交换机的密码破解

简介:
四楼第一机房 5 号交换机具体实验
如何暴力破解WS-CISCO-2950-24交换机密码
S5为例
第一种方法:暴力破解(直接删除保存密码的配置文件即可)
 
远程登陆交换机通信服务器
开始---运行telnet 172.16.3.200 远程登陆交换机通信服务器
User Access Verification
 
Username: benet.cn   登陆帐号
Password: benet.cn   登陆密码(密码不显示)
 
swich-Server#s5 进入5号交换机
Trying s5 (1.1.1.1, 2005)... Open
 
关闭5号交换机电源,按下交换机上的MODE键,重起交换机5, ,交换机启动出现switch:后停止按MODE
 
C2950 Boot Loader (C2950-HBOOT-M) Version 12.1(11r)EA1, RELEASE SOFTWARE (fc1)
Compiled Mon 22-Jul-02 17:18 by antonino
WS-C2950SX-24 starting...
Base ethernet MAC Address: 00:0d:28:9b:4d:80
Xmodem file system is available.
 
The system has been interrupted prior to initializing the
flash filesystem.  The following commands will initialize
the flash filesystem, and finish loading the operating
system software:
 
    flash_init
    load_helper
    boot
 
switch: flash_init 初始化交换机flash文件
Initializing Flash...
flashfs[0]: 10 files, 2 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 7741440
flashfs[0]: Bytes used: 2679808
flashfs[0]: Bytes available: 5061632
flashfs[0]: flashfs fsck took 7 seconds.
...done initializing flash.
Boot Sector Filesystem (bs:) installed, fsid: 3
Parameter Block Filesystem (pb:) installed, fsid: 4
switch: dir flash: 显示5号交换机flash配置文件
Directory of flash:/
 
2    -rwx  1469      <date>               ?
3    drwx  128       <date>               lost+found
5    -rwx  1469      <date>               config.old
8    -rwx  1004      <date>               vlan.dat
9    -rwx  1472      <date>               up
7    -rwx  2664051   <date>               c2950-i6q4l2-mz.121-11.EA1.bin
10   -rwx  1460      <date>               y
11   -rwx  1670      <date>               config.old2
12   -rwx  5         <date>               private-config.text 交换机密码保存的地方
 
5061632 bytes available (2679808 bytes used)
switch: del flash:private-config.text 直接删除交换机保存密码的文件
Are you sure you want to delete "flash:private-config.text" (y/n)?y
File "flash:private-config.text" deleted
switch: dir flash: 显示5号交换机flash配置文件
Directory of flash:/
 
2    -rwx  1469      <date>               ?
3    drwx  128       <date>               lost+found
5    -rwx  1469      <date>               config.old
8    -rwx  1004      <date>               vlan.dat
9    -rwx  1472      <date>               up
7    -rwx  2664051   <date>               c2950-i6q4l2-mz.121-11.EA1.bin
10   -rwx  1460      <date>               y
11   -rwx  1670      <date>               config.old2
 
5062144 bytes available (2679296 bytes used)
switch: boot 重新启动交换机(或者reset
###############################################################################
 
File "flash:/c2950-i6q4l2-mz.121-11.EA1.bin" uncompressed and installed, entry
oint: 0x80010000
executing...
 
              Restricted Rights Legend
 
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
 
           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706
 
 
 
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(11)EA1, RELEASE SOFTWARE
(fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Wed 28-Aug-02 10:25 by antonino
Image text-base: 0x80010000, data-base: 0x80528000
 
 
Initializing flashfs...
flashfs[1]: 9 files, 2 directories
flashfs[1]: 0 orphaned files, 0 orphaned directories
flashfs[1]: Total bytes: 7741440
flashfs[1]: Bytes used: 2679296
flashfs[1]: Bytes available: 5062144
flashfs[1]: flashfs fsck took 6 seconds.
flashfs[1]: Initialization complete.
Done initializing flashfs.
POST: System Board Test : Passed
POST: Ethernet Controller Test : Passed
ASIC Initialization Passed
cisco WS-C2950SX-24 (RC32300) processor (revision B0) with 20402K bytes of memo
y.
Processor board ID FOC0925X3G0
Last reset from system-reset
Running Standard Image
24 FastEthernet/IEEE 802.3 interface(s)
 
32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:0D:28:9B:4D:80
Motherboard assembly number: 73-5781-12
Power supply part number: 34-0965-01
Motherboard serial number: 28-4641-05
Power supply serial number: PHI071407DY
Model revision number: B0
Motherboard revision number: B0
Model number: WS-C2950-24
System serial number: FOC0925X3G0
 
         --- System Configuration Dialog ---
 
Would you like to enter the initial configuration dialog? [yes/no]: no
 
 
 
Press RETURN to get started!
 
