Cisco PIX /ASA 防火墙密码恢复

最新推荐文章于 2019-12-17 20:42:35 发布

weixin_33736832

最新推荐文章于 2019-12-17 20:42:35 发布

阅读量182

点赞数

原文链接：http://blog.51cto.com/studysccm/338572

版权

Cisco PIX /ASA 防火墙密码恢复

Cisco ASA 防火墙密码恢复

＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

Cisco ASA的密码恢复过程很像路由器了，也是通过修改配置寄存器的值来实现。就不要密码恢复文件了。

1，密码恢复准备东东

A，PC机

B，ASA配置线

我们需要通过配置线把PC机的COM口与ASA的控制接口相连。

2，密码恢复程序

首先，我们打开PC机的超级终端，然后启动ASA后迅速按ESC或CTRL+BREAK 键进入Rommon状态。

You can press the Esc (Escape) key after "Use BREAK or ESC to interrupt boot" is shown. This will take you into ROMMON mode, as follows:

rommon #0>

然后我们打入命令confreg，进行配置寄存器值的修改，有两种方法，一种是通过输入ConfReg命令一步一步回答菜单如下：

rommon #1> confreg

Current Configuration Register: 0x00000011

Configuration Summary:

boot TFTP p_w_picpath, boot default p_w_picpath from Flash on netboot failure

Do you wish to change this configuration? y/n [n]: y

所有都按照默认回答,在问"disable system configuration?" 的时候,选择y.

这里将0X11启动模式转变到0X41模式.

第二种方法就是直接使用命令ConfReg 0x41修改配置寄存器的值。如下：

rommon #1> confreg 0x41

Update Config Register (0x41) in NVRAM...

修改后，就可以重启

rommon #2> boot

启动成功进入ASA以后,enable密码为空.

ciscoasa> enable

Password:<cr>

ciscoasa# copy startup-config running-config

ciscoasa# configure terminal

设置新的密码

ciscoasa(config)# password PIXPa55

ciscoasa(config)# enable password PIXp455

ciscoasa(config)# username BluShin password Goodp455

修改会原来的配置寄存器的值

ciscoasa(config)# config-register 0x11

保存配置文件，切记，否则新密码无效

ciscoasa(config)# copy running-config startup-config

后记

====================

有时候我们为了加强安全性，打入了no service password-recovery命令。这时候进行密码恢复时，就不能通过修改配置寄存器的值来实现了，而只能删除所有文件来实现，当然删除的文件会包括配置文件和OS文件。

ciscoasa(config)# no service password-recovery

WARNING: Saving "no service password-recovery" in the startup-config will disable password recovery via the PIX Password Lockout Utility. The only means of recovering from lost or forgotten passwords will be for the PIX Password Lockout Utility to erase all file systems including configuration files and p_w_picpaths.You should make a backup of your configuration and have a mechanism to restore p_w_picpaths from the Monitor Mode command line.

提示两点：

1、恢复的时候会清除所有配置

2、需要保存配置文件，并有一种方式从Monitor Mode command line得到恢复的IMAGES

密码恢复过程：建立物理CONSOLE连接，RELOAD（命令）设备

press the Esc (Escape) key after "Use BREAK or ESC to interrupt boot" is shown

提示：

a new p_w_picpath must be downloaded via ROMMON.

Erase all file systems? y/n [n]: yes

Disk1: is not present.

Enabling password recovery...

rommon #0>

rommon #0> ADDRESS=192.168.10.1

rommon #1> SERVER=192.168.10.250

rommon #3> interface GigabitEthernet0/0

GigabitEthernet0/0

MAC Address: 000f.f775.4b54

rommon #4> file asa702.bin

rommon #5> tftpdnld

tftp sa702.bin@192.168.10.250 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Note

The security appliance downloads the system p_w_picpath file in memory and boots up the device. However, the downloaded system p_w_picpath is not stored in flash.

