import re
import random
import optparse
"""
http://pen-testing.sans.org/resources/papers/gcih/cisco-ios-type-7-password-vulnerability-100566

To calculate xlat use the full p or full a password, after 51 charaters it's repeating.
The first 2 numbers (salt) are taken off

p = "140316144B1B161F315C5E19091507021B1C143A3B3438232532031706131146494843441E130806494847434245441B4B16174847"
a = "051207055A0A070E204D4F08180416130A0D052B2A2529323423120617020057585952550F021917585956525354550A5A07065956"
xlat = []
for i in range(len(a)/2):
	xlat.append(hex(int(a[2*i:2*i+2],16) ^ ord("a")))

print xlat

"""

xlat = [0x64, 0x73, 0x66, 0x64, 0x3b, 0x6b, 0x66, 0x6f, 0x41, 0x2c, 0x2e, 0x69, 0x79, 0x65, 0x77, 0x72, 0x6b, 0x6c, 0x64
, 0x4a, 0x4b, 0x44, 0x48, 0x53, 0x55, 0x42, 0x73, 0x67, 0x76, 0x63, 0x61, 0x36, 0x39, 0x38, 0x33, 0x34, 0x6e, 0x63,
0x78, 0x76, 0x39, 0x38, 0x37, 0x33, 0x32, 0x35, 0x34, 0x6b, 0x3b, 0x66, 0x67, 0x38, 0x37]

			
def decrypt_type7(ep):
	"""
	Based on http://pypi.python.org/pypi/cisco_decrypt/
	Regex improved
	"""
	dp = ''
	regex = re.compile('(^[0-9A-Fa-f]{2})([0-9A-Fa-f]+)')
	result = regex.search(ep)
	s, e = int(result.group(1)), result.group(2)
	for pos in range(0, len(e), 2):
		magic = int(e[pos] + e[pos+1], 16)
		if s <= 50:
			# xlat length is 51
			newchar = '%c' % (magic ^ xlat[s])
			s += 1
		if s == 51: s = 0
		dp += newchar
	return dp

def encrypt_type7(pt):
	"""
	Make Type 7 Cisco password from a string
	"""
	salt = random.randrange(0,15);
	ep = "%02d" % salt
	for i in range(len(pt)):
		ep += "%02x" % (ord(pt[i]) ^ xlat[salt])
		salt += 1
		if salt == 51: salt = 0
	return ep

def main():
	usage = "Usage: %prog [options]"
	parser = optparse.OptionParser(usage=usage)
	parser.add_option('-e', '--encrypt', action='store_true', dest='encrypt', default=False, help='Encrypt password')
	parser.add_option('-d', '--decrypt', action='store_true', dest='decrypt',default=True, help='Decrypt password. This is the default')
	parser.add_option('-p', '--password', action='store', dest="password", help='Password to encrypt / decrypt')
	parser.add_option('-f', '--file', action='store', dest="file", help='Cisco config file, only for decryption')
	options, args = parser.parse_args()
	render_as = "files"

	#fix issue 1, if encrypt is selected, that takes precedence
	if (options.encrypt):
		options.decrypt = False
	if (options.password is not None):
		if(options.decrypt):
			print("Decrypted password: " + decrypt_type7(options.password))
		elif(options.encrypt):
			print("Encrypted password: " + encrypt_type7(options.password))
	elif (options.file is not None):
		if(options.decrypt):
			try:
				f = open(options.file)
				regex = re.compile('(7 )([0-9A-Fa-f]+)($)')
				for line in f:
					result = regex.search(line)
					if(result):
						print("Decrypted password: " + decrypt_type7(result.group(2)))
			except IOError:
				print("Couldn't open file: " + options.file)
		elif(options.encrypt):
			parser.error("You can't encrypt a config file\nPlease run 'python ciscot7.py --help' for usage instructions.")
	else:
		parser.error("Password or config file is not specified!\nPlease run 'python ciscot7.py --help' for usage instructions.")


if __name__ == '__main__':
	main()