Is it possible to crack the enable password of Cisco 19 series router, other than resetting it ?

  • Do you mean decrypt? Is it a type 7 or a type 5 hash?
    – John K.
    Aug 2 '17 at 11:50
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Feb 19 '18 at 17:05

For all actions you will need console cable and direct access to your router!

You can load device in rommon and set config-register to 2142, then reload device again. It will load into default configuration and by entering configure memory you will get into nvram-configuration mode where you can change your enable secret. Don't forget after that change your config-register back to 2102.

So steps in order:

  1. Restart device
  2. Press Ctrl+Z right after you see first boot messages
  3. In rommon enter:
confreg 0x2142
  1. Boot. Device now with default config. Do
conf memory
  1. Change enable secret
  2. Change config-register back to normal boot
(conf-t)# config-register 0x2102
  1. End up with reload

The key difference between enable password ... and enable secret ... is that enable password stores the password using a reversible format and enable secret uses a one-way MD5-based hash. Many configurations have enable password as well as enable secret and that makes "cracking" simple.

But even if the machine is using only enable secret if you have a copy of the one-way hashed key then it's usually trivial to "crack" it due to the poor choice of enable passwords of a typical installation. Many will fall to a simple dictionary-based attack.

For this reason it's usually better to have a random enable secret (recorded offline) and use the AAA features to allow RADIUS authentication to login into the machine and againt to enter enable mode. That RADIUS authentication can require an access token such as YubiKey, (or, as a less secure choice, gateway into corporate authentication systems where good password practices are more easily enforced).

Cisco do make it easy to zeroise and recover a unit where you no longer have access, and another member has given that procedure in their answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.