mirror of
https://github.com/opsxcq/mirror-textfiles.com.git
synced 2025-08-12 17:23:59 +02:00
313 lines
10 KiB
Plaintext
313 lines
10 KiB
Plaintext
Password Recovery Techniques
|
||
|
||
---------------------------------------------------------------------------
|
||
|
||
Introduction
|
||
|
||
This document will explain several password recovery techniques for Cisco
|
||
routers. You can perform password recovery on most of the platforms without
|
||
changing hardware jumpers, but all platforms require the router to be
|
||
reloaded. Password recovery can only be done from the console port
|
||
physically attached to the router.
|
||
|
||
There are three ways to restore enable access to a router when the password
|
||
is lost. You can VIEW the password, CHANGE the password, or ERASE the
|
||
configuration and start over as if the box was new.
|
||
|
||
Each procedure follows these basic steps:
|
||
|
||
1. Configure the router to boot up without reading the configuration
|
||
memory (NVRAM). This is sometimes called the test system mode.
|
||
|
||
2. Reboot the system.
|
||
|
||
3. Access enable mode (which can be done without a password if you are in
|
||
test system mode).
|
||
|
||
4. VIEW or CHANGE the password, or ERASE the configuration.
|
||
|
||
5. Reconfigure the router to boot up and read the NVRAM as it normally
|
||
does.
|
||
|
||
6. Reboot the system.
|
||
|
||
NOTE: Some password recovery requires that a terminal issues a
|
||
Break signal; you must be familiar with how your terminal or PC
|
||
terminal emulator issues this signal. For example, in ProComm,
|
||
the keys Alt-B will by default generate the Break signal, and in
|
||
Windows Terminal you press Break or CTRL-Break. Windows Terminal
|
||
also allows you to define a function key as BREAK. From the
|
||
terminal window, select Function Keys and define one as break by
|
||
filling in the characters ^$B (Shift 6, Shift 4, and Capital B).
|
||
|
||
The following six sections contain detailed instructions for specific Cisco
|
||
routers. Locate your router in the section headings to determine which
|
||
technique to use.
|
||
|
||
Technique #1
|
||
|
||
All Cisco 2000 Series, 2500 Series, 3000 Series, 680x0-Based 4000 Series,
|
||
7000 Series Running 10.0 or Later in ROMs, IGS Series Running 9.1 or Later
|
||
in ROMs
|
||
|
||
This technique can be used on the 7000 and 7010 only if the router has 10.0
|
||
ROMs installed on the RP card. It may be booting Flash 10.0 software, but
|
||
it needs the actual ROMs on the processor card as well.
|
||
|
||
1. Attach a terminal or PC with terminal emulation to the console port of
|
||
the router.
|
||
|
||
2. Type "show version" and record the setting of the configuration
|
||
register. It is usually 0x2102 or 0x102.
|
||
|
||
3. Power the router down, then up.
|
||
|
||
4. Press the Break key on the terminal within 60 seconds of the power up.
|
||
You will see the > prompt with no router name. If you don't, the
|
||
terminal is not sending the correct Break signal. In that case, check
|
||
the terminal or terminal emulation setup.
|
||
|
||
5. Type "o/r0x42" at the > prompt to boot from Flash or "o/r 0x41" to
|
||
boot from the boot ROMs. Note that this is the letter "o," not the
|
||
numeral zero. If you have Flash and it is intact, 0x42 is the best
|
||
setting. Use 0x41 only if the Flash is erased or not installed.
|
||
|
||
NOTE: If you use 0x41, you can only view or erase the
|
||
configuration. You cannot change the password.
|
||
|
||
6. Type "i" at the > prompt. The router will reboot but will ignore its
|
||
saved configuration.
|
||
|
||
7. Answer "no" to all the setup questions.
|
||
|
||
8. Type "enable" at the "Router>" prompt. You'll be in enable mode and
|
||
see the "Router#" prompt.
|
||
|
||
9. Choose one of these three options:
|
||
|
||
o To VIEW the password type "show config."
