［求助］如何破解Cisco2600的密码？

kenzheng

我有一台Cisco2610路由器（声明：这可是我自己的，没有做坏事的意思），可是我没有密码进入，按网上的一些方法偿试破解但没有成功。下面是一些启动信息以供参考：

System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1)
Copyright (c) 1999 by cisco Systems, Inc.
TAC:Home:SW:IOS:Specials for info
C2600 platform with 32768 Kbytes of main memory

program load complete, entry point: 0x80008000, size: 0x34362c
Self decompressing the image : ###############################################################################################################ok
Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706



Cisco Internetwork Operating System Software
IOS (tm) C2600 Software (C2600-I-M), Version 12.0(10), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2000 by cisco Systems, Inc.
Compiled Mon 20-Mar-00 23:30 by phanguye
Image text-base: 0x80008088, data-base: 0x80600628


cisco 2610 (MPC860) processor (revision 0x203) with 26624K/6144K bytes of memory
.
Processor board ID JAD050698ZN (495243398)
M860 processor: part number 0, mask 49
Bridging software.
X.25 software, Version 3.0.0.
1 Ethernet/IEEE 802.3 interface(s)
1 Serial network interface(s)
32K bytes of non-volatile configuration memory.
8192K bytes of processor board System flash (Read/Write)

Press RETURN to get started!


00:00:08: %LIN0 - DLCI 610 state changed to DELETED
00:00:09: %SYS-5-RESTART: System restarted --
Cisco Internetwork Operating System Software
IOS (tm) C2600 Software (C2600-I-M), Version 12.0(10), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2000 by cisco Systems, Inc.
Compiled Mon 20-Mar-00 23:30 by phanguye
00:00:10: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed s
tate to down
00:00:10: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed sta
te to down
00:00:11: %LINK-3-UPDOWN: Interface Ethernet0/0, changed state to up

不知在那个步骤进入修改？请各位指教！！

yangsq

　　密码都没有，算是你的吗？
　　我也有一台Cisco2600，唉！这样吧，把我的给你。不是说机器，是说密码。十元要不要？不要？那就算是友情奉送了吧！用户名：Cisco密码Cisco。记得谢我噢！

kenzheng

最初由 yangsq 发布
[B]　　密码都没有，算是你的吗？
　　我也有一台Cisco2600，唉！这样吧，把我的给你。不是说机器，是说密码。十元要不要？不要？那就算是友情奉送了吧！用户名：Cisco密码Cisco。记得谢我噢！ [/B]

昏到！楼主真会说笑！;02

歪歪

Step-by-Step Procedure
Attach a terminal or PC with terminal emulation to the console port of the router. Use the following terminal settings:
9600 baud rate
No parity
8 data bits
1 stop bit
No flow control

The required console cable specifications are described in the Cabling Guide for RJ-45 Console and AUX Ports (Cisco's 1000 series, 2500 series, and AS5100).

Type show version and record the setting of the configuration register. Click here to see output of a show version command.
The configuration register setting is usually 0x2102 or 0x102.

Using the switch, turn off the router and then turn it on.
Press Break on the terminal keyboard within 60 seconds of the powerup to put the router into ROMMON.
If the break sequence doesn't work, see Possible Key Combinations for Break Sequence During Password Recovery for other key combinations.

Type confreg 0x2142 at the rommon 1> prompt to boot from Flash without loading the configuration.
Type reset at the rommon 2> prompt.
The router reboots but ignores its saved configuration.

Type no after each setup question or press Ctrl-C to skip the initial setup procedure.
Type enable at the Router> prompt.
You'll be in enable mode and see the Router# prompt.

Important Type config mem or copy start running to copy the nonvolatile RAM (NVRAM) into memory. Do not type config term.
Type wr term or show running.
The show running and wr term commands show the configuration of the router. In this configuration you see under all the interfaces the shutdown command, which means all interfaces are currently shutdown. Also, you can see the passwords either in encrypted or unencrypted format.

Type config term and make the changes.
The prompt is now hostname(config)#.

Type enable secret <password>.
Issue the no shutdown command on every interface that is used. If you issue a show ip interface brief command, every interface that you want to use should be "up up".
Type config-register 0x2102, or the value you recorded in step 2.
Press Ctrl-z to leave the configuration mode.
The prompt is now hostname#.

Type write mem or copy running startup to commit the changes.

歪歪

前面的是英文的，说个简单的:D
console线连好，进入超级终端（别告诉我这个不会，不会就不要看下去了）
开2600
按Pause键到rommon>模式
输入confreg 0x2142
输入reset重起
这个时候应该是没有密码的
enable进入全局模式
按write保存
重起继续按pause进入rommon>
输入confreg 0x2102
reset重起就搞定

yangsq

学习，记下了。这次不会再弄丢了。

kenzheng

下面在网上搜到的资料：

常规恢复法

当Cisco路由器的口令被错误修改或忘记时，可以按如下步骤进行操作：

1.开机时按Ctrl+Break使进入ROM状态

2.按o 命令读取配置寄存器的原始值

> o　　

3.作如下设置，使忽略NVRAM引导

>o/r0x**4* 　　　　　　　　　　　　 Cisco2500系列命令

rommon 1 >confreg 0x**4*　　 　　　 Cisco2600、1600系列命令

一般正常值为0x2102

4.重新启动路由器

>I　　 　　　　　　

rommon 2 >reset

5.在“Setup”模式，对所有问题回答No

6.进入特权模式

Router>enable

7.下载NVRAM

Router>configure memory

8.恢复原始配置寄存器值并激活所有端口

“hostname”#configure terminal

“hostname”(config)#config-register 0x“value”

“hostname”(config)#interface xx

“hostname”(config)#no shutdown

9.查询并记录丢失的口令

“hostname”#show configuration (show startup-config)

10.修改口令

“hostname”#configure terminal

“hostname”(config)line console 0

“hostname”(config-line)#login

“hostname”(config-line)#password xxxxxxxxx

“hostname”(config-line)#

“hostname”(config-line)#write memory(copy running-config startup-config)

歪歪

那你还问，多此.....

yangsq

最初由 歪歪 发布
[B]那你还问，多此..... [/B]

在我的印象当中应该没这么复杂，和歪歪讲的一样。