While cleaning up my mess here, I found an old Cisco device, an old 1600 series router which I wanted to inspect before considering to throw it away. After some network magic I found the old IP I used but didn’t get over the password prompt to sneak around in the configs. My mood dropped instantly as I did forget it – until I remembered my USB to serial adapter.

To connect the serial cable I switched the router off and did my setup as follows:

9600 baud
No parity
8 data bits
1 stop bit
No flow control

Knowing Cisco stuff I remember that those devices have a bootloader which kicks off the operating system. If you send a “break” sequence while bootup you gain access to some nice functionality like changing the configuration it boots off. and that’s how it looks like:

*** System received an abort due to Break Key ***

signal= 0x3, code= 0x500, context= 0x813ac158
PC = 0x802d0b60, Vector = 0x500, SP = 0x80006030
rommon 1 > _

As I am now seeing a shell I can try to type my first command “confreg 0x2142”. After a second one, named “reset” a shell hails me:

8192K bytes of processor board System flash partition 1 (Read/Write)
8192K bytes of processor board System flash partition 2 (Read/Write)


 --- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]: n

Press RETURN to get started!

Honestly, that was the worst part. Without a password I am now able to get into the administration mode using the command “enable”. As I am interested in the previous configuration on the device I can copy it from the memory. That’s how it is done:

Router>enable
Router#copy startup-config running-config
Destination filename [running-config]?
1324 bytes copied in 2.35 secs (662 bytes/sec)
Router#

In theory we are ready to sneak around, but I have to admit, if things break, I don’t want to fiddle around with the password anymore, so I overwrote it, changing the ‘enable secret’:

Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#enable secret < password >
Router(config)#^Z

Now we are really ready. Our configuration rests in memory only, so we need to copy it back using: copy running-config startup-config

Last but not least we need to tell the device to boot from the old config again – which is done using “config-register 0x2102”. Then we are done, ready for all further resets and games.