|
||
o To CHANGE the password (in case it is encrypted, for example):
|
||
a. Type "config mem" to copy the NVRAM into memory.
|
||
b. Type "config term" and make the changes to the configuration.
|
||
|
||
conf t
|
||
enable password password
|
||
ctrl-z
|
||
|
||
c. Type "write mem" to commit the changes.
|
||
o To ERASE the config, type "write erase.
|
||
|
||
10. Type "config term" at the prompt.
|
||
|
||
11. Type "config-register 0x2102," or whatever value you recorded in step
|
||
2.
|
||
|
||
12. Hit Ctrl-Z to quit from editor.
|
||
|
||
13. Type "reload" at the prompt. You do not need to write memory.
|
||
|
||
Technique #2
|
||
|
||
Cisco 1003, 4500, or IDT Orion-Based Routers
|
||
|
||
1. Attach a terminal or PC with terminal emulation to the console port of
|
||
the router.
|
||
|
||
2. Type "show version" and record the setting of the configuration
|
||
register. It is usually 0x2102 or 0x102.
|
||
|
||
3. Power the router down, then up.
|
||
|
||
4. Press the Break key on the terminal within 60 seconds of the power up.
|
||
You will see the "rommon>" prompt. If you don't, the terminal is not
|
||
sending the correct Break signal. In that case, check the terminal or
|
||
terminal emulation setup.
|
||
|
||
5. Type "confreg" at the "rommon>" prompt.
|
||
|
||
6. Answer "y" to the "Do you wish to change configuration[y/n]?" prompt.
|
||
|
||
7. Answer "n" to all of the questions that appear until you reach the
|
||
"ignore system config info[y/n]?" prompt. Answer "y."
|
||
|
||
8. Answer "n" to the remaining questions until you reach the "change boot
|
||
characteristics[y/n]?" prompt. Answer "y."
|
||
|
||
9. At the "enter to boot:" prompt, type "2" followed by a carriage
|
||
return. If Flash is erased, type "1." If all Flash is erased, the 4500
|
||
must be returned to Cisco for service.
|
||
|
||
NOTE: If you use "1," you can only view or erase the
|
||
configuration. You cannot change the password.
|
||
|
||
10. A configuration summary is printed. Answer "n" to the "Do you wish to
|
||
change configuration[y/n]?" prompt.
|
||
|
||
11. Type "reset" at the "rommon>" prompt, or power cycle your 4500 or
|
||
7500.
|
||
|
||
12. Once it boots up, answer "no" to all the Setup questions.
|
||
|
||
13. Type "enable" at the "Router>" prompt. You'll be in enable mode and
|
||
see the "Router#" prompt.
|
||
|
||
14. Choose one of these three options:
|
||
|
||
o To VIEW the password type "show config."
|
||
o To CHANGE the password (in case it is encrypted, for example):
|
||
a. Type "config mem" to copy the NVRAM into memory.
|
||
b. Type "config term" and make the changes to the configuration.
|
||
|
||
conf t
|
||
enable password password
|
||
ctrl-z
|
||
|
||
c. Type "write mem" to commit the changes.
|
||
o To ERASE the config, type "write erase."
|
||
|
||
15. Type "config term" at the prompt.
|
||
|
||
16. Type "config-register 0x2102" or whatever value you recorded in step
|
||
2.
|
||
|
||
17. Hit Ctrl-Z to quit from the editor.
|
||
|
||
18. Type "reload" at the prompt. You do not need to write memory.
|
||
|
||
Technique #3
|
||
|
||
IGS Routers Running Software Earlier Than 9.1
|
||
|
||
IGS routers have a bank of DIP switches on the rear panel. If they are
|
||
running software earlier than 9.1, then these switches are used for
|
||
password recovery.
|
||
|
||
1. Attach a terminal or PC with terminal emulation to the console port of
|
||
the router.
