今天為大家分享一篇關于：Juniper高端路由器Root密碼如何破解的教程：
Here,I take MX 960 as an example...
1.Reboot the system...
2.From console ,interrupt the boot routine...
Loading /boot/loader
Consoles: serial port
BIOS drive C: is disk0
BIOS drive D: is disk1
BIOS 622kB/3392176kB available memory
...
...
...
/boot/modules/mac_pcap.ko size 0x1878 at 0xdf8000
Hit [Enter] to boot immediately, or space bar for command prompt.
Booting [/kernel] in 5 second...(sometimes the waittime is changeable)
3.
Type '?' for a list of commands, 'help' for more detailed help.
OK
4.Enter into the single-user mode Type into :boot -s (and press Enter...
platform_early_bootinit: M/T Series Early Boot Initialization
GDB: debug ports: sio
...
...
...
5.If you have the following system output ,enter :recovery ,and hit Enter and skip to step 9
System watchdog timer disabled
Enter full pathname of shell or 'recovery' for root password recovery or RETURN for /bin/sh: recovery
6.Enter the shell:
System watchdog timer disabled
Jan 1 00:36:47 init: /etc/spwd.db: No such file or directory
Enter full pathname of shell or RETURN for /bin/sh:
7.Mount the virtual file systems .(Note that it is not necessary to mount the jbase package ;however the other packages still need to be mounted):
Note:To go to multi-user operation,exit the sing-user shell(with ctrl+D )
# cd /packages
# ./mount jbase
Mounted jbase package on /dev/vn1...
# ./mount jkernel
Mounted jkernel package on /dev/vn2...
# ./mount jroute
Mounted jroute package on /dev/vn3...
8.Enter the recovery mode :
# /user/libexec/ui/recovery-mode
9.Enter configure mode and change the root authentication password:
root>edit
Entering the configuration mode
[edit]
root# set system root-authentication plain-text-password
New password: Juniperlab
Retry new password:Juniperlab
10.Commit the changes ,and exit configuration mode
[edit]
# commit
commit complete
[edit]
# exit
Exiting configuration mode
root@router>exit
11.Exit recovery mode and enter 'y'when promted to reboot the system:
Reboot the system? [y/n] y
Terminated
The system now reboots and changes made to root authentication are activated.
我用的是一臺現網中的核心高端路由器MX 960做的。。。
1.重啟MX960，通過console線(RJ-45轉DB9接口)連到路由器
2.當出現下面的提示時，快速按下空格鍵(有時候設置的等待時間不一樣)
Hit [Enter] to boot immediately, or space bar for command prompt.
Booting [/kernel] in 5 second...
3.讓其自動加載，當出現下面提示時，輸入：(空格)boot -s
Type '?' for a list of commands, 'help' for more detailed help.
OK
4.回車;然后輸入：recovery 回車，讓其自動啟動。
啟動過程中會提示缺少或無法在指定默認目錄下找到系統密碼所在db文件，所以要手動創建;上面有創建方法和相應的操作步驟
5.進入恢復模式：
# /user/libexec/ui/recovery-mode
6.創建新的管理密碼：
。。。(上面有操作方法和步驟。。不詳述)
7.保存配置，退出。
8.重啟系統，即可完成密碼破解。
