Course contents

Chapter 1: Cisco IOSLesson 7 of 10

Password recovery

Recover a lost enable password using the configuration register: ROMMON, 0x2142, loading the config and restoring 0x2102.

Intermediate · 9 min read

Technical definition

Password recovery on a Cisco router means interrupting the boot with a Break signal, booting without the saved configuration, loading the configuration manually, setting a new password and restoring the normal boot setting.

The idea

Example commands and output on this page were written from Cisco IOS documentation and generally described behaviour. They were not captured from a live device, so prompts and details can differ on your platform and version.

Router password recovery: the config register trick
Router password recovery: the config register trickTo recover a lost enable password on a Cisco router you break into ROMMON, set the configuration register to 0x2142 so the router ignores its saved configuration at boot, reboot, copy the saved configuration into memory, set a new password, restore the register to 0x2102 and save.1 Power cyclesend Breakwithin 60 s2 ROMMON promptconfreg 0x2142then reset3 Router bootsignoresstartup-config4 Skip setupanswer no,then enable5 Load configcopy startup-configrunning-config6 New passwordenable secret(new value)7 Restore registerconfig-register0x21028 Savecopy running-configstartup-configModels differ: some boot to a rommon prompt, others need 'confreg' without the equals sign. Check your platform.
Amber boxes are the two register changes. Forgetting step 7 means the router ignores its configuration at every reload. Physical access to the console is required, which is why a locked room is a security control.

Passwords live in the startup configuration. If the router boots without reading it, there is no enable password to enter. You then copy the saved configuration into memory yourself, change the password, and set the register back. These steps assume a typical Cisco router with a console cable and a terminal program.

Step by step

  1. Connect to the console and power cycle the router. Within 60 seconds, send a Break (in many terminal programs, Ctrl+Break, or Ctrl+C on some platforms). The prompt changes to rommon 1 >.
  2. Set the register to ignore NVRAM and restart:
    rommon 1 > confreg 0x2142 rommon 2 > reset

    ROMMON commands; the prompt number increases after each command.

  3. Answer no to the initial configuration dialog and press Enter to reach the Router> prompt, then enter enable. No password is asked.
  4. Copy the saved configuration into the running configuration and set a new password:
    Router# copy startup-config running-config Router# configure terminal Router(config)# enable secret NewStrongPassw0rd Router(config)# config-register 0x2102 Router(config)# interface GigabitEthernet0/0 Router(config-if)# no shutdown Router(config-if)# end Router# copy running-config startup-config

    Interfaces are shut down after a boot without a configuration, so enable each one you need. Passwords here are placeholders.

  5. Check the register is restored and reload when convenient: show version should end with 0x2102.

Common mistakes

What goes wrong during recovery
What goes wrong during recoveryMistake; Result. Running copy running-config startup-config before loading the old one: Overwrites the saved configuration with an empty one Forgetting to restore 0x2102: Router ignores its configuration at every reload Leaving interfaces shut down: Router is up but unreachable Break key not sent in time: Normal boot; try again within the first 60 secondsMistakeResultRunning copy running-configstartup-config beforeloading the old oneOverwrites the saved configuration with an empty oneForgetting to restore0x2102Router ignores its configuration at every reloadLeaving interfaces shutdownRouter is up but unreachableBreak key not sent in timeNormal boot; try again within the first 60 seconds

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The first mistake is the destructive one: always load the old configuration before saving.

Why it is also a security lesson

Recovery works because the device trusts physical access. Locked rooms, console passwords and, where you accept the trade-off, no service password-recovery are the controls.

Test yourself

Predict · scenario 1

In password recovery, which value do you set in ROMMON to boot without the startup configuration?

Predict · scenario 2

After booting with 0x2142, why must you run copy startup-config running-config before saving?

Predict · scenario 3

What is the main protection against this recovery method?

FAQ

Why can anyone do this?
Anyone with console access and the ability to reload can. That is why the router must be in a locked room. The attack needs physical presence, which is the protection.
Can I turn recovery off?
Yes: no service password-recovery stops the break-into-ROMMON method from working without erasing the configuration. If you then lose the password, the only way back is to wipe the configuration. Use it only with a safe backup.
Does this work on switches?
The idea is the same but the steps differ. On many Catalyst switches you hold the Mode button while powering on, then rename the configuration file in flash from the boot loader. Follow the guide for your model.