Saturday, June 1, 2019

Cisco 2900 Router Password Recovery

I previously posted a quick procedure for password recovery on a Cisco 2900 router via ejecting the compact flash (CF) card. This post is about the common password recovery procedure via the ROMMON mode.


System Bootstrap, Version 15.0(1r)M16, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 2012 by cisco Systems, Inc.

Total memory size = 512 MB - On-board = 512 MB, DIMM0 = 0 MB
CISCO2901/K9 platform with 524288 Kbytes of main memory
Main memory is configured to 72/-1(On-board/DIMM0) bit mode with ECC enabled


Readonly ROMMON initialized
program load complete, entry point: 0x80803000, size: 0x1b340
program load complete, entry point: 0x80803000, size: 0x1b340


monitor: command "b    // CTRL + BREAK (CTRL + Fn + b FOR DELL LAPTOP)
monitor: command "boot" aborted due to user interrupt
rommon 1 > confreg 0x2142     // BYPASS STARTUP-CONFIG


You must reset or power cycle for new config to take effect
rommon 2 > reset

System Bootstrap, Version 15.0(1r)M16, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 2012 by cisco Systems, Inc.

Total memory size = 512 MB - On-board = 512 MB, DIMM0 = 0 MB
CISCO2901/K9 platform with 524288 Kbytes of main memory
Main memory is configured to 72/-1(On-board/DIMM0) bit mode with ECC enabled


Readonly ROMMON initialized
program load complete, entry point: 0x80803000, size: 0x1b340
program load complete, entry point: 0x80803000, size: 0x1b340


IOS Image Load Test
___________________
Digitally Signed Release Software
program load complete, entry point: 0x81000000, size: 0x470d00c
Self decompressing the image : ############################################################################################################################################################################################################################################################################################################################################################################################################################################################### [OK]

Smart Init is enabled
smart init is sizing iomem
                 TYPE      MEMORY_REQ
          HWIC Slot 0      0x00200000
               PVDM 0      0x00200000
    Onboard devices &
         buffer pools      0x0228F000
-----------------------------------------------
               TOTAL:      0x0268F000

Rounded IOMEM up to: 40Mb.
Using 7 percent iomem. [40Mb/512Mb]

              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706



Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Tue 20-Mar-12 18:57 by prod_rel_team


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Installed image archive
Cisco CISCO2901/K9 (revision 1.0) with 483328K/40960K bytes of memory.
Processor board ID FCZ17039ABC
2 Gigabit Ethernet interfaces
2 Serial(sync/async) interfaces
1 terminal line
1 Virtual Private Network (VPN) Module
DRAM configuration is 64 bits wide with parity enabled.
255K bytes of non-volatile configuration memory.
250880K bytes of ATA System CompactFlash 0 (Read/Write)


         --- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]: no


Router>enable
Router#
Oct  3 02:08:13.607: %DSPRM-5-UPDOWN: DSP 1 in slot 0, changed state to upconf
Router#copy startup-config running-config      // DUMP THE STARTUP-CONFIG
Destination filename [running-config]?
2180 bytes copied in 0.164 secs (13293 bytes/sec)

2901#configure terminal     // RE-CONFIGURE ALL PASSWORDS
Enter configuration commands, one per line.  End with CNTL/Z.
2901(config)#enable secret cisco 
2901(config)#username admin privilege 15 secret cisco
2901(config)#line console 0
2901(config-line)#password cisco
2901(config-line)#login
2901(config-line)#
2901(config-line)#line vty 0 15
2901(config-line)#password cisco
2901(config-line)#login
2901(config-line)#exit
2901(config)#config-register 0x2102     // REVERT TO ORGINAL CONFIG REGISTER
2901(config)#end
2901#
Oct  3 02:09:44.595: %SYS-5-CONFIG_I: Configured from console by console
2901#write memory
Building configuration...

[OK]
2901#reload
Proceed with reload? [confirm]

Oct  3 02:10:59.883: %SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload Command.
System Bootstrap, Version 15.0(1r)M16, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 2012 by cisco Systems, Inc.

Total memory size = 512 MB - On-board = 512 MB, DIMM0 = 0 MB
CISCO2901/K9 platform with 524288 Kbytes of main memory
Main memory is configured to 72/-1(On-board/DIMM0) bit mode with ECC enabled


Readonly ROMMON initialized
program load complete, entry point: 0x80803000, size: 0x1b340
program load complete, entry point: 0x80803000, size: 0x1b340


IOS Image Load Test
___________________
Digitally Signed Release Software
program load complete, entry point: 0x81000000, size: 0x470d00c
Self decompressing the image : ############################################################################################################################################################################################################################################################################################################################################################################################################################################################### [OK]


<OUTPUT TRUNCATED>


2901>enable
Password: <cisco>
2901#

No comments:

Post a Comment