Password recovery on a Cisco PIX 501
Posted by creining | Filed under Security
I found myself with a couple Cisco PIX 501s that were pulled from production awhile ago and needed to be redeployed. The passwords were unknown. So, I used the document Password Recovery and AAA Configuration Recovery Procedure for the PIX in order to reset the password. I needed to download the binary file available on that webpage for the version of the PIX software that was installed as well a TFTP server. Working from a Windows machine I chose SolarWinds TFTP server. I followed the steps under the section “PIX Without a Floppy Drive”. This involved going into monitor mode on the PIX by booting it up and hitting ESC, setting the interface to use by issuing ‘interface 0′, setting the IP address of the 0 interface with the ‘address’ command, setting the filename to retrieve from the server with the command ‘file np63.bin’ (the binary file I downloaded), and setting the server with the command ‘server’ (the IP of the TFTP server):
monitor> interface 0 0: i8255X @ PCI(bus:0 dev:17 irq:9 ) 1: i8255X @ PCI(bus:0 dev:18 irq:10) Using 0: i82557 @ PCI(bus:0 dev:17 irq:9 ), MAC: 000e.83b2.e0a4 monitor> address 10.3.10.24 address 10.3.10.24 monitor> file np63.bin file np63.bin monitor> server 10.3.10.25 server 10.3.10.25
At this point it was possible to ping the TFTP server and retrieve the binary file with the command ‘tftp’:
monitor> ping 10.3.10.25 Sending 5, 100-byte 0x891a ICMP Echoes to 10.3.10.25, timeout is 4 seconds: !!!!! Success rate is 100 percent (5/5) monitor> tftp tftp np63.bin@10.3.10.25........................................................ ................................................................................ ............................................. Received 92160 bytes Cisco Secure PIX Firewall password tool (3.0) #0: Thu Jul 17 08:01:09 PDT 2003 Flash=E28F640J3 @ 0x3000000 BIOS Flash=E28F640J3 @ 0xD8000 Do you wish to erase the passwords? [yn] y
The default telnet password after this is “cisco” and there is no enable password. Pretty painless.
Comments are closed.