On a Cisco router you login via SSH or Telnet, then you run a command to become 'enabled'. enable is a command like sudo on Linux-it elevates your permission level so you can make changes (although not all changes require you to be enabled, most do).

If you used ExtraBacon to clear the login user/password you would get a basic shell on connection. This would open at least 2 options to you as an attacker-1) using a local exploit to become an enabled user and 2) you can now send traffic to ALL the networks that the firewall/router knows about-for example, a non-internet connected management network that might be filled with never upgraded KVM/OOB control equipment.

In my lab, re-enabling did not kill the current connection, so it could be a very quick switch flick, login, revert to try and avoid detection.

The "enable" password is sort of like the root account on Cisco gear. When you first connect, you're in a low-priv state where you can do simple things like see the uptime of the device, interface info, etc. But to make any changes to the settings on the router, you have to run the "enable" command which typically asks for a password which is separate from the login password.

I guess the name comes from enabling admin functionality, but I don't know why Cisco didn't call the command admin. Anyway, this enable is different from enabling/disabling the login authentication.

For those without `showdead` on: (@dang / @sctb: this seems to be a false positive)

> XORcat 18 minutes ago [dead] [-]

> In my lab, re-enabling did not kill the current connection, so it could be a very quick switch flick, login, revert to try and avoid detection.