Cisco系列路由器密码恢复研究与实践

Cisco系列路由器密码恢复研究与实践密码恢复原理（1）Cisco路由器保存了几种不同的配置参数,并存放在不同的内存模块中。Cisco系列路由器的内存有：ROM，闪存（Flash memory）,RAM，不可变RAM和动态内存（DRAM）等5种（其功能见表1）。一般情况下，路由器启动时，首先运行ROM中的程序，进行系统自检及引导，然后运行Flash中的ISO，并在NVRAM中寻找路由器配置，并装入DRAM中。（2）口令恢复的关键在于对配置登记码(Configuration Register Value)（见表2）进行修改，从而让路由器从不同的内存中调用不同的参数表进行启动。有效口令存放在NVRAM中，因此修改口令的实质是先让登记码不起作用，从而可以进行直接启动，完成后再将登记码恢复（如忘记恢复，路由器重新启动后修改的配置可能会丢失）。内存作用ROM存放系统的引导程序，类似PC机的BIOS，是一种只读存储器，系统掉电程序不会丢失闪存存放Cisco IOS的镜像，类似PC机的硬盘，是一种可擦写、可编程的ROM，系统掉电数据不会丢失NVRAM存放配置文件（Startupconfig）RAM存放当前系统使用配置（Runningconfig）DRAM主要包含路由表、ARP缓存、Fastswitch缓存、数据包缓存等，也包含正在执行的配置文件，系统掉电该内存数据会丢失表2Cisco系列路由器配置登陆码Configuration Register Value含义0X2102缺省设置Bit13=0X2000Flash引导失败5次后，自动从ROM引导Bit8=0X0100关闭Break键Boot field=0X20X2101从Flash中引导正常运行模式Bit13=0X2000Flash引导失败5次后，自动从ROM引导Bit8=0X0100关闭Break键Boot field=0X10X142进入boot ROM运行模式Router（boot）Bit8=0X0040进入boot monitor运行模式或rommonBoot field=0X2从Flash中引导正常运行模式准备工作厂商在设计路由器产品的时候就预留了一个Console（控制台），它是对路由器进行配置时的一个重要接口，也是密码恢复的第一步工作：利用DB25转接口和交叉线，将终端或装有超级终端软件的PC接到路由器的Console口上。终端参数设置如下：速度：9 600 bps；数据位：8；奇偶校验位：无；停止位：1；流控：无。如图1所示。3800系列路由器（以801为例）具体操作方法（1）在启动的60 s内按下中断键Ctrl+Break,如果Break被屏蔽了可以使用循环开机的方法，使设备进入rom monitor状态，提示符号为“”。（2）在rom monitor中输入set命令：记下当前的ios-conf值，这里是0x2102。Boot# setSet prompt=“boot”Set ios-conf=0X2102（3）输入set ios-conf 142，如下：boot# set ios-conf 142。（4）输入boot引导系统，如果设备在重启过程中要求进行初始化配置，一路回答“No”，如下所示：Boot# boot8kbytes of nonvolatile configurationmemory8Mbytes of flash on board (4M from flash card)system configuration dialogwould you like to enter the initial configurationdialog?yes/no:npress reture to get started!(press enter)（5）输入回车，enable,再回车，进入enable状态，命令序列如下：RouterenRouter#（6）输入config mem,调入原配置文件，并进入配置模式（注意：不要conf t）,命令序列如下：Router# conf mem801(config)#（7）恢复原始配置寄存器值并激活所有端口：801#configure terminal801(config)#configregister0X2102801(config)#interface xx801(config)#no shutdow（8）查询并记录丢失的口令：801#show configuration (show startupconfig)（9）修改口令：801#configure terminal801(config)line console 0801(configline)#login801(configline)#password xxxxxxxxx801(configline)#801(configline)#write memory (copy runningconfig startupconfig)4Cisco2500系列路由器（以2509为例）具体操作方法（1）在启动的60 s内按下中断键Ctrl+Break,如果Break被屏蔽了可以使用循环开机的方法，使设备进入rom monitor状态。（2）在rom monitor中输入o命令：oconfiguration register=0X2102 at last boot记下当前的Configuration register值，这里是0x2102，通常为0x2102或0x102。如果用命令不能获得有关提示，可以查看类似的路由器来获得配置寄存器的值或用0x2102试试。（3）输入“o/r 0x0142”，更新Configuration register值，使路由器启动时跳过配置文件直接启动，以便原来的密码不起作用，具体操作如下：o/r 0x0142（4）重新启动路由器：Irommon 2reset（5）在“Setup”模式，对所有问题回答“No”（6）进入特权模式：routerenable（7）下载NVRAMRouterconfigure memory（8）恢复原始配置寄存器值并激活所有端口：2509#configure terminal2509(config)#configregister 0X21022509(config)#interface xx2509(config)#no shutdown（9）查询并记录丢失的口令：2509#show configuration (show startupconfig)（10）修改口令：2509#configure terminal2509(config)line console 02509(configline)#login2509(configline)#password xxxxxxx2509(configline)#2509(configline)#write memory (copyrunningconfigstartupconfig)5Cisco2600系列路由器（以2611为例）具体操作方法（1）将路由器的口和计算机串口相连，启动计算机超级终端，开启路由器电源，在开机60s内按使路由器进入状态，提示符：rommon1（2）在Rommon中输入：conf reg 0x42,如下所示：Rommon 1conf reg 0x42(3)输入reset，命令如下：Rommon 2reset(4)当提示是否进入对话配置时回答“no”（如误输入“yes”,立刻按Ctrl+c退出，出现“press return to get started！”