实验原理
思科路由器所有的配置都保存在NVRAM中，此为16位软件寄存器。通过修改寄存值，我们可以读取、更改并且写入最终配置从而破解密码
实验步骤
开启路由器查看version
Router>show version
…………………
cisco 2621XM (MPC860P) processor (revision 0x200) with 126976K/4096K bytes of memory.
Processor board ID JAE075202KQ (2960342124)
M860 processor: part number 5, mask 2
Bridging software.
X.25 software, Version 3.0.0.
2 FastEthernet/IEEE 802.3 interface(s)
4 Low-speed serial(sync/async) network interface(s)
32K bytes of non-volatile configuration memory.
32768K bytes of processor board System flash (Read/Write)
Configuration register is 0x2102
注意：0x2102 是指开机时加载配置文件，0x2142 是指开机时不加载配置文件
调出你的屏幕键盘，然后断电重启动路由器，并且在路由器启动完毕之前按下Ctrl+Pause(屏幕键盘)
Copyright (c) 2003 by cisco Systems, Inc.
PC = 0xfff0ac3c, Vector = 0x500, SP = 0x680127c0
C2600 platform with 131072 Kbytes of main memory
PC = 0xfff0ac3c, Vector = 0x500, SP = 0x80004884
monitor: command "boot" aborted due to user interrupt
rommon 1>
更改寄存器位置为0x2142
rommon 2 >confreg 0x2142
You must reset or power cycle for new config to take effect
重启设备
rommon 2>reset
重启后提示是否使用初始化配置，输入no
Router>show version
Cisco Internetwork Operating System Software
………
Configuration register is 0x2142
可以看到寄存器已经修改为0x2142，show running的话发现配置是初始状态，在此就不列出log
我们再把原来的配置写入进来
Router#conf t
Router#copy startup-config running-config
Destination filename [running-config]?
Slot is empty or does not support clock participate
WIC slot is empty or does not support clock participate
1133 bytes copied in 1.306 secs (868 bytes/sec)
show run一下,看一下原有配置情况
cisco2600_1#show running-config
Building configuration...
Current configuration : 1133 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname cisco2600_1
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$hrif$30HnQMz/S.Caj4vEDlWos1
enable password 123456
!
no network-clock-participate slot 1
no network-clock-participate wic 0
no aaa new-model
ip subnet-zero
no ip routing
no ip cef
!
!
ip dhcp excluded-address 125.221.224.1 125.221.224.19
ip dhcp excluded-address 125.221.224.101 125.221.224.254
!
ip dhcp pool nic
network 125.221.224.0 255.255.255.0
default-router 125.221.224.1
dns-server 218.75.247.245 211.67.208.1
domain-name hnust.edu.cn
lease 0 1
!
no ip domain lookup
no ftp-server write-enable
!
!
!
!
interface FastEthernet0/0
ip address 125.221.224.2 255.255.255.0
no ip route-cache
shutdown
duplex auto
speed auto
!
interface Serial0/0
在此处我们看到了password为123456
然而当我们输入123456的时候并不能进入enable模式
于是我们尝试清除设置的密码
cisco2600_1(config)#no enable password
再次尝试
cisco2600_1#exit
cisco2600_1>en
password:
还是存在密码，于是我们仔细翻看上面的running-config发现了问题
这里除了一个enable password还有一个enable secret
查询相关资料后发现，原来思科路由器的密码有两种密码，一种是password，以明文存放；一种是secret，是以加密之后的密文存放的，并且分为15个加密等级，这里面的enable secret 5是经过MD5加密的，并且当这两种密码共存的时候，secret会覆盖password，所以当secret存在时，无论我们怎样破解修改password都是无效的
找到了问题所在就好办了，我们清除掉secret就可以了
cisco2600_1#conf t
cisco2600_1(config)#no enable secret
cisco2600_1#show running-config
Building configuration...
Current configuration : 1086 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname cisco2600_1
!
boot-start-marker
boot-end-marker
!
!
no network-clock-participate slot 1
no network-clock-participate wic 0
no aaa new-model
ip subnet-zero
no ip routing
no ip cef
!
!
ip dhcp excluded-address 125.221.224.1 125.221.224.19
ip dhcp excluded-address 125.221.224.101 125.221.224.254
!
ip dhcp pool nic
network 125.221.224.0 255.255.255.0
default-router 125.221.224.1
dns-server 218.75.247.245 211.67.208.1
domain-name hnust.edu.cn
....
可以看到已经没有密码了
接下把当前设备的运行配置保存到flash上去，以便下一次重启后系统能够还原到当前配置，然后更改寄存器为正常的0x2102并重启
cisco2600_1#copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]
cisco2600_1#conf t
cisco2600_1(config)#config 0x2102
cisco2600_1(config)#end
cisco2600_1#reload
重启之后show version看看里面寄存器是否改回来了
cisco2600_1>show version
……
Configuration register is 0x2102
可以看到寄存器已经改回为0x2102
尝试进入特权模式
cisco2600_1>en
cisco2600_1#
OK，成功破解密码
