Friday, February 23, 2018

Cisco c3550 Password Recovery from SPARC Solaris

Cisco c3550 Password Recovery from SPARC Solaris


Abstract:

Sometimes, old lab equipment may sit around, operating well for years without interruption. In some cases, the password for older network lab equipment may have had it's authentication passwords lost. Network equipment is often in the same rack as a remote server. A Solaris Server can be easily used to gain console on various serial based network equipment to perform password recovery.

SPARC Server:

Physical serial ports on SPARC Solaris servers are often defined as tty's, vs pts's (Pseudo Terminals.)
Log into a server via a pts or pseudo terminal:
Last login: Tue Feb 20 14:44:39 2018 from sun1593.daytono
Sun Microsystems Inc.   SunOS 5.9       Generic May 2002
INTR=Ctrl-C ERASE=Ctrl-H KILL=Ctrl-U
/dev/pts/1
sun9999/user$
Example of physical terminal ports available on servers with a hardware serial port:
sun9999/user$ ls -al /dev/tty* | head -4
lrwxrwxrwx 1 root other 26 Mar 12 2016 /dev/tty ->
../devices/pseudo/sy@0:tty
lrwxrwxrwx 1 root root 6 Mar 12 2016 /dev/ttya -> term/a
lrwxrwxrwx 1 root root 6 Mar 12 2016 /dev/ttyb -> term/b
lrwxrwxrwx 1 root root 30 Mar 12 2016 /dev/ttyp0 ->
../devices/pseudo/ptsl@0:ttyp0
The ttya port is used for console access, while ttyb can be used with a Cisco console cable. The default speed for older equipment is 9600 baud.
sun9999/user$ tip -9600 /dev/ttyb
connected

Process for password recovery or just normal console usage can begin.

Cisco Console Equipment:

Depending on the configuration, a single carriage return may result in a read-only prompt or an  authentication sequence.
Switch>

A normal power cycle of the switch may look like the following on the console.

Switch> Base ethernet MAC Address: 00:11:93:a1:70:80

Xmodem file system is available.

The password-recovery mechanism is enabled.

Initializing Flash...
flashfs[0]: 87 files, 4 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 15998976
flashfs[0]: Bytes used: 6642176
flashfs[0]: Bytes available: 9356800
flashfs[0]: flashfs fsck took 16 seconds.
...done Initializing Flash.
Boot Sector Filesystem (bs:) installed, fsid: 3
Loading "flash:c3550-i9q3l2-mz.121-20.EA1a/c3550-i9q3l2-mz.121-20.EA1a.bin"...###########################################################################################################################################################################################################################################################################################################################################################################################################
File "flash:c3550-i9q3l2-mz.121-20.EA1a/c3550-i9q3l2-mz.121-20.EA1a.bin" uncompressed and installed, entry point: 0x3000
executing...
              Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706
Cisco Internetwork Operating System Software
IOS (tm) C3550 Software (C3550-I9Q3L2-M), Version 12.1(20)EA1a, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2004 by cisco Systems, Inc.
Compiled Mon 19-Apr-04 21:42 by yenanh
Image text-base: 0x00003000, data-base: 0x006B3454
Initializing flashfs...
flashfs[1]: 87 files, 4 directories
flashfs[1]: 0 orphaned files, 0 orphaned directories
flashfs[1]: Total bytes: 15998976
flashfs[1]: Bytes used: 6642176
flashfs[1]: Bytes available: 9356800
flashfs[1]: flashfs fsck took 8 seconds.
flashfs[1]: Initialization complete.
...done Initializing flashfs.
POST: CPU Buffer Tests : Begin
POST: CPU Buffer Tests : End, Status Passed
POST: CPU Interface Tests : Begin
POST: CPU Interface Tests : End, Status Passed
POST: Switch Core Tests : Begin
POST: Switch Core Tests : End, Status Passed
POST: CPU Interface 2nd Stage Tests : Begin
POST: CPU Interface 2nd Stage Tests : End, Status Passed
POST: CAM Subsystem Tests : Begin
POST: CAM Subsystem Tests : End, Status Passed
POST: Ethernet Controller Tests : Begin
POST: Ethernet Controller Tests : End, Status Passed
POST: ILP Controller Tests : Begin
POST: ILP Controller Tests : End, Status Passed
POST: Loopback Tests : Begin
POST: Loopback Tests : End, Status Passed
cisco WS-C3550-24-PWR (PowerPC) processor (revision H0) with 65526K/8192K bytes of memory.
Processor board ID CAT0829Z301
Last reset from warm-reset
Running Layer2/3 Switching Image
Ethernet-controller 1 has 12 Fast Ethernet/IEEE 802.3 interfaces
Ethernet-controller 2 has 12 Fast Ethernet/IEEE 802.3 interfaces
Ethernet-controller 3 has 1 Gigabit Ethernet/IEEE 802.3 interface
Ethernet-controller 4 has 1 Gigabit Ethernet/IEEE 802.3 interface
24 FastEthernet/IEEE 802.3 interface(s)
2 Gigabit Ethernet/IEEE 802.3 interface(s)
The password-recovery mechanism is enabled.
384K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:11:93:A1:70:80
Motherboard assembly number: 73-8100-08
Power supply part number: 341-0029-03
Motherboard serial number: CAT08290FL9
Power supply serial number: DTH082326P8
Model revision number: H0
Motherboard revision number: A0
Model number: WS-C3550-24PWR-SMI
System serial number: CAT0829Z301
Press RETURN to get started!
00:00:33: %SPANTREE-5-EXTENDED_SYSID: Extended SysId enabled for type vlan
00:00:35: %SYS-5-CONFIG_I: Configured from memory by console
00:00:36: %SYS-5-RESTART: System restarted --
Cisco Internetwork Operating System Software
IOS (tm) C3550 Software (C3550-I9Q3L2-M), Version 12.1(20)EA1a, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2004 by cisco Systems, Inc.
Compiled Mon 19-Apr-04 21:42 by yenanh
00:00:36: %SNMP-5-COLDSTART: SNMP agent on host Switch is undergoing a cold start
00:00:37: %LINK-5-CHANGED: Interface Vlan1, changed state to administratively down
00:00:38: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
Switch>

