A password recovery requires two things, you need to be able to power cycle the device, I'm going to
be using an APC to do this so that I can power cycle the device remotely.
I'm also connected to the console of this router via a terminal server.
So I'm telnetting to a server and then accessing the console of this router through the terminal
server.
In the real world, you may have to physically walk to the router and plug your laptop into the console
and then power cycle the device
or if you've got access to an APC and a terminal server that's giving you out-of-band console access
to the device, you can do what I'm doing here.
The process is the same,
the APC and terminal server only give me the ability to access the console and power cycle the device
remotely.
I'm connected to the console of this router and I'm told that I need to press return to get started.
So I'm in user mode,
I can type show version and we can see that this is a Cisco 1841 router.
We can see that the configuration register is set to 2102,
that is the default of value, which means that the router will boot normally and has a console speed
of 9600 bits per second startup of will be used and we can change the config register if necessary as
follows.
However, when I type enable, let's assume that I don't know what the password is.
So I'm unable to access privilege mode on this router.
Let's assume that the secret password was set and we don't know what that password is anymore.
So what we can do is power cycle, the router, so I'm going to set the APC to do an immediate reboot
on the router
and what we will notice on the router is it's rebooting, I'm going to send a special command which
is the break to the router, and notice I am now in ROM MON mode.
So through the APC are remotely rebooted the router rather than physically doing it.
Router has rebooted and I sent a break signal to the router so you could use your keyboard or your terminal
emulation program to send the break.
In this case, I'm using putty
and I just sent the brake command to the router which meant that it broke the boot process and went into
ROM MON mode.
Question mark shows me options
in ROM MON, you'll notice that this is different to the traditional Cisco
IOS, this is the command that we're looking for, configuration register utility.
So we're going to set tat to conf reg 0x142.
The possible procedure I'm using is a little bit different to the 2900 possible procedure, but notice
the same command is used.
The Cisco website will give you the details for individual routers.
So as an example, for an 1841 router, the full procedure is shown here.
Just follow the procedure for the relevant device that you want to do a password recovery on.
That includes both routers and switches.
So in a document like this, we have high-end routers and switches and other devices.
So conf reg is set,
we are told that we need to reset or power cycle
the device, command to do that is going to be reset
and what will happen now is the router will put normally, but it will bypass the startup configuration
because when setting this value to 4 bit 6 is set, which means ignore NVRAM contents.
So to save you some time, I'm going to speed up the process.
What will happen is when the router boots up, it will bypass the startup configuration and ask us
whether we want to enter the initial startup dialogue and notice now that the router is prompting us
with the system configuration dialogue.
We don't want to enter that,
so I'm going to say no.
We're told to press return to get started
and notice the name of the router is router, whereas previously it was called C1841 R1.
So here's the critical piece enable, I can move to enable mode without a password show startup-config
shows that there is an enable secret password configured in the startup-config
and we can see the hostname of the router as an example.
We can see other information such as IP addresses on serial interfaces.
We can see that OPF was configured as part of the Start-Up config in the running config, however.
we don't have the hostname configured,
we don't have a secret password,
we don't have IP addresses on our serial interfaces and we don't have OSPF configured. So to get the
config back, I'm gonna type copy startup-config, running-config.
Notice the router name has now changed,
show run
shows us
the IP addresses and OSPF configuration in running config. Now OSPF was complaining that it couldn't allocate
a unique router ID and that's because all interfaces on the router are shut down.
So I'm going to go into serial 0/0/0 and no shut the interface and do that on the other serial
interface and notice now OSPF is able to allocate
a router ID and then form a neighbor relationship with a neighboring router. So as an example, show IP,
OSPF neighbor shows us that the neighbor relationship has formed.
Now, it's important to remember that we are now in privilege mode or enable mode, but we don't know
the password, show run
shows us that the secret password is configured, but we don't actually know what that password is,
We moved from user mode to privilege mode without entering a password, and then we copied the startup-
config to running-config.
If we exit privilege mode now, we won't be able to get back in.
So what we need to do is change the password, so change the secret password to something that we know.
So it's really important that when you do the password recovery that you go to privilege mode or enable
mode first and then copy the config from startup-config to running-config and then change the password
and then save your config.
So it's really important that you set the password and that you then save the configuration before continuing.
Now show version
shows us that the configuration register is still 2142, the configuration register configuration
is separate to the running and startup config of a router.
So what I'm going to do is save the config right now.
So copy running-config, startup-config or write mem
at the moment, the config register is 0x2142, if I rebooted the router now, it would
end up booting without using the startup-config
again, we don't want to do that.
We want to use the config register command and set it for normal
boot, so set it to 2102.
Show version notice it will be this at next reload, I can reload the router without saving the configuration
and it will reboot using the previously saved config.
If you remember before I made the change, I saved the config.
So that's the configuration that's going to be used.
I don't need to save the configuration again for the configuration register change to be saved, it's
saved independently of the running configuration on the router, so I'll speed up the boot process again.
So notice that we're told to press enter to get started and interfaces come up and the OSPF neighbor relationship
is formed, and that's because the startup-config was applied when the router booted up.
Now, when we type enable, we can log in with the password that we configured, in other words,
the reset secret password.
We can't see that in the output here because it's hashed, but this is the password of Cisco that we configured
the router to use.
So that's an example of how to do password recovery.
Don't forget that on Cisco's website, there are password recovery procedures for various routers that
you may be using in your lab or that you may be using in the real world.
Simply follow the step by step procedures to bypass an encrypted password.
This does require physical access.
In other words, you need access to the console to be able to do a password recovery.