topic Re: Retrieve WLAN password from WLC in Wireless

Retrieve WLAN password from WLC

Martin Smid — Sun, 04 Jul 2021 03:55:50 GMT

Hi,

I have been wondering whether we can retrieve a lost WPA password from our WLC.

All I see int he config is

wlan security static-wep-key encryption 4 104 <mode unknown> <passwd hidden> 1

Any ideas?

Retrieve WLAN password from WLC

pcroak — Fri, 14 Oct 2011 15:58:54 GMT

Hello Martin,

We have a procedure to retrieve WEP keys from the WLC, however we cannot retrieve WPA keys. We use a stronger encryption algorithm for WPA which prevents a simple retrieval process.

You might have a wireless client that has the option to "show key" in the wireless profile that could help here, but unfortunately if the key has been lost you may need to re-configure it.

-Pat

Re: Retrieve WLAN password from WLC

George Stefanick — Sat, 15 Oct 2011 12:48:09 GMT

WPA / WPA2 PSK can be broken with CowPatty. It's based on a dicionary attack. With that being said you could spend forever trying to crack it ...

Oh, and BTW.. If you used PSK with windows zero config, I understand the PSK sits in the registration.

Re: Retrieve WLAN password from WLC

Martin Smid — Mon, 17 Oct 2011 07:52:17 GMT

Hey Pat,

thank you for the info. Can you please share a link to a Cisco website with me for the procedure? All I find is password recovery for WLC. It might not help with this particular case, but might come in handy in the future.

Thank you,

Martin

Re: Retrieve WLAN password from WLC

Martin Smid — Mon, 17 Oct 2011 07:55:16 GMT

Hi George,

yeah, I have been thinking about trying to crack the password. The WLAN is unfortunately not used by PCs, but Cisco wi-fi phones. And they are manually configured. The person responsible lost the password so we are trying to help out.

Cheers,

Martin

Re: Retrieve WLAN password from WLC

pcroak — Mon, 17 Oct 2011 16:17:20 GMT

Hi Martin,

I don't think we have any documentation for the WEP recovery procedure, I will outline the steps for you quickly, but this will only work for WEP:

From the WLC CLI:

config passwd-cleartext enable

config switchconfig secret-obfuscation disable

Then, upload your configuration file via tftp/file upload (this will take longer than normal config uploads, need to be running WLC 6.0/7.0 I believe).

When you open your configuration file, the WEP key will be listed in the command, the relevant portion is the leading HEX section before all of the zeros. You can convert those hex values to ascii if desired.

-Pat

Re: Retrieve WLAN password from WLC

George Stefanick — Mon, 17 Oct 2011 16:49:18 GMT

Pat -- Great post!

Retrieve WLAN password from WLC

Zar Ni Lay Thwin — Fri, 29 Nov 2013 01:37:11 GMT

Any luck of retireveing key for WPA2 from WLC?

I am having that issue as no body know what is the key being used.

Retrieve WLAN password from WLC

Leo Laohoo — Fri, 29 Nov 2013 01:38:19 GMT

Any luck of retireveing key for WPA2 from WLC?

I am having that issue as no body know what is the key being used.

The keys cannot be retrieved. It's encrypted.

You'll need to find someone who can hack it.

Re: Retrieve WLAN password from WLC

Scott Fella — Fri, 29 Nov 2013 01:40:24 GMT

Your better off getting that info from a windows 7 machine if one is configured for it. Windows 7 allows you to view the preshared key.

Sent from Cisco Technical Support iPhone App

Re: Retrieve WLAN password from WLC

Zar Ni Lay Thwin — Fri, 29 Nov 2013 02:04:17 GMT

Problem is it is used for Cisco Wireless Phones.

No PC is ever connected to it.

Re: Retrieve WLAN password from WLC

Scott Fella — Fri, 29 Nov 2013 02:31:40 GMT

Sorry, but there is no way to retrieve the preshared key.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"

Re: Retrieve WLAN password from WLC

Zar Ni Lay Thwin — Fri, 29 Nov 2013 03:02:17 GMT

Thank you Scott for confirmation.

Re: Retrieve WLAN password from WLC

Zar Ni Lay Thwin — Fri, 29 Nov 2013 03:02:37 GMT

Thanks for advice Leo

This procedure saved me from

Pedro Prado — Tue, 02 Sep 2014 20:22:58 GMT

This procedure saved me from having to retype 223 passwords for local net users, on an upgrade, as the encrypted format one controller exported was not accepted by the newer controller.

Thanks. Really!