今天为大家分享一篇关于：Juniper高端路由器Root密码如何破解的教程：
Here,I take MX 960 as an example...
1.Reboot the system...
2.From console ,interrupt the boot routine...
Loading /boot/loader
Consoles: serial port
BIOS drive C: is disk0
BIOS drive D: is disk1
BIOS 622kB/3392176kB available memory
...
...
...
/boot/modules/mac_pcap.ko size 0x1878 at 0xdf8000
Hit [Enter] to boot immediately, or space bar for command prompt.
Booting [/kernel] in 5 second...(sometimes the waittime is changeable)
3.
Type '?' for a list of commands, 'help' for more detailed help.
OK
4.Enter into the single-user mode Type into :boot -s (and press Enter...
platform_early_bootinit: M/T Series Early Boot Initialization
GDB: debug ports: sio
...
...
...
5.If you have the following system output ,enter :recovery ,and hit Enter and skip to step 9
System watchdog timer disabled
Enter full pathname of shell or 'recovery' for root password recovery or RETURN for /bin/sh: recovery
6.Enter the shell:
System watchdog timer disabled
Jan 1 00:36:47 init: /etc/spwd.db: No such file or directory
Enter full pathname of shell or RETURN for /bin/sh:
7.Mount the virtual file systems .(Note that it is not necessary to mount the jbase package ;however the other packages still need to be mounted):
Note:To go to multi-user operation,exit the sing-user shell(with ctrl+D )
# cd /packages
# ./mount jbase
Mounted jbase package on /dev/vn1...
# ./mount jkernel
Mounted jkernel package on /dev/vn2...
# ./mount jroute
Mounted jroute package on /dev/vn3...
8.Enter the recovery mode :
# /user/libexec/ui/recovery-mode
9.Enter configure mode and change the root authentication password:
root>edit
Entering the configuration mode
[edit]
root# set system root-authentication plain-text-password
New password: Juniperlab
Retry new password:Juniperlab
10.Commit the changes ,and exit configuration mode
[edit]
# commit
commit complete
[edit]
# exit
Exiting configuration mode
root@router>exit
11.Exit recovery mode and enter 'y'when promted to reboot the system:
Reboot the system? [y/n] y
Terminated
The system now reboots and changes made to root authentication are activated.
我用的是一台现网中的核心高端路由器MX 960做的。。。
1.重启MX960，通过console线(RJ-45转DB9接口)连到路由器
2.当出现下面的提示时，快速按下空格键(有时候设置的等待时间不一样)
Hit [Enter] to boot immediately, or space bar for command prompt.
Booting [/kernel] in 5 second...
3.让其自动加载，当出现下面提示时，输入：(空格)boot -s
Type '?' for a list of commands, 'help' for more detailed help.
OK
4.回车;然后输入：recovery 回车，让其自动启动。
启动过程中会提示缺少或无法在指定默认目录下找到系统密码所在db文件，所以要手动创建;上面有创建方法和相应的操作步骤
5.进入恢复模式：
# /user/libexec/ui/recovery-mode
6.创建新的管理密码：
。。。(上面有操作方法和步骤。。不详述)
7.保存配置，退出。
8.重启系统，即可完成密码破解。