A single carriage return would bring a prompt or authentication sequence.

Cisco Switch Password Recovery

On the 3550 model switch, there is a button on the front console, which can be depressed during the power down to power up transition, which will bring the switch into ROM mode.


Base ethernet MAC Address: 00:11:93:a1:70:80

Xmodem file system is available.

The password-recovery mechanism is enabled.

The system has been interrupted prior to initializing the
flash filesystem.  The following commands will initialize
the flash filesystem, and finish loading the operating
system software:
    flash_init
    boot
switch:
Note: The "System" light may flash 22 times, and cease flashing. Release the "mode" switch.


After the mode switch is released, the "System" light may continue to blink. Perform a "flash_init"

switch: flash_init

Initializing Flash...

flashfs[0]: 87 files, 4 directories

flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 15998976
flashfs[0]: Bytes used: 6642176
flashfs[0]: Bytes available: 9356800
flashfs[0]: flashfs fsck took 16 seconds.
...done Initializing Flash.
Boot Sector Filesystem (bs:) installed, fsid: 3
switch:
Note: This may take about 12 seconds.


Perform "load_helper", rename the configuration file holding the password.

switch: dir flash:/

Directory of flash://


2    -rwx  0                        env_vars
3    -rwx  348                      system_env_vars
4    -rwx  5                        private-config.text
6    -rwx  616                      vlan.dat
8    drwx  192                      c3550-i9q3l2-mz.121-20.EA1a
7    -rwx  3940                     config.text
9356800 bytes available (6642176 bytes used)
switch: rename flash:config.text flash:config.old
switch: dir flash:/
Directory of flash://
2    -rwx  0                        env_vars
3    -rwx  348                      system_env_vars
4    -rwx  5                        private-config.text
6    -rwx  616                      vlan.dat
8    drwx  192                      c3550-i9q3l2-mz.121-20.EA1a
7    -rwx  3940                     config.old
9356800 bytes available (6642176 bytes used)
switch:
Note: When the switch reboots, the file will be regenerated.


Now, "boot" switch and "[control][c]" to gain user mode, if initial configuration is not needed.
switch: boot
Loading "flash:c3550-i9q3l2-mz.121-20.EA1a/c3550-i9q3l2-mz.121-20.EA1a.bin"...###########################################################################################################################################################################################################################################################################################################################################################################################################

File "flash:c3550-i9q3l2-mz.121-20.EA1a/c3550-i9q3l2-mz.121-20.EA1a.bin" uncompressed and installed, entry point: 0x3000
executing...

              Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706



Cisco Internetwork Operating System Software
IOS (tm) C3550 Software (C3550-I9Q3L2-M), Version 12.1(20)EA1a, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2004 by cisco Systems, Inc.
Compiled Mon 19-Apr-04 21:42 by yenanh
Image text-base: 0x00003000, data-base: 0x006B3454


Initializing flashfs...
flashfs[1]: 87 files, 4 directories
flashfs[1]: 0 orphaned files, 0 orphaned directories
flashfs[1]: Total bytes: 15998976
flashfs[1]: Bytes used: 6642176
flashfs[1]: Bytes available: 9356800
flashfs[1]: flashfs fsck took 8 seconds.
flashfs[1]: Initialization complete.
...done Initializing flashfs.
POST: CPU Buffer Tests : Begin
POST: CPU Buffer Tests : End, Status Passed
POST: CPU Interface Tests : Begin
POST: CPU Interface Tests : End, Status Passed
POST: Switch Core Tests : Begin
POST: Switch Core Tests : End, Status Passed
POST: CPU Interface 2nd Stage Tests : Begin
POST: CPU Interface 2nd Stage Tests : End, Status Passed
POST: CAM Subsystem Tests : Begin
POST: CAM Subsystem Tests : End, Status Passed
POST: Ethernet Controller Tests : Begin
POST: Ethernet Controller Tests : End, Status Passed
POST: ILP Controller Tests : Begin
POST: ILP Controller Tests : End, Status Passed
POST: Loopback Tests : Begin
POST: Loopback Tests : End, Status Passed

cisco WS-C3550-24-PWR (PowerPC) processor (revision H0) with 65526K/8192K bytes of memory.
Processor board ID CAT0829Z301
Last reset from warm-reset
Running Layer2/3 Switching Image

Ethernet-controller 1 has 12 Fast Ethernet/IEEE 802.3 interfaces
Ethernet-controller 2 has 12 Fast Ethernet/IEEE 802.3 interfaces
Ethernet-controller 3 has 1 Gigabit Ethernet/IEEE 802.3 interface
Ethernet-controller 4 has 1 Gigabit Ethernet/IEEE 802.3 interface
24 FastEthernet/IEEE 802.3 interface(s)
2 Gigabit Ethernet/IEEE 802.3 interface(s)

The password-recovery mechanism is enabled.
384K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:11:93:A1:70:80
Motherboard assembly number: 73-8100-08
Power supply part number: 341-0029-03
Motherboard serial number: CAT08290FL9
Power supply serial number: DTH082326P8
Model revision number: H0
Motherboard revision number: A0
Model number: WS-C3550-24PWR-SMI
System serial number: CAT0829Z301

         --- System Configuration Dialog ---
Would you like to enter the initial configuration dialog? [yes/no]:
00:00:33: %SPANTREE-5-EXTENDED_SYSID: Extended SysId enabled for type vlan
00:00:37: %SYS-5-RESTART: System restarted --
Cisco Internetwork Operating System Software
IOS (tm) C3550 Software (C3550-I9Q3L2-M), Version 12.1(20)EA1a, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2004 by cisco Systems, Inc.
Compiled Mon 19-Apr-04 21:42 by yenanh
00:00:37: %SNMP-5-COLDSTART: SNMP agent on host Switch is undergoing a cold start


Press RETURN to get started!


00:01:29: %LINK-5-CHANGED: Interface Vlan1, changed state to administratively down
00:01:30: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
Switch>
Note: the switch is now in unprivileged "user" mode.

Configuration work can be done from the "enable" privileged mode.