按回车，进入rom模式router。(5)键入enable命令进入exec状态，键入router#show config查看原路由器配置和未加密码口令，建议立刻做一文本备份文件，以免误操作将原路由器配置丢失。(6)下载NVRAM，将NVRAM模式中的参数表装入内存：Router# configuration memory(7)更改完毕一定要写入NVRAM中，否则路由器原配置会丢失以及改写口令无效：Router# write memory(8)将第3步查到的登记码还原，一般为0x2102（即从闪存正常启动，并屏蔽中断），并激活所有端口（系统会将所有端口自动shutdown）：Router#configregister 0x2102Router?(config)#interface xxRouter(configif)#no shutdownRouter(configif)#ctrl-z(9)重新启动路由器：Router# reload。63600系列路由器（以3640为例）具体操作方法3640的密码恢复和26系列基本相似，都是进入监控模式，运行conf reg命令，启动时忽略配置文件，进行直接启动。此方法同样适用于4500、7500、12000系列路由器。7Cisco系列路由器进入rom状态的几种方法对于Cisco的各种路由器进入rom状态的方法不尽相同，但一般通过如下3种方法可以进入rom状态，在使用过程中可以分别试用。（1）如果Break未被屏蔽，可以在开机60 s内按Ctrl+Break键中断启动过程，进入rom状态。（2）如果Break键已经屏蔽，可以通过循环开机的方法进入rom状态，方法是：路由器开机后，将电源关闭，间隔5 s后重新开机，一般会进入rom状态。此方法适用于7500、12000等路由器。（3）将超级终端通信波特率设置为1200，数据位8，奇偶位1，停止位无。开启路由器电源，启动后关机，5 s后重新开机，同时一直按住空格键12 s后放开，等路由器启动完成后，重新更改超级终端位默认值，通信波特率设置为9600，数据位8，奇偶位1，停止位1。重新连接后，从终端上可以看到已经进入rom状态。注意：在波特率为1200时，终端上没有内容显示。此方法适用于2500、2600、4500等系列路由器。结束语作为3层设备，路由器是一种技术含量很高的网络设备，涉及到各种协议，技术面较广。熟练运用各种路由器，及时处理各种突发故障，对维护网路的正常运转有着重要意义。本文仅就Cisco各系列路由器中的典型型号的密码恢复方法进行介绍，但对于解决Cisco各系列路由器的类似问题，其具体操作也类似。CISCO 7200密码忘记的恢复方法Routerenable Password: Password: Password: % Bad secrets Routershow version Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-IS-M), Version 12.0(7)T, RELEASE SOFTWARE (fc2) Copyright (c) 1986-1999 by cisco Systems, Inc. Compiled Tue 07-Dec-99 02:21 by phanguye Image text-base: 0x80008088, data-base: 0x80C524F8 ROM: System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1) Router uptime is 3 minutes System returned to ROM by abort at PC 0x802D0B60 System image file is flash:c2600-is-mz.120-7.T cisco 2611 (MPC860) processor (revision 0x202) with 26624K/6144K bytes of memory. Processor board ID JAB031202NK (3878188963) 60 processor: part number 0, mask 49 Bridging software. X.25 software, Version 3.0.0. Basic Rate ISDN software, Version 1.1. 2 Ethernet/IEEE 802.3 interface(s) 2 Serial(sync/async) network interface(s) 1 ISDN Basic Rate interface(s) 32K bytes of non-volatile configuration memory. 8192K bytes of processor board System flash partition 1 (Read/Write) 8192K bytes of processor board System flash partition 2 (Read/Write) Configuration register is 0x2102 Router !- The router was just powercycled and during bootup a !