Is it possible to crack the enable password of Cisco 19 series router, other than resetting it ?
For all actions you will need console cable and direct access to your router!
You can load device in rommon and set config-register to 2142, then reload device again. It will load into default configuration and by entering
configure memory you will get into nvram-configuration mode where you can change your enable secret.
Don't forget after that change your config-register back to 2102.
So steps in order:
- Restart device
- Press Ctrl+Z right after you see first boot messages
- In rommon enter:
confreg 0x2142 reset
- Boot. Device now with default config. Do
enable conf memory
- Change enable secret
- Change config-register back to normal boot
(conf-t)# config-register 0x2102 write
- End up with reload
The key difference between
enable password ... and
enable secret ... is that
enable password stores the password using a reversible format and
enable secret uses a one-way MD5-based hash. Many configurations have
enable password as well as
enable secret and that makes "cracking" simple.
But even if the machine is using only
enable secret if you have a copy of the one-way hashed key then it's usually trivial to "crack" it due to the poor choice of enable passwords of a typical installation. Many will fall to a simple dictionary-based attack.
For this reason it's usually better to have a random enable secret (recorded offline) and use the AAA features to allow RADIUS authentication to login into the machine and againt to enter enable mode. That RADIUS authentication can require an access token such as YubiKey, (or, as a less secure choice, gateway into corporate authentication systems where good password practices are more easily enforced).
Cisco do make it easy to zeroise and recover a unit where you no longer have access, and another member has given that procedure in their answer.