2022年2022年交换机密码破解 .pdf

《2022年2022年交换机密码破解 .pdf》由会员分享，可在线阅读，更多相关《2022年2022年交换机密码破解 .pdf（8页珍藏版）》请在淘文阁 - 分享文档赚钱的网站上搜索。

1、今天到客户那里进行了密码破解，虽然方法网络上已经都处都有，该文结合自己的心得，自己写一次，某些细节的地方也描述了，也方便自己加深印象。好好学习。呵呵1. 启用超级终端并出现连接界面(就是除了交换机符号外空白一片那个哦) 2. 拔掉交换机的电源. 3. 按下交换机上的Mode按钮 ,与此同时 ,重新插上交换机的电源线. 4. 当交换机左边的sys 灯会慢慢的闪动，( 细心的话会发现部分灯红色的闪过) ，按住 mode按钮直到sys 灯不闪动 (常亮状态 ). 否则提前松开的按钮的话会直接进入正常的启动，必须跳会步骤2 5. 可以松开Mode按钮之后系统将显示一些指示信息: The system

2、has been interrupted prior to initializing the flash file system. The following commands will initialize the flash file system, and finish loading the operating system software: flash_init/- 初始化 flash文件系统 -/ load_helper/-加载帮助文件-/ boot/- 启动设备进入正常的模式-/ 步骤 : switch: Switch:flash_initSwitch:dir flash:/-

3、 查看 Flash的文件名字可以用来确认文件名为config.text-/ Switch:rename flash:config.text flash:config.text.old/- 把配置文件重命名, 当然你可以不改为config.text.old,只要文件名和原来的不相同就可以-/ Switch:boot/-手动启动交换机-/ 由于配置文件改过了，所以交换机找不到默认的config.text而出现配置的对话向导，选择n 然后回车然后我们就会绕过原来的 password而进入到 : Switch Switchen/- 可以进入特权模式-/ Switch#rename flash:conf

4、ig.text.old flash:config.text/- 恢复交换机配置文件-/ Switch#copy flash:config.text system:running-config/-保存配置到DRAM 里-/ Switch#config t Switch(config)#no enable password/- 干掉特权模式旧密码-/Switch(config)#no enable secret/- 干掉加秘密码-/ Switch(config)#exitSwitch#copy run start/- 把当前配置的文件写回Flash-/ 用这个方法修改密码不会把原来的配置文件内容清

5、掉。特别是一个现成的大型网络里已经在运行的交换机，这样比较保险点。参考switch: flash_init Initializing Flash. .The flash is already initialized. switch: load_helper switch: dir flash: Directory of flash:/ 名师资料总结 - - -精品资料欢迎下载 - - - - - - - - - - - - - - - - - - 名师精心整理 - - - - - - - 第 1 页，共 8 页 - - - - - - - - - 2 -rwx 1674921 c2950-c3

6、h2s-mz.120-5.3.WC.1.bin 4 drwx 10240 html 165 -rwx 1559 config.text 166 -rwx 269 env_vars 4778496 bytes available (2962944 bytes used) switch: delete flash:config.text Are you sure you want to delete flash:config.text (y/n)?y File flash:config.text deleted switch: ? ? - Present list of available com

7、mands boot - Load and boot an executable image cat - Concatenate (type) file(s) copy - Copy a file delete - Delete file(s) dir - List files in directories flash_init - Initialize flash filesystem(s) format - Format a filesystem fsck - Check filesystem consistency help - Present list of available com

8、mands load_helper - Load and initialize a helper image memory - Present memory heap utilization information mkdir - Create dir(s) more - Concatenate (display) file(s) rename - Rename a file reset - Reset the system rmdir - Delete empty dir(s) set - Set or display environment variables set_param - Se

9、t system parameters in flash trap - Cause a software breakpoint to occur type - Concatenate (type) file(s) unset - Unset one or more environment variables version - Display boot loader version switch: switch: boot Loading flash:c2950-c3h2s-mz.120-5.3.WC.1.bin.# # # File flash:c2950-c3h2s-mz.120-5.3.

