discussed below is best done in a lab environment and should never be done in production. It may render your box unsupportable, make your hair fall out or give you the urge to bark like a dog in meetings.</div><div><br></div><div>That being said, I've actually had to do this on a production host due to the fact that we inherited the environment but not all the passwords. The choice was either take one host down for 20 minutes to copy a file or take a longer outage on every host in the cluster as required by the official Cisco password reset process. Plus the official process is a change, so tack on a week to get approval from change management.</div><div><a href="http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/cucos/8_6_1/cucos/iptpch2.html" target="_blank" style="font-size: 12pt;">http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/cucos/8_6_1/cucos/iptpch2.html</a></div><div><div><span style="font-size: 12pt;"><br></span></div><div><span style="font-size: 12pt;">Of course it's well known that the platformConfig.xml file contains the encrypted passwords, but so far I haven't found any existing utilities to perform the decryption. Ended up writing one in C# this weekend; could use some volunteers to test it if anyone is interested</span><span style="font-size: 12pt;">. You point it toward your plaformConfig.xml file and it will output the following...</span></div><div><div><div><br></div><div>Localhost Admin Name & Password</div><div>SFTP Password</div><div>Cluster Security Password</div><div>Application User Name & Password</div><div><br></div><div>Needless to say, the hard part is extracting this file from a non-rooted, patched UCOS host...</div><div><br></div><div>/usr/local/platform/conf/platformConfig.xml</div><div><br></div><div>I've only found two surefire ways to do it without rooting, but both require shutting down the host and booting to a live Linux ISO. If you're using a VM, create a snapshot between shutting down and booting to the ISO. If you accidentally change/delete something or the UCOS volumes are not cleanly dismounted (you hit the power), you may very well hose the box.</div><div><br></div><div>Local Copy to TFTP Method</div><div><ol><li><span style="font-size: 12pt;">Create a scratch XML file on your workstation. Can't be zero-length, so enter some junk text.</span></li><li><span style="font-size: 12pt;">Upload scratch XML file to the host's TFTP directory using the GUI.</span></li><li><span style="font-size: 12pt;">Reboot the host to a live Linux ISO.</span></li><li><span style="font-size: 12pt;">Mount the '/' and '/common' volumes.</span></li><li><span style="font-size: 12pt;">Use 'cat' to copy the contents of platformConfig.xml to the scratch file in the TFTP directory. A straight copy would seem easier, but will not work due to the security settings of the newly created file.</span></li><li><span style="font-size: 12pt;">Reboot the host, let it boot to UCOS as usual.</span></li><li><span style="font-size: 12pt;">Use a TFTP client to download the scratch XML file from the host's TFTP server.</span></li></ol><div><br></div><div>Remote Copy Method</div></div><div><ol><li>Reboot the host to a live Linux ISO.</li><li>Configure networking.</li><li>Mount the '/' and '/common' volumes.</li><li>Use your favorite remote copy method (TFTP, FTP, SCP) to copy platformConfig.xml to a remote host.</li><li>Reboot the host, let it boot to UCOS as usual.</li></ol></div><div><span style="font-size: 12pt;"><br></span></div><div><span style="font-size: 12pt;">The first option requires no knowledge of Linux; the second is more straightforward. I took screenshots of the first process just in case. But before I finish documenting I thought I'd check with the group. Does anyone have a better way to get at this file? Maybe one that doesn't involve shutting down the host?</span></div></div><div><span style="font-size: 12pt;"><br></span></div><div><span style="font-size: 12pt;">The only "shortcut" I've found so far takes advantage of a directory traversal bug which has been patched for some time...</span></div><div><a href="http://www.securityfocus.com/archive/1/520414" target="_blank">http://www.securityfocus.com/archive/1/520414</a></div><div><br></div><div><span style="font-size: 12pt;">Thanks,</span></div><div><span style="font-size: 12pt;">Pete</span></div></div></div></div></div></div></div> </div></body>
</html>