Switch> enable
Switch# show running-config
Building configuration...
Current configuration : 1995 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
!
ip subnet-zero
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
interface FastEthernet0/1
 switchport mode dynamic desirable
!
interface FastEthernet0/2
 switchport mode dynamic desirable
!
interface FastEthernet0/3
 switchport mode dynamic desirable
!
interface FastEthernet0/4
 switchport mode dynamic desirable
!
interface FastEthernet0/5
 switchport mode dynamic desirable
!
interface FastEthernet0/6
 switchport mode dynamic desirable
!
interface FastEthernet0/7
 switchport mode dynamic desirable
!
interface FastEthernet0/8
 switchport mode dynamic desirable
!
interface FastEthernet0/9
 switchport mode dynamic desirable
!
interface FastEthernet0/10
 switchport mode dynamic desirable
!
interface FastEthernet0/11
 switchport mode dynamic desirable
!
interface FastEthernet0/12
 switchport mode dynamic desirable
!
interface FastEthernet0/13
 switchport mode dynamic desirable
!
interface FastEthernet0/14
 switchport mode dynamic desirable
!
interface FastEthernet0/15
 switchport mode dynamic desirable
!
interface FastEthernet0/16
 switchport mode dynamic desirable
!
interface FastEthernet0/17
 switchport mode dynamic desirable
!
interface FastEthernet0/18
 switchport mode dynamic desirable
!
interface FastEthernet0/19
 switchport mode dynamic desirable
!
interface FastEthernet0/20
 switchport mode dynamic desirable
!
interface FastEthernet0/21
 switchport mode dynamic desirable
!
interface FastEthernet0/22
 switchport mode dynamic desirable
!
interface FastEthernet0/23
 switchport mode dynamic desirable
!
interface FastEthernet0/24
 switchport mode dynamic desirable
!
interface GigabitEthernet0/1
 switchport mode dynamic desirable
!
interface GigabitEthernet0/2
 switchport mode dynamic desirable
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
ip http server
!
!
line con 0
line vty 5 15
!
!
end

Switch#

The switch is ready to be configured.

A Simple Configuration

Name switch "C3550", encrypt "cisco" password in MD5, and save running configuration.

Switch# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# hostname C3550


C3550(config)# enable secret cisco
C3550# copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]
C3550(config)# exit

Note: the simple "cisco" password above should not be used, choose a stronger password.


The saved password can  be tested via a restart of the switch.

Show Saved Startup Configuration

The running and startup configuration should be the same. Show the startup configuration.
C3550# show startup-config
Using 2041 out of 393216 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname C3550
!
enable secret 5 $1$nOpq$3Hg6AloyI74Vq0HV0uwTq0
!
ip subnet-zero
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
interface FastEthernet0/1
switchport mode dynamic desirable
!
interface FastEthernet0/2
switchport mode dynamic desirable
!
interface FastEthernet0/3
switchport mode dynamic desirable
!
interface FastEthernet0/4
switchport mode dynamic desirable
!
interface FastEthernet0/5
switchport mode dynamic desirable
!
interface FastEthernet0/6
switchport mode dynamic desirable
!
interface FastEthernet0/7
switchport mode dynamic desirable
!
interface FastEthernet0/8
switchport mode dynamic desirable
!
interface FastEthernet0/9
switchport mode dynamic desirable
!
interface FastEthernet0/10
switchport mode dynamic desirable
!
interface FastEthernet0/11
switchport mode dynamic desirable
!
interface FastEthernet0/12
switchport mode dynamic desirable
!
interface FastEthernet0/13
switchport mode dynamic desirable
!
interface FastEthernet0/14
switchport mode dynamic desirable
!
interface FastEthernet0/15
switchport mode dynamic desirable
!
interface FastEthernet0/16
switchport mode dynamic desirable
!
interface FastEthernet0/17
switchport mode dynamic desirable
!
interface FastEthernet0/18
switchport mode dynamic desirable
!
interface FastEthernet0/19
switchport mode dynamic desirable
!
interface FastEthernet0/20
switchport mode dynamic desirable
!
interface FastEthernet0/21
switchport mode dynamic desirable
!
interface FastEthernet0/22
switchport mode dynamic desirable
!
interface FastEthernet0/23
switchport mode dynamic desirable
!
interface FastEthernet0/24
switchport mode dynamic desirable
!
interface GigabitEthernet0/1
switchport mode dynamic desirable
!
interface GigabitEthernet0/2
switchport mode dynamic desirable
!
interface Vlan1
no ip address
shutdown
!
ip classless
ip http server
!
!
line con 0
line vty 5 15
!
!
end

C3550#

Note: the added configuration lines above are easily identified.