- break sequence was sent to the router. ! * System received an abort due to Break Key * signal= 0x3, code= 0x500, context= 0x813ac158 PC = 0x802d0b60, Vector = 0x500, SP = 0x80006030 rommon 1 confreg 0x2142 You must reset or power cycle for new config to take effect rommon 2 reset System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1) Copyright (c) 1999 by cisco Systems, Inc. TAC:Home:SW:IOS:Specials for info C2600 platform with 32768 Kbytes of main memory program load complete, entry point: 0x80008000, size: 0x6fdb4c Self decompressing the image : # # # # # OK Restricted Rights Legend Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013. cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134-1706 Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-IS-M), Version 12.0(7)T, RELEASE SOFTWARE (fc2) Copyright (c) 1986-1999 by cisco Systems, Inc. Compiled Tue 07-Dec-99 02:21 by phanguye Image text-base: 0x80008088, data-base: 0x80C524F8 cisco 2611 (MPC860) processor (revision 0x202) with 26624K/6144K bytes of memory. Processor board ID JAB031202NK (3878188963) M860 processor: part number 0, mask 49 Bridging software. X.25 software, Version 3.0.0. Basic Rate ISDN software, Version 1.1. 2 Ethernet/IEEE 802.3 interface(s) 2 Serial(sync/async) network interface(s) 1 ISDN Basic Rate interface(s) 32K bytes of non-volatile configuration memory. 8192K bytes of processor board System flash partition 1 (Read/Write) 8192K bytes of processor board System flash partition 2 (Read/Write) - System Configuration Dialog - Would you like to enter the initial configuration dialog? yes/no: n Press RETURN to get started! 00:19: %LINK-3-UPDOWN: Interface BRI0/0, changed state to up 00:00:19: %LINK-3-UPDOWN: Interface Ethernet0/0, changed state to up 00:00:19: %LINK-3-UPDOWN: Interface Ethernet0/1, changed state to up 00:00:19: %LINK-3-UPDOWN: Interface Serial0/0, changed state to down 00:00:19: %LINK-3-UPDOWN: Interface Serial0/1, changed state to down 00:00:20: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0/0, changed state to down 00:00:20: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up Router 00:00:20: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/1, changed state to up 00:00:20: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to down 00:00:20: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1, changed state to down 00:00:50: %SYS-5-RESTART: System restarted - Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-IS-M), Version 12.0(7)T, RELEASE SOFTWARE (fc2) Copyright (c) 1986-1999 by cisco Systems, Inc. Compiled Tue 07-Dec-99 02:21 by phanguye 00:00:50: %LINK-5-CHANGED: Interface BRI0/0, changed state to administratively down 00:00:52: %LINK-5-CHANGED: Interface Ethernet0/0, changed state to administratively down 00:00:52: %LINK-5-CHANGED: Interface Serial0/0, changed state to administratively down 00:00:52: %LINK-5-CHANGED: Interface Ethernet0/1, changed state to administratively down 00:00:52: %LINK-5-CHANGED: terface Serial0/1, changed state to administratively down 00:00:53: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to down 00:00:53: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/1, changed state to down Router Routerenable Router#copy startup-config running-config Destination filename running-config? 