 
00:00:13: POST: Loop back Test Failed on GigabitEthernet0/1. State:Disabled
 
00:00:13: POST: Loop back Test Failed on GigabitEthernet0/2. State:Disabled
 
00:00:13: %SPANTREE-5-EXTENDED_SYSID: Extended SysId enabled for type vlan
00:00:17: Gi0/1 can't be brought up because it failed POST in loopback test
00:00:17: Gi0/2 can't be brought up because it failed POST in loopback test
00:00:17: %SYS-5-RESTART: System restarted --
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C29
Switch>
Switch>
Switch>
Switch>
Switch>50-I6Q4L2-M), Version 12.1(11)EA1, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Wed 28-Aug-02 10:25 by antoninocpd_port_enable: port 24 xcvr_enable_li
k: FALSE
cpd_port_enable: port 25 xcvr_enable_link: FALSE
 
00:00:19: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
00:00:19: %LINK-3-UPDOWN: Interface GigabitEthernet0/2, changed state to up
00:00:20: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, c
anged state to down
00:00:20: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/2, c
anged state to down
00:00:20: %LINK-5-CHANGED: Interface Vlan1, changed state to administratively d
wn
00:00:21: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, c
anged state to up
00:00:21: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/2, c
anged state to up
00:00:21: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state
o down
Switch>
Switch>
Switch>enable 进入特权模式
Switch#config  terimal 进入全局配置模式
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#
 
 
 
 
/*****************************************************************************/
第二种方法:密码恢复方式(修改交换机密码保存配置文件的扩展名,让交换机启动时饶过配置文件(config.text)进入特权模式,然后再把配置文件的扩展名恢复过来,然后在全局模式下,修改密码,并保存当前配置)
/*****************************************************************************/
远程登陆交换机通信服务器
开始---运行telnet 172.16.3.200 远程登陆交换机通信服务器
User Access Verification
 
Username: benet.cn   登陆帐号
Password: benet.cn   登陆密码(密码不显示)
 
swich-Server#s5 进入5号交换机
Trying s5 (1.1.1.1, 2005)... Open
 
关闭5号交换机电源,按下交换机上的MODE键,重起交换机5, ,交换机启动出现switch:后停止按MODE
 
C2950 Boot Loader (C2950-HBOOT-M) Version 12.1(11r)EA1, RELEASE SOFTWARE (fc1)
Compiled Mon 22-Jul-02 17:18 by antonino
WS-C2950SX-24 starting...
Base ethernet MAC Address: 00:0d:28:9b:4d:80
Xmodem file system is available.
 
The system has been interrupted prior to initializing the
flash filesystem.  The following commands will initialize
the flash filesystem, and finish loading the operating
system software:
 
    flash_init
    load_helper
    boot
 
switch: flash_init 初始化交换机flash文件
Initializing Flash...
flashfs[0]: 10 files, 2 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 7741440
flashfs[0]: Bytes used: 2679808
flashfs[0]: Bytes available: 5061632
flashfs[0]: flashfs fsck took 7 seconds.
...done initializing flash.
Boot Sector Filesystem (bs:) installed, fsid: 3
Parameter Block Filesystem (pb:) installed, fsid: 4
switch: dir flash: 显示5号交换机flash配置文件
Directory of flash:/
 
2    -rwx  1469      <date>               ?
3    drwx  128       <date>               lost+found
5    -rwx  1469      <date>               config.old
8    -rwx  1004      <date>               vlan.dat
9    -rwx  1472      <date>               up
7    -rwx  2664051   <date>               c2950-i6q4l2-mz.121-11.EA1.bin
10   -rwx  1460      <date>               y
11   -rwx  1670      <date>               config.old2
12   -rwx  5         <date>               private-config.text 交换机密码保存的地方
 
5061632 bytes available (2679808 bytes used)
 
switch: rename flash:config.text flash:config.old  config.text改为config.old
switch: dir flash: 显示5号交换机flash的具体配置文件
Directory of flash:/
 
2    -rwx  1469      <date>               ?
3    drwx  128       <date>               lost+found
8    -rwx  1004      <date>               vlan.dat
9    -rwx  1472      <date>               up
7    -rwx  2664051   <date>               c2950-i6q4l2-mz.121-11.EA1.bin
10   -rwx  1460      <date>               y
12   -rwx  1496      <date>               config.old
 
5063680 bytes available (2677760 bytes used)
switch: boot  重新启动交换机5(或者reset)
################################################################################
 
File "flash:/c2950-i6q4l2-mz.121-11.EA1.bin" uncompressed and installed, entry p
oint: 0x80010000
executing...
 
              Restricted Rights Legend
 
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
 
           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706
 
 
 
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(11)EA1, RELEASE SOFTWARE
(fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Wed 28-Aug-02 10:25 by antonino
Image text-base: 0x80010000, data-base: 0x80528000
 
 
Initializing flashfs...
flashfs[1]: 9 files, 2 directories
flashfs[1]: 0 orphaned files, 0 orphaned directories
flashfs[1]: Total bytes: 7741440
flashfs[1]: Bytes used: 2677760
flashfs[1]: Bytes available: 5063680
flashfs[1]: flashfs fsck took 6 seconds.
flashfs[1]: Initialization complete.
Done initializing flashfs.
POST: System Board Test : Passed
POST: Ethernet Controller Test : Passed
ASIC Initialization Passed
cisco WS-C2950SX-24 (RC32300) processor (revision B0) with 20402K bytes of memor
y.
Processor board ID FOC0925X3G0
Last reset from system-reset
Running Standard Image
24 FastEthernet/IEEE 802.3 interface(s)
 
