1. by Joe Elkins Password Recovery for Cisco Routers (aka Breaking a Cisco Router)

2. Copyright, University of Tulsa, 2002 Overview Equipment Requirements Router Memory Password Recovery Sequence

3. Copyright, University of Tulsa, 2002 Equipment Requirements PC with a DB9 or DB25 serial port Rollover cable DB9/DB25 to RJ45 converter Windows with HyperTerminal installed (Use HyperTerminal PE)

4. Copyright, University of Tulsa, 2002 Router Memory Cisco Routers use three main memory types -Flash -NVRAM -DRAM

5. Copyright, University of Tulsa, 2002 Router Memory FLASH FLASH Memory -Contains the IOS -New routers have IOS images that are zipped -Can contain multiple images if the module is large enough. -Router(config)#boot system flash IOS_filename

6. Copyright, University of Tulsa, 2002 Router Memory NVRAM Non-Volatile Random Access Memory -Stores the start-up config file -Stores register settings -Stores boot system commands

7. Copyright, University of Tulsa, 2002 Router Memory DRAM DRAM -Known as working memory -Stores working IOS image -Stores working config file called running-config -Stores routing table, ARP tables, NAT tables, DHCP, etc.

8. Copyright, University of Tulsa, 2002 Password Recovery Sequence 1.Physical access 2.Reset router 3.Break start-up sequence 4.Change register setting 5.Reset router 6.Enter privileged mode 7.Copy start-up to running config 8.Enter global config mode 9.Change passwords 10.Copy running config to start-up 11.Change registers back 12.Done

9. Copyright, University of Tulsa, 2002 Password Recovery Sequence Physical Access MUST HAVE PHYSICAL ACCESS!!!

10. Copyright, University of Tulsa, 2002 If you have physical access you own the router. Switches are the same, but have different recovery process -Some switches just reset, and it asks if you want to keep current password!!!!! Connect rollover cable Password Recovery Sequence Physical Access

11. Copyright, University of Tulsa, 2002 Password Recovery Sequence Physical Access Set-up HyperTerminal –Name your session –Select COM1/COM2 –Set Properties

12. Copyright, University of Tulsa, 2002 Password Recovery Sequence Reset Router Reset Router reload (EXEC mode) reset (rommon mode) Cycle power

13. Copyright, University of Tulsa, 2002 Password Recovery Sequence Break Start-up 60 second time frame to break Use Ctrl+Break Puts router in rommon> mode –ROM monitor –aka RXBoot –Known as programmer’s mode

14. Copyright, University of Tulsa, 2002 Password Recovery Sequence Change Registers At rommon1> –Type confreg 0x42 – Type reset

15. Copyright, University of Tulsa, 2002 Password Recovery Sequence Privileged Mode When the router reboots will be at Router> mode. Router> mode is the default empty config –No passwords, or anything else –Already in User EXEC mode –Type enable to gain privileged mode –Router #

16. Copyright, University of Tulsa, 2002 Password Recovery Sequence copy start run At Router# –Type copy start run –This copies the start-up config, which holds all the passwords, interface configs, routing info, ACLs, etc. –The router should now regain functionality –Now ready to change passwords

17. Copyright, University of Tulsa, 2002 Password Recovery Sequence Enable mode At router# –Type config terminal (config t) –Now in global mode –Router(config)# –Global mode means any commands issued affect the router as a whole, not a specific aspect of the router

18. Copyright, University of Tulsa, 2002 Password Recovery Sequence Change Passwords At Router(config)# –Type enable secret (password) –This changes the EXEC privilege password

19. Copyright, University of Tulsa, 2002 Password Recovery Sequence Change Passwords The router will generally have two more passwords: User EXEC & VTY To change the User EXEC for the console –From the current prompt type: –line con 0 (the console port) –Router (config-line)# –Type password (password)

20. Copyright, University of Tulsa, 2002 Password Recovery Sequence Change Passwords To change the VTY User EXEC: –Type line vty 0 4 –vty 0 4 refers to the 5 telnet connections the router will accept –Router (config-line)# –Type password (password) –The router can have different passwords for the console and VTY User EXEC modes –When you exit your session, and then try to start a new session your new passwords will be in effect, but they are not saved in the NVRAM start-up config. So….

21. Copyright, University of Tulsa, 2002 Password Recovery Sequence copy run start At Router (config-line)# –Type Ctrl +Z to return to privilege mode –Type copy run start –This copies the running config, which holds the new passwords, to the start-up config in NVRAM. –Now if the router should be reloaded your new passwords will be in the start-up config. –There is one problem…if the router reloads now, it will load back to rommon> mode.

22. Copyright, University of Tulsa, 2002 Password Recovery Sequence Change Registers Back Now change your registers back to the original setting of 0x2102. At Router# –Type config t to return to global config mode –Type config-reg 0x2102 –The 02 tells the router to load the config file from NVRAM and load IOS from FLASH –Type Ctrl + Z, then exit to exit your session.

23. Copyright, University of Tulsa, 2002 QUESTIONS ?????????? ?????????? ??????????