[afnog] Cisco 7609 sup32 password recovery

[Frank A. Kuse]

Hi Hary,

Thanks you all for the explanation.

I am up and running now.

Regards,

Frank

>-----Original Message-----
>From: Hari Kurup [mailto:kurup at afrinic.net]
>Sent: Tuesday, August 11, 2009 9:40 AM
>To: Frank A. Kuse
>Cc: afnog at afnog.org
>Subject: Re: [afnog] Cisco 7609 sup32 password recovery
>
>Copy and paste output from the link below:-
>
>http://www.cisco.com/en/US/products/hw/switches/ps700/products_password_
>recovery09186a0080133fb1.shtml
>
>The boot sequence is different on the Catalyst 6500/6000 and Cisco 7600
>that run Cisco IOS System Software than the Cisco 7200 Series Router
>because the hardware is different. After you power-cycle the box, the
>switch processor (SP) boots up first. After a short amount of time
>(approximately 25 to 60 seconds) it transfers console ownership to the
>route processor (RP (MSFC)). The RP continues to load the bundled
>software image. It is crucial that you press Ctrl-brk just after the SP
>gives over control of the console to the RP. If you send the break
>sequence too soon, you end up in the ROMMON of the SP, which is not
>where you should be. Send the break sequence after you see this message
>on the console:
>
>    00:00:03: %OIR-6-CONSOLE: Changing console ownership to route
>processor
>
>After this point, the password recovery is the same as a normal router.
>
>
>--
>Hari
>
>
>On 8/11/09 11:27 AM, Frank A. Kuse wrote:-
>> Hi Mark,
>>
>> I did the following as you suggested and below is the latter part of
>the
>> boot sequence which still gives me a username prompt.
>>
>> Rommon 1> confreg 0x2142
>> Rommon 2> boot
>>
>> ----------------------------------------------------------------------
>------
>> -------------
>> cisco CISCO7609 (R7000) processor (revision 1.2) with 458752K/65536K
>bytes
>> of memory.
>> Processor board ID FOX1201G7Q7
>> R7000 CPU at 300Mhz, Implementation 0x27, Rev 3.3, 256KB L2, 1024KB L3
>Cache
>> Last reset from power-on SuperLAT software (copyright 1990 by Meridian
>> Technology Corp).
>> X.25 software, Version 3.0.0.
>> Bridging software.
>> TN3270 Emulation software.
>> 1 Virtual Ethernet/IEEE 802.3 interface
>> 21 Gigabit Ethernet/IEEE 802.3 interfaces 1915K bytes of non-volatile
>> configuration memory.
>>
>> 65536K bytes of Flash internal SIMM (Sector size 512K).
>> ICMP redirect is disabled on interfaces with secondary IP address
>>
>>
>> Press RETURN to get started!
>>
>>
>> 00:01:15: STDBY: RP: Currently running ROMMON from S (Gold) region
>> 00:01:16: %SPANTREE-STDBY-5-EXTENDED_SYSID: Extended SysId enabled for
>type
>> vlan
>> 00:02:08: %PM-STDBY-4-INT_FAILUP: GigabitEthernet5/9 failed to come
>up. No
>> internal VLAN available
>> 00:02:08: %PM-STDBY-4-INT_FAILUP: GigabitEthernet5/9 failed to come
>up. No
>> internal VLAN available
>> 00:02:13: %SYS-STDBY-5-RESTART: System restarted -- Cisco Internetwork
>> Operating System Software IOS (tm) s3223_rp Software
>> (s3223_rp-ADVIPSERVICESK9_WAN-M)
>>
>> User Access Verification
>>
>> Username: , Version 12.2(18)SXF13, RELEASE SOFTWARE (fc1) Technical
>Support:
>> http://www.cisco.com/techsupport Copyright (c) 1986-2008 by cisco
>Systems,
>> Inc.
>> Compiled Wed 13-Feb-08 23:45 by kellythw
>> 00:02:13: %MFIB_CONST_RP-STDBY-6-REPLICATION_MODE_CHANGE: Replication
>Mode
>> Change Detected. Current system replication mode is Ingress
>> Username:
>> % Username:  timeout expired!
>> % Authentication failed.
>>
>> Username:
>>
>> -------------------------------------------------------------------
>> Any ideas ?
>>
>> Regards,
>>
>> Frank
>>
>>> -----Original Message-----
>>> From: Mark Tinka [mailto:mtinka at globaltransit.net]
>>> Sent: Tuesday, August 11, 2009 9:00 AM
>>> To: Frank A. Kuse
>>> Cc: afnog at afnog.org
>>> Subject: Re: [afnog] Cisco 7609 sup32 password recovery
>>>
>>> On Tuesday 11 August 2009 04:10:35 pm Frank A. Kuse wrote:
>>>
>>>> In my attempt to break into a Cisco 7609 sup32 router, when typing
>>>> confreg 0x2142 in the rom monitor and boot, it reset itself back to
>>>> 0x2102.
>>> Rather than doing a 'reset', try booting the RP after modifying the
>>> config-register, i.e., 'boot'.
>>>
>>> Cheers,
>>>
>>> Mark.
>>
>>
>> _______________________________________________
>> afnog mailing list
>> http://afnog.org/mailman/listinfo/afnog
>>