Juniper高端路由器的Root密码的破解方法和思路

针对常见的Juniper高端的企业级路由器产品，忘记密码是一件然网管非常头疼的事情。下面就提供一些破解root密码的方法，以Juniper MX 960为例子来说明，其它系列产品的路由器密码破解方式也是差不多的。

 1.Reboot the system...   （重启系统）
 2.From console ,interrupt the boot routine...
              Loading /boot/loader

         Consoles: serial port 

         BIOS drive C: is disk0

         BIOS drive D: is disk1

         BIOS 622kB/3392176kB available memory

                        ...

                        ...

                        ...

         /boot/modules/mac_pcap.ko size 0x1878 at 0xdf8000

         Hit [Enter] to boot immediately, or space bar for command prompt.

         Booting [/kernel] in 5 second...(sometimes the waittime is changeable)

  3.<Press the space bar at this point>
         Type '?' for a list of commands, 'help' for more detailed help.

OK      

  4.Enter into the single-user mode Type into :boot -s       (and press Enter...
 

         platform_early_bootinit: M/T Series Early Boot Initialization

         GDB: debug ports: sio

                           ...

                           ...

                           ...

    5.If you have the following system output ,enter :recovery ,and hit Enter and skip to step 9
 

       System watchdog timer disabled

       Enter full pathname of shell or 'recovery' for root password recovery or RETURN for /bin/sh: recovery

   6.Enter the shell:
      System watchdog timer disabled

      Jan  1 00:36:47 init: /etc/spwd.db: No such file or directory

      Enter full pathname of shell or RETURN for /bin/sh:

   7.Mount the virtual file systems .(Note that it is not necessary to mount the jbase package ;however the other packages still need to be mounted):
       Note:To go to multi-user operation,exit the sing-user shell(with ctrl+D )

       # cd /packages

       # ./mount jbase

       Mounted jbase package on /dev/vn1...

       # ./mount jkernel

       Mounted jkernel package on /dev/vn2...

       # ./mount jroute

       Mounted jroute package on /dev/vn3...

   8.Enter the recovery mode :
       # /user/libexec/ui/recovery-mode

   9.Enter configure mode and change the root authentication password:
       root>edit

       Entering the configuration mode

       http://www.luyouqiwang.com/14504/  [edit]

       root# set system root-authentication plain-text-password

       New password: Juniperlab

       Retry new password:Juniperlab

   10.Commit the changes ,and exit configuration mode
       [edit]

       # commit

       commit complete

       [edit]

       # exit

       Exiting configuration mode

       root@router>exit

   11.Exit recovery mode and enter 'y'when promted to reboot the system:
       Reboot the system? [y/n] y

       Terminated

    The system now reboots and changes made to root authentication are activated.

 我用的是一台现网中的核心高端路由器MX 960做的。。。

1.重启MX960，通过console线（RJ-45转DB9接口）连到路由器

2.当出现下面的提示时，快速按下空格键（有时候设置的等待时间不一样）

         Hit [Enter] to boot immediately, or space bar for command prompt.

         Booting [/kernel] in 5 second...

3.让其自动加载，当出现下面提示时，输入：（空格）boot  -s
          Type '?' for a list of commands, 'help' for more detailed help.

OK   

4.回车；然后输入：recovery 回车，让其自动启动。。。。

   启动过程中会提示缺少或无法在指定默认目录下找到系统密码所在db文件，所以要手动创建；上面有创建方法和相应的操作步骤

5.进入恢复模式：

    # /user/libexec/ui/recovery-mode

6.创建新的管理密码：

    。。。

    。。。（上面有操作方法和步骤。。不详述）

7.保存配置，退出。。。

8.重启系统，即可完成密码破解。。

。。。。。