cisco catalyst2900、3500系列交换机密码破解方法
  
1.拔掉交换机的电源线 
 
2。用超级终端和控制线连到交换机，超级终端的设置是： 
9600 baud rate 
No parity 
8 data bits 
1 stop bit 
No flow control 
 
3。按住交换机前面板的“mode”按钮，插上电源线，当端口1上面的灯不亮后，放松“mode”按钮； 
 
4。这时超级终端上应该显示： 
The system has been interrupted prior to initializing the flash 
file system. 
The following commands will initialize the flash file system, and 
finish loading 
the operating system software: 
 
flash_init 
load_helper 
boot 
 
5。输入flash_init 
 
6。输入load_helper 
 
7. 输入dir flash: 
这时显示： 
Directory of flash: 
2 -rwx 843947 Mar 01 1993 00:02:18 C2900XL-h-mz-112.8-SA 
4 drwx 3776 Mar 01 1993 01:23:24 html 
66 -rwx 130 Jan 01 1970 00:01:19 env_vars 
68 -rwx 1296 Mar 01 1993 06:55:51 config.text 
1728000 bytes total (456704 bytes free) 
 
8。输入rename flash:config.text flash:config.old 
 
9.输入boot，重新启动系统 
 
10。系统启动完后显示：Continue with the configuration dialog? 
[yes/no] : 
输入N 
 
11.输入enable 
 
12.进入enable模式后，输入rename flash:config.old flash:config.text 
 
13。接着按以下步骤操作： 
 
Switch# copy flash:config.text system:running-config 
Source filename [config.text]? (press Return) 
Destination filename [running-config]? (press Return) 
14 。接着按以下步骤操作： 
switch#configure terminal 
switch(config)#no enable secret 
switch(config)#no enable password

路由器口令破解 
1、启动路由器，在30秒那按ctrl+break，进入rommon模式 
System Bootstrap, Version 12.1(3r)T2, RELEASE SOFTWARE (fc1) 
Copyright (c) 2000 by cisco Systems, Inc. 
C2600 platform with 65536 Kbytes of main memory 
PC = 0xfff0ab6c, Vector = 0x500, SP = 0x80004884 
monitor: command "boot" aborted due to user interrupt 
rommon 1 > 
2、然后输入 
rommon 1 > confreg 0x2142 
You must reset or power cycle for new config to take effect 
rommon 2 > reset 
3、路由器会重新启动 
System Bootstrap, Version 12.1(3r)T2, RELEASE SOFTWARE (fc1) 
Copyright (c) 2000 by cisco Systems, Inc. 
C2600 platform with 65536 Kbytes of main memory 
program load complete, entry point: 0x80008000, size: 0x8a7f8c 
Self decompressing the image : 
中间引导过程忽略。。。。。 
--- System Configuration Dialog --- 
Would you like to enter the initial configuration dialog? [yes/no]: 
4、按ctrl+c 
Press RETURN to get started! 
Router> 
Router>enable 
Router#copy startup-config running-config 
Destination filename [running-config]? 
816 bytes copied in 0.884 secs 
router1# 
router1#conf t 
Enter configuration commands, one per line. End with CNTL/Z. 
router1(config)# 
router1(config)#enable secret cisco

router1(config)#enable password 12345

router1(config)#line con 0 
router1(config-line)#login 
router1(config-line)#password cisco 
router1(config-line)#exit

router1(config)#line aux 0 
router1(config-line)#login 
router1(config-line)#password cisco 
router1(config-line)#exit

router1(config)#line vty 0 4 
router1(config-line)#login 
router1(config-line)#password cisco 
router1(config-line)#exit

router1(config)#config-register 0x2102

router1(config)#exit 
router1#

router1#copy running-config startup-config 
Destination filename [startup-config]? 
Building configuration... 
[OK]

本文转自zcm8483 51CTO博客，原文链接:http://blog.51cto.com/haolun/993048