|
||
|
||
2. Power the router down.
|
||
|
||
3. Record the settings of the switches on the rear panel.
|
||
|
||
4. Set switch 7 ON (or down).
|
||
|
||
5. Set switches 0-3 OFF (or up).
|
||
|
||
6. Power the router up. It will boot up to the > prompt.
|
||
|
||
7. Type "b" at the > prompt. The router is in test-system mode.
|
||
|
||
8. Press return until the "Test-System>" prompt appears.
|
||
|
||
9. Type "enable" at the prompt. You'll be in enable mode and see the
|
||
"Test-System#" prompt.
|
||
|
||
10. Choose one of these three options:
|
||
|
||
o To VIEW the password type "show config."
|
||
o To CHANGE the password (in case it is encrypted, for example):
|
||
a. Type "config mem" to copy the NVRAM into memory.
|
||
b. Type "config term" and make the changes to the configuration.
|
||
|
||
conf t
|
||
enable password password
|
||
ctrl-z
|
||
|
||
c. Type "write mem" to commit the changes.
|
||
o To ERASE the config, type "write erase".
|
||
|
||
11. Restore the switch setting to those recorded in step 3.
|
||
|
||
12. Reboot the router.
|
||
|
||
Technique #4
|
||
|
||
CGS, MGS, AGS, AGS+, 70x0 Running ROMs Lower Than 10.0
|
||
|
||
1. Attach a terminal or PC with terminal emulation to the console port of
|
||
the router.
|
||
|
||
2. Power the router down.
|
||
|
||
3. Remove the processor card (CSC/2 or CSC/3 or CSC/4 on AGS/CGS/MGS, or
|
||
RP on a 70x0).
|
||
|
||
4. Change the hardware register from bit position 0 (or 1) to position
|
||
15.
|
||
|
||
5. Re-insert the processor card.
|
||
|
||
6. Power the router up.
|
||
|
||
7. Press "b" at the > prompt or "b flash" if you have Flash memory
|
||
installed.
|
||
|
||
8. Press return until the "Test-System>" prompt appears.
|
||
|
||
9. Type "enable" at the prompt. You'll be in enable mode and see the
|
||
"Test-System#" prompt.
|
||
|
||
10. Choose one of these three options:
|
||
|
||
o To VIEW the password type "show config."
|
||
o To CHANGE the password (in case it is encrypted, for example):
|
||
a. Type "config mem" to copy the NVRAM into memory.
|
||
b. Type "config term" and make the changes to the configuration.
|
||
|
||
conf t
|
||
enable password password
|
||
ctrl-z
|
||
c. Type "write mem" to commit the changes.
|
||
|
||
o To ERASE the config, type "write erase."
|
||
|
||
11. Power the router down.
|
||
|
||
12. Remove the processor card and return the jumper on pin 15 to its
|
||
original position.
|
||
|
||
13. Power the router up.
|
||
|
||
Technique #5
|
||
|
||
500-CS Communication Servers
|
||
|
||
The password cannot be recovered from the 500-CS since it does not have a
|
||
console port. Your only option is to erase the configuration.
|
||
|
||
1. Power the router off by unplugging it.
|
||
|
||
2. Depress and hold the DEFAULT button on the front of the chassis.
|
||
|
||
3. Power the router back on.
|
||
|
||
4. Watch the OK and LAN LEDs. They will blink on, and then off.
|
||
|
||
5. When they blink off (after about 15 seconds), release the DEFAULT
|
||
button.
|
||
|
||
6. In 2-10 minutes, the 500-CS will enter setup mode as if it was factory
|
||
new.
|
||
|
||
7. Configure the router.
|
||
|
||
You could also recover a password on a 500 by holding the DEFAULT button
|
||
down for 30-45 seconds. The system will then be in test mode, and you can
|
||
follow the normal procedure for password recovery. See the earlier sections
|
||
for details.
|
||
|
||
Technique #6
|
||
|
||
Cisco 1020
|
||
|
||
You must call the Cisco TAC to recover Cisco 1020 passwords. The 1020 will
|
||
issue a password override challenge that can only be interpreted by TAC
|
||
personnel.
|
||
|
||
---------------------------------------------------------------------------
|
||
Posted: Thu Aug 17 11:57:44 PDT 1995
|
||
|
||
Copyright 1995 <20>Cisco Systems Inc.
|
||
|
||
|