<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><div>Here is the application that decrypts the passwords in platformConfig.xml. It's been tested with 6.x, 8.x and 9.x. Should work with 7.x as well. Please let me know if you run into any problems or have feedback.</div><div><br></div><a href="http://www.adhdtech.com/UCOS%20Password%20Decrypter.exe" target="_blank">http://www.adhdtech.com/UCOS%20Password%20Decrypter.exe</a><div><br></div><div>Thanks,</div><div><span style="font-size: 12pt;">Pete</span></div><div><br><div><hr id="stopSpelling">From: jpb@chykn.com<br>To: cisco-voip@puck.nether.net<br>Date: Sun, 2 Feb 2014 19:29:39 -0600<br>Subject: [cisco-voip] UCOS Password Recovery (not reset)<br><br>
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir="ltr">I've received a few messages off list regarding the possibility of recovering (as opposed to just resetting) a cluster security password from a non-rooted, patched UCOS 6.x-9.x host. Short answer; yes, it's possible, contrary to the official responses...<div><a href="https://supportforums.cisco.com/thread/2164756" target="_blank" style="font-size:12pt;">https://supportforums.cisco.com/thread/2164756</a><div><br></div><div><div><div><div>Disclaimer:</div><div>What's discussed below is best done in a lab environment and should never be done in production. It may render your box unsupportable, make your hair fall out or give you the urge to bark like a dog in meetings.</div><div><br></div><div>That being said, I've actually had to do this on a production host due to the fact that we inherited the environment but not all the passwords. The choice was either take one host down for 20 minutes to copy a file or take a longer outage on every host in the cluster as required by the official Cisco password reset process. Plus the official process is a change, so tack on a week to get approval from change management.</div><div><a href="http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/cucos/8_6_1/cucos/iptpch2.html" target="_blank" style="font-size:12pt;">http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/cucos/8_6_1/cucos/iptpch2.html</a></div><div><div><span style="font-size:12pt;"><br></span></div><div><span style="font-size:12pt;">Of course it's well known that the platformConfig.xml file contains the encrypted passwords, but so far I haven't found any existing utilities to perform the decryption. Ended up writing one in C# this weekend; could use some volunteers to test it if anyone is interested</span><span style="font-size:12pt;">. You point it toward your plaformConfig.xml file and it will output the following...</span></div><div><div><div><br></div><div>Localhost Admin Name & Password</div><div>SFTP Password</div><div>Cluster Security Password</div><div>Application User Name & Password</div><div><br></div><div>Needless to say, the hard part is extracting this file from a non-rooted, patched UCOS host...</div><div><br></div><div>/usr/local/platform/conf/platformConfig.xml</div><div><br></div><div>I've only found two surefire ways to do it without rooting, but both require shutting down the host and booting to a live Linux ISO. If you're using a VM, create a snapshot between shutting down and booting to the ISO. If you accidentally change/delete something or the UCOS volumes are not cleanly dismounted (you hit the power), you may very well hose the box.</div><div><br></div><div>Local Copy to TFTP Method</div><div><ol><li><span style="font-size:12pt;">Create a scratch XML file on your workstation. Can't be zero-length, so enter some junk text.</span></li><li><span style="font-size:12pt;">Upload scratch XML file to the host's TFTP directory using the GUI.</span></li><li><span style="font-size:12pt;">Reboot the host to a live Linux ISO.</span></li><li><span style="font-size:12pt;">Mount the '/' and '/common' volumes.</span></li><li><span style="font-size:12pt;">Use 'cat' to copy the contents of platformConfig.xml to the scratch file in the TFTP directory. A straight copy would seem easier, but will not work due to the security settings of the newly created file.</span></li><li><span style="font-size:12pt;">Reboot the host, let it boot to UCOS as usual.</span></li><li><span style="font-size:12pt;">Use a TFTP client to download the scratch XML file from the host's TFTP server.</span></li></ol><div><br></div><div>Remote Copy Method</div></div><div><ol><li>Reboot the host to a live Linux ISO.</li><li>Configure networking.</li><li>Mount the '/' and '/common' volumes.</li><li>Use your favorite remote copy method (TFTP, FTP, SCP) to copy platformConfig.xml to a remote host.</li><li>Reboot the host, let it boot to UCOS as usual.</li></ol></div><div><span style="font-size:12pt;"><br></span></div><div><span style="font-size:12pt;">The first option requires no knowledge of Linux; the second is more straightforward. I took screenshots of the first process just in case. But before I finish documenting I thought I'd check with the group. Does anyone have a better way to get at this file? Maybe one that doesn't involve shutting down the host?</span></div></div><div><span style="font-size:12pt;"><br></span></div><div><span style="font-size:12pt;">The only "shortcut" I've found so far takes advantage of a directory traversal bug which has been patched for some time...</span></div><div><a href="http://www.securityfocus.com/archive/1/520414" target="_blank">http://www.securityfocus.com/archive/1/520414</a></div><div><br></div><div><span style="font-size:12pt;">Thanks,</span></div><div><span style="font-size:12pt;">Pete</span></div></div></div></div></div></div></div> </div>
<br>_______________________________________________
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip</div></div> </div></body>
</html>