1324 bytes copied in 2.35 secs (662 bytes/sec) Router# 00:01:24: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0/0:1, changed state to down 00:01:24: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0/0:2, changed state to down Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#enable secret cisco Router(config)#Z 00:01:54: %SYS-5-CONFIG_I: Configured from console by console Router#show ip interface brief Interface IP-Address OK? Method Status Protocol Ethernet0/0 7 YES TFTP administratively down down Serial0/0 unassigned YES TFTP administratively down down BRI0/0 57 YES unset administratively down down BRI0/0:1 unassigned YES unset administratively down down BRI0/0:2 unassigned YES unset administratively down down Ethernet0/1 unassigned YES FTP administratively down down Serial0/1 unassigned YES TFTP administratively down down Loopback0 57 YES TFTP up up Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#interface Ethernet0/0 Router(config-if)#no shutdown Router(config-if)# 00:02:14: %LINK-3-UPDOWN: Interface Ethernet0/0, changed state to up 00:02:15: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up Router(config-if)#interface BRI0/0 Router(config-if)#no shutdown Router(config-if)# 00:02:26: %LINK-3-UPDOWN: Interface BRI0/0:1, changed state to down 00:02:26: %LINK-3-UPDOWN: Interface BRI0/0:2, changed state to down 00:02:26: %LINK-3-UPDOWN: Interface BRI0/0, changed state to up 00:02:115964116991: %ISDN-6-LAYER2UP: Layer 2 for Interface BR0/0, TEI 68 changed to up Router(config-if)#Z Router# 00:02:35: %SYS-5-CONFIG_I: Configured from console by console Router#copy running-config startup-config Destination filename startup-config? Building configuration. OK Router#show version Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-IS-M), Version 12.0(7)T, RELEASE SOFTWARE (fc2) Copyright (c) 1986-1999 by cisco Systems, Inc. Compiled Tue 07-Dec-99 02:21 by phanguye Image text-base: 80008088, data-base: 0x80C524F8 ROM: System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1) Router uptime is 3 minutes System returned to ROM by abort at PC 0x802D0B60 System image file is flash:c2600-is-mz.120-7.T cisco 2611 (MPC860) processor (revision 0x202) with 26624K/6144K bytes of memory. Processor board ID JAB031202NK (3878188963) M860 processor: part number 0, mask 49 Bridging software. X.25 software, Version 3.0.0. Basic Rate ISDN software, Version 1.1. 2 Ethernet/IEEE 802.3 interface(s) 2 Serial(sync/async) network interface(s) 1 ISDN Basic Rate interface(s) 32K bytes of non-volatile configuration memory. 