这里提示只在MEMORY而不保存到FLASH中。

此时可以进入：

ciscoasa> enable

ciscoasa# copy tftp: running-config

Address or name of remote host []? 192.168.10.250

Source filename []? CiscoASA.conf

需要将以前保存的配置文件载入到设备中然后重设密码，并保存即可

这里有两个安全提高：

1、IMEGE保存在TFTP、备份文件也保存在另外的位置

2、擦除了使用的配置文件

注意：如果TFTP不在同一网段，则：

rommon #2> GATEWAY 192.168.10.100

注意：TFTP的参数是需要预先配置好的，为密码恢复做准备，示例如下：是在rommon中完成的

Example 4-49. Setting Up TFTP Parameters

rommon #0> ADDRESS 192.168.10.1

rommon #1> SERVER 192.168.10.250

rommon #2> interface GigabitEthernet0/0

GigabitEthernet0/0

MAC Address: 000f.f775.4b54

rommon #3> file ASA702.bin

rommon #4> set 检查参数

rommon #5> tftpdnld 开始下载

tftp ASA702.bin@192.168.10.250 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Cisco PIX 防火墙密码恢复

＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

PIX的密码恢复有两种方式，一种是通过软驱，另一种是无软驱实现。由于新的型号都没有带软驱，所以我只介绍无软驱恢复方法。不管怎样，PIX的密码恢复和路由器稍有不同,都需要用专门的密码恢复文件来进行恢复.不同的PIXos选用的密码恢复文件是不同的，现在大部分的PIXos都是7.0和8.0，所以我们选用这两个版本的密码恢复文件实验。np70.bin (7.0 and 8.0 release)

1，密码恢复准备东东

A，PC机

B，PIX配置线和交叉线，用与PIX连接

C，密码恢复文件( np70.bin)

D，TFTP服务软件

我们需要把PC机与PIX接口相连，一个通过配置线是PC的COM口与PIX的控制口相连，另一个是PC的网卡与PIX的某一以太接口相连。然后我们在PC机上开启Tftp服务，并且把np70.bin文件放在Tftp目录下。

2，密码恢复程序

首先，开启超级终端，然后在启动PIX的时候快速按ESC或者BREAK,进入Rom Moniter状态.我们会看到如下信息。

CISCO SYSTEMS PIX FIREWALL

Embedded BIOS Version 4.3.207 01/02/02 16:12:22.73

Compiled by morlee

32 MB RAM

PCI Device Table.

Bus Dev Func VendID DevID Class Irq

00 00 00 8086 7192 Host Bridge

00 07 00 8086 7110 ISA Bridge

00 07 01 8086 7111 IDE Controller

00 07 02 8086 7112 Serial Bus 9

00 07 03 8086 7113 PCI Bridge

00 0D 00 8086 1209 Ethernet 11

00 0E 00 8086 1209 Ethernet 10

Cisco Secure PIX Firewall BIOS (4.2) #0: Mon Dec 31 08:34:35 PST 2001

Platform PIX-506E

System Flash=E28F640J3 @ 0xfff00000

Use BREAK or ESC to interrupt flash boot.

Use SPACE to begin flash boot immediately.

Flash boot interrupted.

0: i8255X @ PCI(bus:0 dev:14 irq:10)

1: i8255X @ PCI(bus:0 dev:13 irq:11)

Ethernet auto negotiation timed out.

Ethernet port 1 could not be initialized.

Use ? for help.

我们输入"?"查看命令。

monitor> ?

? this help message 帮助命令

address [addr] set IP address of the PIX interface on which

the TFTP server resides 设置PIX与TFTPserver相连接口IP地址

file [name] set boot file name 配置需要tftp传输的文件名字

gateway [addr] set IP gateway 配置网关

help this help message

interface [num] select TFTP interface 进入配置接口模拟

ping <addr> send ICMP echo

reload halt and reload system 重启

server [addr] set server IP address 指定Tftp服务器地址

tftp TFTP download 传输文件

timeout TFTP timeout

trace toggle packet tracing

我们进行密码恢复命令：

monitor> interface 0 #进入到与PC机相连的eth0接口模式下

0: i8255X @ PCI(bus:0 dev:14 irq:10)

1: i8255X @ PCI(bus:0 dev:13 irq:11)

Using 0: i82557 @ PCI(bus:0 dev:14 irq:10), MAC: 000d.bc7e.d97a

monitor>address 192.168.11.11 #设置接口IP地址

address 192.168.11.11

monitor> file np70.bin #指定需要tftp的文件

file np70.bin

monitor> ping 192.168.11.88 #测试tftp sever地址

Sending 5, 100-byte 0x9e5e ICMP Echoes to 192.168.11.88, timeout is 4 seconds:

!!!!!

Success rate is 100 percent (5/5)

monitor> server 192.168.11.88 #设置tftp服务器IP地址

server 192.168.11.88

monitor> tftp #开始传输文件

tftp

np70.bin@192.168.11.88 ..........................................................................