32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:0D:28:9B:4D:80
Motherboard assembly number: 73-5781-12
Power supply part number: 34-0965-01
Motherboard serial number: 28-4641-05
Power supply serial number: PHI071407DY
Model revision number: B0
Motherboard revision number: B0
Model number: WS-C2950-24
System serial number: FOC0925X3G0
 
         --- System Configuration Dialog ---
 
Would you like to enter the initial configuration dialog? [yes/no]:
00:00:13: POST: Loop back Test Failed on GigabitEthernet0/1. State:Disabled
 
00:00:13: POST: Loop back Test Failed on GigabitEthernet0/2. State:Disabled
 
00:00:13: %SPANTREE-5-EXTENDED_SYSID: Extended SysId enabled for type vlan
00:00:17: Gi0/1 can't be brought up because it failed POST in loopback test
00:00:17: Gi0/2 can't be brought up because it failed POST in loopback test
00:00:17: %SYS-5-RESTART: System restarted --
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(11)EA1, RELEASE SOFTWARE
(fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Wed 28-Aug-02 10:25 by antoninocpd_port_enable: port 24 xcvr_enable_lin
k: FALSE
cpd_port_enable: port 25 xcvr_enable_link: FALSE
 
00:00:19: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
00:00:19: %LINK-3-UPDOWN: Interface GigabitEthernet0/2, changed state to up
00:00:20: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, ch
anged state to up
00:00:20: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/2, ch
anged state to up
00:00:51: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state t
o up
% Please answer 'yes' or 'no'.
% Please answer 'yes' or 'no'.
Would you like to enter the initial configuration dialog? [yes/no]:
% Please answer 'yes' or 'no'.
Would you like to enter the initial configuration dialog? [yes/no]:
% Please answer 'yes' or 'no'.
Would you like to enter the initial configuration dialog? [yes/no]:
% Please answer 'yes' or 'no'.
Would you like to enter the initial configuration dialog? [yes/no]: no
 
 
 
Press RETURN to get started!
 
 
Switch>
00:01:01: %LINK-5-CHANGED: Interface Vlan1, changed state to administratively do
wn
00:01:02: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state t
o down
Switch>enable  进入特权模式
Switch#dir flash:
Directory of flash:/
 
    2  -rwx        1469   Mar 01 1993 00:06:29  ?
    3  drwx         128   Mar 01 1993 00:00:07  lost+found
    8  -rwx        1004   Mar 01 1993 03:36:00  vlan.dat
    9  -rwx        1472   Mar 01 1993 00:18:51  up
    7  -rwx     2664051   Mar 01 1993 00:02:42  c2950-i6q4l2-mz.121-11.EA1.bin
   10  -rwx        1460   Mar 01 1993 00:02:20  y
   12  -rwx        1496   Mar 01 1993 00:01:29  config.old 修改过的文件
 
7741440 bytes total (5063680 bytes free)
Switch#rename flash:config.old flash:config.text 将改过的文件再次改回来
Destination filename [config.text]?
%Error renaming flash:config.old to flash:config.text (No such file or directory
)
Switch#dir flash:
Directory of flash:/
 
    2  -rwx        1469   Mar 01 1993 00:06:29  ?
    3  drwx         128   Mar 01 1993 00:00:07  lost+found
    8  -rwx        1004   Mar 01 1993 03:36:00  vlan.dat
    9  -rwx        1472   Mar 01 1993 00:18:51  up
    7  -rwx     2664051   Mar 01 1993 00:02:42  c2950-i6q4l2-mz.121-11.EA1.bin
   10  -rwx        1460   Mar 01 1993 00:02:20  y
   12  -rwx        1496   Mar 01 1993 00:01:29  config.text  改回来的文件
  
7741440 bytes total (5063680 bytes free)
Switch#copy running-config startup-config 保存当前配置文件(或者write
Destination filename [startup-config]?
Building configuration...
[OK]
Switch#exit
 
Switch con0 is now available
Press RETURN to get started.
Switch>
Switch>
Switch>enable 进入特权模式
Switch#


本文转自凌激冰51CTO博客,原文链接:http://blog.51cto.com/dreamfire/97957,如需转载请自行联系原作者
相关文章
|
10月前
|
网络架构
交换机与路由器技术-10-交换机密码恢复
交换机与路由器技术-10-交换机密码恢复
40 0
|
11月前
|
存储 数据安全/隐私保护 网络架构
路由器设备管理 以及 交换机、路由器 密码设置与恢复
一、路由器硬件概述 如同计算机一样,路由器也是由各种各样的硬件组成的,并且每个硬件所具备的功能各不相同。
194 0
|
Linux 数据安全/隐私保护
光纤交换机忘记密码
修改密码后忘记
204 0
|
数据安全/隐私保护 网络架构 内存技术
|
网络安全 数据安全/隐私保护 网络虚拟化
|
数据安全/隐私保护 网络架构 内存技术
|
数据安全/隐私保护 内存技术 安全
|
数据安全/隐私保护 内存技术