8192K bytes of processor board System flash partition 1 (Read/Write) 8192K bytes of processor board System flash partition 2 (Read/Write) Configuration register is 0x2142 Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#config-register 0x2102 Router(config)#Z 00:03:20: %SYS-5-CONFIG_I: Configured from console by console Router#show version Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-IS-M), Version 12.0(7)T, RELEASE SOFTWARE (fc2) Copyright (c) 1986-1999 by cisco Systems, Inc. Compiled Tue 07-Dec-99 02:21 by phanguye Image text-base: 0x80008088, data-base: 0x80C524F8 ROM: System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1) Router uptime is 3 minutes Syem returned to ROM by abort at PC 0x802D0B60 System image file is flash:c2600-is-mz.120-7.T cisco 2611 (MPC860) processor (revision 0x202) with 26624K/6144K bytes of memory. Processor board ID JAB031202NK (3878188963) M860 processor: part number 0, mask 49 Bridging software. X.25 software, Version 3.0.0. Basic Rate ISDN software, Version 1.1. 2 Ethernet/IEEE 802.3 interface(s) 2 Serial(sync/async) network interface(s) 1 ISDN Basic Rate interface(s) 32K bytes of non-volatile configuration memory. 8192K bytes of processor board System flash partition 1 (Read/Write) 8192K bytes of processor board System flash partition 2 (Read/Write) Configuration register is 0x2142 (will be 0x2102 at next reload) Router#Cisco常见路由器密码和版本恢复方法探讨摘要：本文对CISCO公司的一些常见路由器的密码恢复进行了探讨和总结，同时描述了对路由器版本的灾难性恢复的一些方法。关键字：路由器，密码，版本。随着互联网规模的不断扩大，网络与我们的生活已经越来越近，许多政府，学校和公司都组建了自己的信息网络，这使得路由器这一网络设备的使用越来越广泛。在使用路由器的过程中经常会出现忘记密码的事情，使维护人员无法登录，影响工作的进一步开展。同时，在操作过程中有时会因为一些意想不到的原因，将路由器内部的版本映象文件损坏，使路由器无法正常工作，路由器退回到监控状态，使用常用的版本拷贝命令无法更新版本。这两个问题都是较常见，但又是初学者感到比较棘手的问题。对于版本的获得一般可以通过网站下载，或与供应商联系提供，也可以在路由器正常工作时利用常规命令将版本备份到服务器上，以备应急之用。CISCO 路由器品种较多，各种路由器的密码恢复和版本的灾难恢复情况又不同，现分别叙述。一 2500系列路由器（以2509为例）1 密码恢复1.1 利用DB25转换接口，和交叉线将2509路由器的CONSOLE口和计算机串口相连，启动计算机超级终端，设置其参数为波特率9600，数据位8，奇偶校验为无，停止位为1，流控选择无。开启路由器电源，在开机60秒内按ctlr+break 使路由器进入rom monitor 状态，提示符 1.2 查看configure register 值，并将该值记下。e/s2000002返回值正常时一般为21021.3 更新configure-register 值使路由器启动时跳过配置文件，直接启动，以便使原来的密码不起作用。o/r0x01421.4 重新启动路由器i1.5 启动后进入特权模式，执行如下命令使原来的配置信息有效。router(config)#config mem 1.6 此时可以按照正常操作查看原来的密码，或修改为新的密码。1.7 将configure-register 值复原，并重新启动路由器。此时即可恢复正常。Router(config)#configure-register 0x2102Router(config)#wriRouter(config)#reload2版本灾难性恢复与其他路由器不同的是2509在rom内部有一个引导监控模式，内含一个小的映象版本，当flash中版本损坏时，可以用于正式版本下载。2.1在计算机串口和2509CONSLOE 口相连的同时，还必须准备一个AUI 与RJ45的转换接口，以便可以使用交叉线将AUI口与计算机网口相连。2.2在引导监控模式下，进入特权模式，配置以太口的接口地址和掩码，使其与计算机网口地址在同一子网，（假定计算机地址位06 路由器以太口地址位07 ）router(boot)#config trouter(boot)(config)#int ethernet 0router(boot)(config-if)#ip address 07 2.3验证网络互通性router(boot)#ping 062.4 计算机上启动tftp服务器，将需要下载的版本放在服务器的指定目录下。2.5 在超级终端上执行如下命令：router(boot)#copy tftp flash将新的版本下载到路由器的flash中，2.6重新启动路由器，运行新的正常版本router(boot)#reload二 2600系列（以2621 为例）1密码恢复1.1将路由器的CONSOLE口和计算机串口相连，启动计算机超级终端，开启路由器电源，在开机60秒内按ctlr+break 使路由器进入rom monitor 状态，提示符rommon11.2重新配置组态寄存器rommon1confreg 当出现 do you wish to change the configuration (y/n) 时 选择y 接下来的选项选择n当出现 enable”ignore system configuration information”(y/n) 选择y接下来的选项选择n1.3 重新启动路由器rommon1reset1.4 启动后进入特权模式，执行如下命令使原来的配置信息有效。router(config)#config mem 1.5可以进一步查看密码或更改密码2版本的灾难性恢复。2621 提供了两种灾难性恢复版本的方法，tftpdnld 和 xmodem 方式。2.1 tftpdnld方式2.1.1将计算机串口和路