......................................................................

Received 129024 bytes

Cisco Secure PIX Firewall password tool (3.0) #0: Wed Mar 27 11:02:16 PST 2002

System Flash=E28F640J3 @ 0xfff00000

BIOS Flash=am29f400b @ 0xd8000

Do you wish to erase the passwords? [yn] y

The following lines will be removed from the configuration:

enable password mLbCjoY6Ql1vh0o4 encrypted

passwd i/Y4R6kWHD6hjJ/v encrypted

Do you want to remove the commands listed above from the configuration? [yn] y

Passwords and aaa commands have been erased.

Rebooting..

CISCO SYSTEMS PIX FIREWALL

Embedded BIOS Version 4.3.207 01/02/02 16:12:22.73

Compiled by morlee

32 MB RAM

PCI Device Table.

Bus Dev Func VendID DevID Class Irq

00 00 00 8086 7192 Host Bridge

00 07 00 8086 7110 ISA Bridge

00 07 01 8086 7111 IDE Controller

00 07 02 8086 7112 Serial Bus 9

00 07 03 8086 7113 PCI Bridge

00 0D 00 8086 1209 Ethernet 11

00 0E 00 8086 1209 Ethernet 10

Cisco Secure PIX Firewall BIOS (4.2) #0: Mon Dec 31 08:34:35 PST 2001

Platform PIX-506E

System Flash=E28F640J3 @ 0xfff00000

Use BREAK or ESC to interrupt flash boot.

Use SPACE to begin flash boot immediately.

Reading 1536512 bytes of p_w_picpath from flash.

##################################################################################

32MB RAM

System Flash=E28F640J3 @ 0xfff00000

BIOS Flash=am29f400b @ 0xd8000

mcwa i82559 Ethernet at irq 11 MAC: 000d.bc7e.d97b

mcwa i82559 Ethernet at irq 10 MAC: 000d.bc7e.d97a

-----------------------------------------------------------------------

|| ||

|||| ||||

..:||||||:..:||||||:..

c i s c o S y s t e m s

Private Internet eXchange

-----------------------------------------------------------------------

Cisco PIX Firewall

Cisco PIX Firewall Version 7.2(2)

Licensed Features:

Failover: Disabled

×××-DES: Enabled

×××-3DES: Disabled

Maximum Interfaces: 2

Cut-through Proxy: Enabled

Guards: Enabled

URL-filtering: Enabled

Inside Hosts: Unlimited

Throughput: Limited

IKE peers: Unlimited

****************Warning ************************

Compliance with U.S. Export Laws and Regulations - Encryption.

This product performs encryption and is regulated for export

by the U.S. Government.

This product is not authorized for use by persons located

outside the United States and Canada that do not have prior

approval from Cisco Systems, Inc. or the U.S. Government.

This product may not be exported outside the U.S. and Canada

either by physical or electronic means without PRIOR approval

of Cisco Systems, Inc. or the U.S. Government.

Persons outside the U.S. and Canada may not re-export, resell

or transfer this product by either physical or electronic means

without prior approval of Cisco Systems, Inc. or the U.S.

Government.

********************* Warning ***********************

Restricted Rights Legend

Use, duplication, or disclosure by the Government is

subject to restrictions as set forth in subparagraph

Rights clause at FAR sec. 52.227-19 and subparagraph

Software clause at DFARS sec. 252.227-7013.

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, California 95134-1706

Cryptochecksum(changed): f72dbc0b 3560939d 6544ff4a 70d7e598

Type help or '?' for a list of available commands.

pixfirewall> en

Password: <cr>

pixfirewall#

转载于:https://blog.51cto.com/studysccm/338572

weixin_33736832

关注

0
点赞
踩
2

收藏

觉得还不错? 一键收藏
0
评论
Cisco PIX /ASA 防火墙密码恢复

Cisco PIX /ASA 防火墙密码恢复Cisco ASA 防火墙密码恢复＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝ Cisco ASA的密码恢复过程很像路由器了，也是通过修改配置寄存器的值来实现。就不要密码恢复文件了。1，密码恢复准备东东A，PC机B，ASA配置线我们需要通过配置线把PC机的COM口与ASA的控制接口相连。2，密码恢复程序首先，我们打开PC机的超级终...
复制链接

扫一扫