{"id":642,"date":"2010-08-07T12:20:44","date_gmt":"2010-08-07T12:20:44","guid":{"rendered":"http:\/\/wiki.freeiz.com\/?p=642"},"modified":"2016-08-09T12:02:40","modified_gmt":"2016-08-09T12:02:40","slug":"cisco-password-recovery","status":"publish","type":"post","link":"https:\/\/wiki-see.info\/wp\/2010\/08\/07\/cisco-password-recovery\/","title":{"rendered":"Cisco Password Recovery"},"content":{"rendered":"<p><span style=\"color: #800000;\">There are times when you need to recover Cisco Router password.<br \/>\n<strong>This  tutorial shows how to do it in few simple and detailed steps<\/strong><\/span> <span style=\"color: #800000;\">.<\/span><\/p>\n<p><span style=\"color: #800000;\">Depending  on the router model, the configuration might be slightly different,<br \/>\nbut  the concept remains same (check Summarized Steps)<\/span><\/p>\n<p><span style=\"color: #800000;\">Although it is possible to bypass router password feature, <strong>but it is  not possible to recover encrypted<br \/>\npasswords. Plain text passwords can be  viewed from saved configuration but the encrypted passwords<br \/>\nmust be  changed to a new password<\/strong><\/span><\/p>\n<h2><span style=\"color: #000000;\">Summarized Steps<\/span><\/h2>\n<ol>\n<li><span style=\"color: #000000;\">Connect to router console port using terminal or PC using terminal emulation with appropriate settings.<\/span><\/li>\n<li><span style=\"color: #000000;\">(Optional) Find configuration register<\/span><\/li>\n<li><span style=\"color: #000000;\">Enter ROMMON mode<\/span><\/li>\n<li><span style=\"color: #000000;\">Change the configuration register<\/span><\/li>\n<li><span style=\"color: #000000;\">Recover or change passwords<\/span><\/li>\n<li><span style=\"color: #000000;\">Change back the configuration register<\/span><\/li>\n<\/ol>\n<h2><span style=\"color: #000000;\">Connect to Router<\/span><\/h2>\n<p><span style=\"color: #000000;\">Attach a PC with terminal emulation to the console port of the router using the following settings<\/span><\/p>\n<ul>\n<li><span style=\"color: #000000;\">9600 baud rate<\/span><\/li>\n<li><span style=\"color: #000000;\">No parity<\/span><\/li>\n<li><span style=\"color: #000000;\">8 data bits<\/span><\/li>\n<li><span style=\"color: #000000;\">1 stop bit<\/span><\/li>\n<li><span style=\"color: #000000;\">No flow control<\/span><\/li>\n<\/ul>\n<p><span style=\"color: #000000;\">Make sure to use rollover cable for connection<\/span><\/p>\n<h2><span style=\"color: #000000;\">(Optional) Find configuration register<\/span><\/h2>\n<p><span style=\"color: #000000;\">Use the following command to check configuration register.<\/span><\/p>\n<div>\n<pre><span style=\"color: #000000;\">Router&gt;show version\n...\nDRAM configuration is 64 bits wide with parity enabled.\n55K bytes of NVRAM.\n16384K bytes of ATA System CompactFlash (Read\/Write)\n\nConfiguration register is 0x2102\n\nRouter&gt;<\/span><\/pre>\n<\/div>\n<p><span style=\"color: #000000;\">Configuration register is at the end of the output.<\/span><\/p>\n<h2><span style=\"color: #000000;\">Entering ROMMON mode<\/span><\/h2>\n<p><span style=\"color: #000000;\">Power cycle the router. Turn it off using power switch and turn the router back on.<br \/>\nWithin <strong><em>60 seconds<\/em><\/strong> press <em>Break<\/em> in terminal to enter ROMMON mode<br \/>\n<strong>Note :<\/strong><\/span> <span style=\"color: #000000;\"> The break sequence is different in every  terminal emulation software (usually it is Ctrl+Break),<br \/>\ncheck the  documentation for details.<\/span><\/p>\n<p><span style=\"color: #000000;\">Here are the few common standard break key combination<\/span><\/p>\n<p><span style=\"color: #000000;\">Hyperterminal : Ctrl + Break<br \/>\nPutty : Ctrl + Break<br \/>\nTelnet : Ctrl + ], then type \u201c<em>send brk\u201d<\/em><\/span><\/p>\n<h2><span style=\"color: #000000;\">Configuration Register<\/span><\/h2>\n<p><span style=\"color: #000000;\">By default the configuration register is set to 0\u00d72102. In order to  bypass the router password,<br \/>\nthe configuration register has to be changed  to 0\u00d72142.<br \/>\nUnder ROMMON mode enter the following command<\/span><\/p>\n<div>\n<pre><span style=\"color: #000000;\">rommon 1&gt;confreg 0x2142\nrommon 2&gt;reset<\/span><\/pre>\n<\/div>\n<p><span style=\"color: #000000;\">reset command will reboot the router<\/span><\/p>\n<h2><span style=\"color: #000000;\">Recovering passwords<\/span><\/h2>\n<p><span style=\"color: #000000;\">When the router reboots, it will not prompt for password because of  the configuration register.<br \/>\nThe router will be loaded from flash, so the  configuration (NVRAM) will be blank.<br \/>\n<strong>Important :<\/strong><\/span> <span style=\"color: #000000;\"> Do not type <em>\u201ccopy running-config startup-config\u201d<\/em>. This will overwrite the startup config with<br \/>\nblank configuration file.<\/span><\/p>\n<p><span style=\"color: #000000;\">Copy the configuration to the running-config<\/span><\/p>\n<div>\n<pre><span style=\"color: #000000;\">Router#copy startup-config running-config<\/span><\/pre>\n<\/div>\n<p><span style=\"color: #000000;\">Thats it. Now all you have to do is reassign the password if it is  encrypted, or recover from running-config<br \/>\nif it is unencrypted.<\/span><\/p>\n<h2><span style=\"color: #000000;\">Revert Configuration Register<\/span><\/h2>\n<p><span style=\"color: #000000;\">After everything is done, set the configuration register back to  0\u00d72102 (or whatever value was at the beginning<br \/>\nof password recovery  process)<\/span><\/p>\n<div>\n<pre><span style=\"color: #000000;\">Router(config)#config-register 0x2102<\/span><\/pre>\n<\/div>\n<p><span style=\"color: #000000;\">Save the configuration file to commit all the changes.<\/span><\/p>\n<p><strong>Extra Reading :<\/strong> <a href=\"..\/?p=1574\" target=\"_blank\">Disable Password Recovery<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>There are times when you need to recover Cisco Router password. This tutorial shows how to do it in few simple and detailed steps . Depending on the router model, the configuration might be slightly different, but the concept remains same (check Summarized Steps) Although it is possible to bypass router password feature, but it [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[188,536],"class_list":["post-642","post","type-post","status-publish","format-standard","hentry","category-cisco-routers","tag-cisco-password-recovery","tag-password-recovery"],"_links":{"self":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/642","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/comments?post=642"}],"version-history":[{"count":1,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/642\/revisions"}],"predecessor-version":[{"id":4761,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/642\/revisions\/4761"}],"wp:attachment":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/media?parent=642"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/categories?post=642"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/tags?post=642"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}