10、WC.1.bin uncompressed and installed, entry p oint: 0 x80010000 executing. 名师资料总结 - - -精品资料欢迎下载 - - - - - - - - - - - - - - - - - - 名师精心整理 - - - - - - - 第 2 页，共 8 页 - - - - - - - - - Restricted Rights Legend Use, duplication, or disclosure by the Government is subject to restrictions as set forth in

11、subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013. cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134-1706 Cisco

12、 Internetwork Operating System Software IOS (tm) C2950 Software (C2950-C3H2S-M), Version 12.0(5.3)WC(1), MAINTENANCE INT ERIM SOFTWARE Copyright (c) 1986-2001 by cisco Systems, Inc. Compiled Mon 30-Apr-01 07:56 by devgoyal Image text-base: 0 x80010000, data-base: 0 x8031A000 Initializing flashfs. fl

13、ashfs1: 161 files, 3 directories flashfs1: 0 orphaned files, 0 orphaned directories flashfs1: Total bytes: 7741440 flashfs1: Bytes used: 2960896 flashfs1: Bytes available: 4780544 flashfs1: flashfs fsck took 6 seconds. flashfs1: Initialization complete. Done initializing flashfs. C2950 POST: System

14、Board Test : Passed C2950 POST: Ethernet Controller Test : Passed C2950 POST: MII TEST : Passed cisco WS-C2950-24 (RC32300) processor (revision B0) with 22260K bytes of memory. Processor board ID FOC0605W1QV Last reset from system-reset 名师资料总结 - - -精品资料欢迎下载 - - - - - - - - - - - - - - - - - - 名师精心整理

15、 - - - - - - - 第 3 页，共 8 页 - - - - - - - - - Processor is running Enterprise Edition Software Cluster command switch capable Cluster member switch capable 24 FastEthernet/IEEE 802.3 interface(s) 32K bytes of flash-simulated non-volatile configuration memory. Base ethernet MAC Address: 00:08:E3:68:76

16、:00 Motherboard assembly number: 73-5781-08 Power supply part number: 34-0965-01 Motherboard serial number: FOC060509VF Power supply serial number: DAB05523DPL Model revision number: B0 Motherboard revision number: B0 Model number: WS-C2950-24 System serial number: FOC0605W1QV C2950 INIT: Complete 0

17、0:00:17: %SYS-5-RESTART: System restarted - Cisco Internetwork Operating System Software IOS (tm) C2950 Software (C2950-C3H2S-M), Version 12.0(5.3)WC(1), MAINTENANCE INT ERIM SOFTWARE Copyright (c) 1986-2001 by cisco Systems, Inc. Compiled Mon 30-Apr-01 07:56 by devgoyal - System Configuration Dialo

18、g - At any point you may enter a question mark ? for help. Use ctrl-c to abort configuration dialog at any prompt. Default settings are in square brackets . Continue with configuration dialog? yes/no: y Enter IP address: 192.168.0.50 Enter IP netmask: 255.255.255.0 Would you like to enter a default

19、gateway address? yes: n Enter host name Switch: 2950-2 The enable secret is a one-way cryptographic secret used instead of the enable password when it exists. Enter enable secret: Would you like to configure a Telnet password? yes: y 名师资料总结 - - -精品资料欢迎下载 - - - - - - - - - - - - - - - - - - 名师精心整理 -

20、- - - - - - 第 4 页，共 8 页 - - - - - - - - - Enter Telnet password: Would you like to enable as a cluster command switch? yes/no: n The following configuration command script was created: ip subnet-zero interface VLAN1 ip address 192.168.0.50 255.255.255.0 hostname 2950-2 enable secret 5 $1$5Ocj$1osGcB

21、mYqsrb0BbHHI4Lr/ line vty 0 15 password cisco snmp community private rw snmp community public ro ! end Use this configuration? yes/no: y Building configuration. OK Use the enabled mode configure command to modify this configuration. Press RETURN to get started. 其中 config.text是配置文件，如果有CONSOLE线，可以用 X-

22、MODEN 的方式导出文件，如果配置的密码加密为 password 方式而不是 secret方式，那还可以破译路由器的密码破解破解密码原则只删除密码不破坏配置1 重启路由器按 ctrl + pause break 键 进入 mini IOS 2 修改寄存器值改变启动次序rommon 1 > confreg 0 x2142 3 在 mini IOS 下重启路由rommon 2 > reset System Bootstrap, Version 12.1(3r)T2, RELEASE SOFTWARE (fc1) Copyright (c) 2000 by cisco Systems,

23、 Inc. 名师资料总结 - - -精品资料欢迎下载 - - - - - - - - - - - - - - - - - - 名师精心整理 - - - - - - - 第 5 页，共 8 页 - - - - - - - - - cisco 2621 (MPC860) processor (revision 0 x200) with 60416K/5120K bytes of memory Self decompressing the image : # OK Restricted Rights Legend Use, duplication, or disclosure by the Gove

