Is it possible to crack the enable password of Cisco 19 series router?

Question

Is it possible to crack the enable password of Cisco 19 series router, other than resetting it ?

Answer 1

For all actions you will need console cable and direct access to your router!

You can load device in rommon and set config-register to 2142, then reload device again. It will load into default configuration and by entering configure memory you will get into nvram-configuration mode where you can change your enable secret. Don't forget after that change your config-register back to 2102.

So steps in order:

1. Restart device
2. Press Ctrl+Z right after you see first boot messages
3. In rommon enter:

confreg 0x2142
reset

4. Boot. Device now with default config. Do

enable
conf memory

5. Change enable secret
6. Change config-register back to normal boot

(conf-t)# config-register 0x2102
write

7. End up with reload

Answer 2

The key difference between enable password ... and enable secret ... is that enable password stores the password using a reversible format and enable secret uses a one-way MD5-based hash. Many configurations have enable password as well as enable secret and that makes "cracking" simple.

But even if the machine is using only enable secret if you have a copy of the one-way hashed key then it's usually trivial to "crack" it due to the poor choice of enable passwords of a typical installation. Many will fall to a simple dictionary-based attack.

For this reason it's usually better to have a random enable secret (recorded offline) and use the AAA features to allow RADIUS authentication to login into the machine and againt to enter enable mode. That RADIUS authentication can require an access token such as YubiKey, (or, as a less secure choice, gateway into corporate authentication systems where good password practices are more easily enforced).

Cisco do make it easy to zeroise and recover a unit where you no longer have access, and another member has given that procedure in their answer.