Test Startup Configuration  through Switch Reload

Reboot switch with "reload" to test simple configuration and privileged "enable" password.
C3550# reload
Proceed with reload? [confirm]
01:02:58: %SYS-5-RELOAD: Reload requested
Base ethernet MAC Address: 00:11:93:a1:70:80
Xmodem file system is available.
The password-recovery mechanism is enabled.
Initializing Flash...
flashfs[0]: 88 files, 4 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 15998976
flashfs[0]: Bytes used: 6644224
flashfs[0]: Bytes available: 9354752
flashfs[0]: flashfs fsck took 16 seconds.
...done Initializing Flash.
Boot Sector Filesystem (bs:) installed, fsid: 3
Loading "flash:c3550-i9q3l2-mz.121-20.EA1a/c3550-i9q3l2-mz.121-20.EA1a.bin"...###########################################################################################################################################################################################################################################################################################################################################################################################################
File "flash:c3550-i9q3l2-mz.121-20.EA1a/c3550-i9q3l2-mz.121-20.EA1a.bin" uncompressed and installed, entry point: 0x3000
executing...

              Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706


Cisco Internetwork Operating System Software
IOS (tm) C3550 Software (C3550-I9Q3L2-M), Version 12.1(20)EA1a, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2004 by cisco Systems, Inc.
Compiled Mon 19-Apr-04 21:42 by yenanh
Image text-base: 0x00003000, data-base: 0x006B3454

Initializing flashfs...
flashfs[1]: 88 files, 4 directories
flashfs[1]: 0 orphaned files, 0 orphaned directories
flashfs[1]: Total bytes: 15998976
flashfs[1]: Bytes used: 6644224
flashfs[1]: Bytes available: 9354752
flashfs[1]: flashfs fsck took 8 seconds.
flashfs[1]: Initialization complete.
...done Initializing flashfs.
POST: CPU Buffer Tests : Begin
POST: CPU Buffer Tests : End, Status Passed
POST: CPU Interface Tests : Begin
POST: CPU Interface Tests : End, Status Passed
POST: Switch Core Tests : Begin
POST: Switch Core Tests : End, Status Passed
POST: CPU Interface 2nd Stage Tests : Begin
POST: CPU Interface 2nd Stage Tests : End, Status Passed
POST: CAM Subsystem Tests : Begin
POST: CAM Subsystem Tests : End, Status Passed
POST: Ethernet Controller Tests : Begin
POST: Ethernet Controller Tests : End, Status Passed
POST: ILP Controller Tests : Begin
POST: ILP Controller Tests : End, Status Passed
POST: Loopback Tests : Begin
POST: Loopback Tests : End, Status Passed
cisco WS-C3550-24-PWR (PowerPC) processor (revision H0) with 65526K/8192K bytes of memory.
Processor board ID CAT0829Z301
Last reset from warm-reset
Running Layer2/3 Switching Image
Ethernet-controller 1 has 12 Fast Ethernet/IEEE 802.3 interfaces
Ethernet-controller 2 has 12 Fast Ethernet/IEEE 802.3 interfaces
Ethernet-controller 3 has 1 Gigabit Ethernet/IEEE 802.3 interface
Ethernet-controller 4 has 1 Gigabit Ethernet/IEEE 802.3 interface
24 FastEthernet/IEEE 802.3 interface(s)
2 Gigabit Ethernet/IEEE 802.3 interface(s)
The password-recovery mechanism is enabled.
384K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:11:93:A1:70:80
Motherboard assembly number: 73-8100-08
Power supply part number: 341-0029-03
Motherboard serial number: CAT08290FL9
Power supply serial number: DTH082326P8
Model revision number: H0
Motherboard revision number: A0
Model number: WS-C3550-24PWR-SMI
System serial number: CAT0829Z301

Press RETURN to get started!

00:00:33: %SPANTREE-5-EXTENDED_SYSID: Extended SysId enabled for type vlan
00:00:35: %SYS-5-CONFIG_I: Configured from memory by console
00:00:35: %SYS-5-RESTART: System restarted --
Cisco Internetwork Operating System Software
IOS (tm) C3550 Software (C3550-I9Q3L2-M), Version 12.1(20)EA1a, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2004 by cisco Systems, Inc.
Compiled Mon 19-Apr-04 21:42 by yenanh
00:00:35: %SNMP-5-COLDSTART: SNMP agent on host C3550 is undergoing a cold start
00:00:37: %LINK-5-CHANGED: Interface Vlan1, changed state to administratively down
00:00:38: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
C3550>
C3550>enable
Password:
C3550#
Note: There is no remote access at this point and all interfaces are defaulted to VLAN1

The switch needs a complex password, but it will operate when  equipment is attached.