Reset Administrator Password On A Cisco Router With SNMP

Recently, a fellow Cisco administrator told me about a tool he had used to reset a password on a router. He had forgotten the line vty password and the enable password. He could not log in to the router. He did, however, know the SNMP Read/Write password. Using a freeware tool dubbed “Cisco SNMP Tool” he was able to reset the passwords on the router so he could log in. He found that, without knowing the admin passwords, he could even upload and download the start and running configuration files. Amazingly, he could even reboot the router.

In this article, we will review the Cisco SNMP Tool and provide an example of how it works.

What Is SNMP?

SNMP is a standard protocol for managing and monitoring network devices. SNMP works by having an agent run on a SNMP device, and having a SNMP manager run on a workstation or server. In our case, a Cisco IOS router will be the SNMP device. A Windows workstation with PRTG will be our SNMP manager.
SNMP is a standard defined by the IETF and is based on a number of RFC’s. Usually, the agent uses UDP port 161 and the manager uses UDP port 162. There are 3 versions of SNMP.
There are so many different types of SNMP managers available and they are all created to perform different functions. For example, some programs like Whatsup can alert you when a server is low on disk space, or when a printer runs out of toner.
As we don’t have room to go into all the details on SNMP, take a look at Wikipedia:SNMP for more information.

What is Cisco SNMP Tool?

“Cisco SNMP Tool” is not made by Cisco. Instead, it is a free SNMP application available for download on the Internet. It is made by someone calling himself “Billy the Kid”. Despite the fact that its appearance is rough, it does its job quite well. It can perform full modification of a Cisco router’s running and startup configuration. Additionally, it can reboot the router remotely. This can all be done with only the SNMP write password (called a community string).

How do I obtain “Cisco SNMP Tool”?

To find this tool, I went to googled “cisco snmp tool”. I found that it was available for download from a number of sites. However, the homepage and source for the latest version is at:
http://www.geocities.com/billytk06/
I downloaded and extracted the tool. Inside the zipped download were these files:

It is made up of only a single executable and some text files. There was no installation to be performed at all. Once running, the tool looks like this:

It can only perform a few basic tasks:

• Telnet to Host
• Reboot device
• Upload Running & Startup Configuration
• Download Running & Startup Configuration
• Reset Passwords
• Write NVRAM

How can I reset a lost Cisco IOS enable password with Cisco SNMP Tool?

To reset a lost Cisco IOS enable password with Cisco SNMP tool, let’s look at an example. I have a test router and I have configured an enable password of “lostpassword”. I have a SNMP write community string of “SnmpPassword1”.
On the router, these commands would look like this: Router(config)# enable secret lostpassword Router(config)# snmp-server community SnmpPassword1 RW Router(config)# line vty 0 4 Router(config-line)# password lostpassword

To use “Cisco SNMP Tool” to change the enable password, I first have to add my router to the tool. To do this, type in the IP address of my device, the hostname, and the SNMP write community string. Next I click Add/Update Device, like this:

Once the device is added on the left hand side, I want to test SNMP communication with it. To do this, I click Device Commands -> Test SNMP String.

From this test, you should see the message in the SNMP log that “Your SNMP Read/Write COMMUNITY is CORRECT”, like this:

Now that you know you have full administrative capabilities to this device, using SNMP, you can proceed with whatever you need to do. From here, you can choose to reset passwords on the router. To do this, go to Configuration Commands -> Reset Passwords, like this:

When you do this, in reality, you are just uploading a configuration file from the config tab to the router’s running-configuration. You could create your own config file and upload it yourself. By default, the configuration will change the enable secret password to billy and the line vty password to billy. Also note that you only copied these changes to the running configuration, not the startup-configuration. So, you need to login with these passwords, change the passwords to what they should be and save that configuration with copy run start or wr. Now, let’s see if we can login to our router and change back these passwords:

Now, let me offer a couple of notes on how this tool works. The version of SNMP that is used by default is unencrypted. Thus, the SNMP community string (password) with full write privileges to your router is going across the network in the clear. That means that the password could be sniffed, and a malicious attacker could use this same tool against you. Another important piece is that you must have, ahead of time, configured a SNMP read/write community string on the router. Without that, this tool is never going to work.

Summary

In this article, we learned the power that SNMP can offer a network administrator. I was impressed at how, using only SNMP, we could change the running configuration, change the startup configuration, or reboot the router. I hope you were as impressed as I was. I am going to send an email of thanks to the author of this tool and keep it in my toolbox for the next time I need it. You may want to do the same.