24、rnment is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013. cisco Systems, Inc. 170 West

25、Tasman Drive San Jose, California 95134-1706 Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-I-M), Version 12.2(28), RELEASE SOFTWARE (fc5) Technical Support: http:/ Copyright (c) 1986-2005 by cisco Systems, Inc. Compiled Wed 27-Apr-04 19:01 by miwang cisco 2621 (MPC860)

26、processor (revision 0 x200) with 60416K/5120K bytes of memory . Processor board ID JAD05190MTZ (4292891495) M860 processor: part number 0, mask 49 Bridging software. X.25 software, Version 3.0.0. 2 FastEthernet/IEEE 802.3 interface(s) 2 Low-speed serial(sync/async) network interface(s) 32K bytes of

27、non-volatile configuration memory. 16384K bytes of processor board System flash (Read/Write) - System Configuration Dialog - Continue with configuration dialog? yes/no: n Press RETURN to get started! Router> 看这里进入系统之后直接就进入了用户模式没要密码Router>en Router#copy start run Destination filename running-co

28、nfig? 552 bytes copied in 0.416 secs (1326 bytes/sec) ru1# 我们输入 enable 进入特权模式输入命令copy start run 从 NVRAM 里面调用配置到内存中下一步更换密码ru1#conf t Enter configuration commands, one per line. End with CNTL/Z. ru1(config)#line console 0 ru1(config-line)#pass admin 名师资料总结 - - -精品资料欢迎下载 - - - - - - - - - - - - - - - -

29、 - - 名师精心整理 - - - - - - - 第 6 页，共 8 页 - - - - - - - - - ru1(config-line)#login ru1(config-line)#exit ru1(config)#line vty 0 4 ru1(config-line)#pass admin ru1(config-line)#login ru1(config-line)#exit ru1(config)#enable pass admin ru1(config)#enable secret admin ru1(config)#service password-encryption

30、 比如说我们将密码修改为admin 实验环境下只采用这一个密码下一步更改寄存器值恢复到正常的启动次序ru1(config)#config-register 0 x2102 下一步保存配置到NVRAM里面ru1(config)#exit %SYS-5-CONFIG_I: Configured from console by console ru1#copy run start Destination filename startup-config? Building configuration. OK ru1# 重启一下ru1#rel Proceed with reload? confirm %

31、SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload Command. System Bootstrap, Version 12.1(3r)T2, RELEASE SOFTWARE (fc1) Copyright (c) 2000 by cisco Systems, Inc. cisco 2621 (MPC860) processor (revision 0 x200) with 60416K/5120K bytes of memory Self decompressing the image : # OK Restr

32、icted Rights Legend Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software c

33、lause at DFARS sec. 252.227-7013. cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134-1706 Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-I-M), Version 12.2(28), RELEASE SOFTWARE (fc5) Technical Support: http:/ Copyright (c) 1986-2005 by cisco Systems, I

34、nc. Compiled Wed 27-Apr-04 19:01 by miwang 名师资料总结 - - -精品资料欢迎下载 - - - - - - - - - - - - - - - - - - 名师精心整理 - - - - - - - 第 7 页，共 8 页 - - - - - - - - - cisco 2621 (MPC860) processor (revision 0 x200) with 60416K/5120K bytes of memory . Processor board ID JAD05190MTZ (4292891495) M860 processor: part

35、number 0, mask 49 Bridging software. X.25 software, Version 3.0.0. 2 FastEthernet/IEEE 802.3 interface(s) 2 Low-speed serial(sync/async) network interface(s) 32K bytes of non-volatile configuration memory. 16384K bytes of processor board System flash (Read/Write) %LINK-5-CHANGED: Interface FastEther

36、net0/0, changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up %LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down %LINEPROTO-5-UPDOWN: Line protocol on In

37、terface FastEthernet0/0, changed state to down %LINK-5-CHANGED: Interface FastEthernet0/1, changed state to administratively down Press RETURN to get started! User Access Verification Password: ru1>en Password: ru1# 最后解释一下文中带下划线的为个人说明阴影部分是必要的步骤是要输入命令的文章转载自网管网：http:/ 名师资料总结 - - -精品资料欢迎下载 - - - - - - - - - - - - - - - - - - 名师精心整理 - - - - - - - 第 8 页，共 8 页 - - - - - - - - -