cisco路由器密碼全攻略勝一籌

1、首先在試驗(yàn)之前我們要理解路由器的工作原理：路由器在開機(jī)時(shí)首先會(huì)進(jìn)行POST，檢查硬件無故障后先讀取ROM里的BootStrap程序進(jìn)行初步引導(dǎo)。

2、初步引導(dǎo)完成后，嘗試定位并讀取完整的IOS鏡像文件。在這里，路由器將會(huì)首先在FLASH中查找IOS文件，如果找到了IOS文件的話，那么讀取IOS文件，引導(dǎo)路由器。

4. 如果在FLASH中沒有找到IOS文件的話，那么路由器將會(huì)進(jìn)入BOOT模式，在BOOT模式下可以使用TFTP上的IOS文件。或者使用TFTP/X-MODEM來給路由器的FLASH中傳一個(gè)IOS文件(一般我們把這個(gè)過程叫做灌IOS)。傳輸完畢后重新啟動(dòng)路由器，路由器就可以正常啟動(dòng)到CLI模式。

5. 當(dāng)路由器初始化完成IOS文件后，就會(huì)開始在NVRAM中查找STARTUP-CONFIG文件，STARTUP-CONFIG叫做啟動(dòng)配置文件。該文件里保存了我們對路由器所做的所有的配置和修改。當(dāng)路由器找到了這個(gè)文件后，路由器就會(huì)加載該文件里的所有配置，并且根據(jù)配置來學(xué)習(xí)、生成、維護(hù)路由表，并將所有的配置加載到RAM(路由器的內(nèi)存)里后，進(jìn)入用戶模式，最終完成啟動(dòng)過程。

6. 如果在NVRAM里沒有STARTUP-CONFIG文件，則路由器會(huì)進(jìn)入詢問配置模式，也就是俗稱的問答配置模式，在該模式下所有關(guān)于路由器的配置都可以以問答的形式進(jìn)行配置。

在上面第5步我們會(huì)有所發(fā)現(xiàn)，只要我們跳過加載startup-config文件，不就是可以不需要密碼進(jìn)入了？因?yàn)槲覀兯�有的配置文件running-config完成配置后都需要cp running-config startup-config將內(nèi)存的配置拷貝到NVRAM，這樣才會(huì)保證重新加電時(shí)配置丟失，這里我們可以通過修改寄存器的值來實(shí)現(xiàn)這一過程。

下面是實(shí)驗(yàn)過程：

a、在打開路由器開關(guān)時(shí)，按下ctrl+break鍵進(jìn)入ROM監(jiān)控模式

monitor: command "boot" aborted due to user interrupt

rommon 1 >

b、修改寄存器值ox2102為ox2142

rommon 1 > confreg 0x2142

c、重啟路由器

rommon 2 >

System Bootstrap, Version 12.2(7r)XM2, RELEASE SOFTWARE (fc1)

TAC Support: http://www.cisco.com/tac

Copyright (c) 2003 by cisco Systems,

C1700 platform with 65536 Kbytes of main memory

monitor: command "boot" aborted due to user interrupt

rommon 1 > confreg 0x2142

rommon 2 > reset

?

System Bootstrap, Version 12.2(7r)XM2, RELEASE SOFTWARE (fc1)

TAC Support: http://www.cisco.com/tac

Copyright (c) 2003 by cisco Systems, Inc.

C1700 platform with 65536 Kbytes of main memory

program load complete, entry point: 0x80008000, size: 0x553334

Self decompressing the image : #################################################

################################################### [OK]

Smart Init is enabled

smart init is sizing iomem

ID MEMORY_REQ TYPE

MainBoard 0X00027A80 1721

0X000F3BB0 public buffer pools

0X00211000 public particle pools

0X0039 0X0000DC00 Card in slot 0

0X0012 0X0001B800 Card in slot 1

TOTAL: 0X00355A30

If any of the above Memory Requirements are

"UNKNOWN", you may be using an unsupported

configuration or there is a software problem

system operation may be compromised.

Allocating additional 8035419 bytes to IO Memory.

PMem allocated: 55576949 bytes; IOMem allocated: 11531915 bytes

Restricted Rights Legend

Use, duplication, or disclosure by the Government is

subject to restrictions as set forth in subparagraph

(c) of the Commercial Computer Software - Restricted

Rights clause at FAR sec. 52.227-19 and subparagraph

(c) (1) (ii) of the Rights in Technical Data and Computer

Software clause at DFARS sec. 252.227-7013.

cisco Systems, Inc.

170 West Tasman Drive

San Jose, California 95134-1706

Cisco Internetwork Operating System Software

IOS (tm) C1700 Software (C1700-Y-M), Version 12.3(5b), RELEASE SOFTWARE (fc1)

Copyright (c) 1986-2004 by cisco Systems, Inc.

Compiled Fri 16-Jan-04 05:16 by kellythw

Image text-base: 0x80008120, data-base: 0x809FA874

cisco 1721 (MPC860P) processor (revision 0x300) with 54274K/11262K bytes of memo

ry.

Processor board ID FOC080503Y4 (2190598144), with hardware revision 0000

MPC860P processor: part number 5, mask 2

Bridging software.

X.25 software, Version 3.0.0.

1 Ethernet/IEEE 802.3 interface(s)

1 FastEthernet/IEEE 802.3 interface(s)

2 Serial(sync/async) network interface(s)

32K bytes of non-volatile configuration memory.

32768K bytes of processor board System flash (Read/Write)

--- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]:

d、選擇no，進(jìn)入用戶模式，enable進(jìn)入特權(quán)模式，將startup-config文件復(fù)制到running-config文件中

Router>

Router>en

Router#copy start run

Destination filename [running-config]?

592 bytes copied in 0.620 secs (955 bytes/sec)

Router#

e、修改控制臺(tái)口令和特權(quán)模式口令

Router#config t

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#li

Router(config)#line co

Router(config)#line console 0

Router(config-line)#login

Router(config-line)#pass

Router(config-line)#password 123

Router(config)#ena

Router(config)#enable pa

Router(config)#enable password 123

f、修改后保存配置文件

Router#copy run start

Destination filename [startup-config]?

Building configuration...

[OK]

Router#