Hone

Lessons · Network switches · password recovery

Getting back into a switch nobody has the password for

The configuration register decides whether the startup configuration is read at boot. 0x2142 skips it; 0x2102 is normal.

Hone is a place to practise programming. This is one of its lessons, written out in full and free to read without an account.

What it is for

You will inherit a switch whose password left with somebody. This is the documented way back in, and it works because it needs physical access to the console, which is the point.

How to think about it

Skip the configuration, boot, then LOAD it deliberately with copy startup-config running-config so nothing is lost, set a new secret, put the register back, and save. The last two steps are the ones people forget.

Worked example

enable
The console gets you here on a box booted without its configuration.
configure terminal
Into configuration mode.
config-register 0x2142
The next boot will skip the startup configuration.
end
Out.
write memory
The register setting has to survive the reload, so it is saved.
reload
It comes back with defaults, and no password, because the configuration was skipped rather than erased.
enable
Straight in.
configure terminal
And now the recovery proper.
enable secret Ledger-4-Room
A password you know.
config-register 0x2102
Back to normal, or the switch skips its own configuration for ever.
end
Out.
write memory
Saved. Miss this and the whole recovery is undone by the next power cut.

Your turn

Set the register back to its normal value.

config-register

The trap

Erasing the startup configuration instead of skipping it. That gets you in too, and it takes the whole configuration with it: every VLAN, every port, every description.

Practise password recovery on HoneA question on it now, a coding challenge where there is one, and it is remembered for review. Free, no email needed.