今天为大家分享一篇关于：Juniper高端路由器Root密码如何破解的教程：
　　Here,I take MX 960 as an example...
　　1.Reboot the system...
　　2.From console ,interrupt the boot routine...
　　Loading /boot/loader
　　Consoles: serial port
　　BIOS drive C: is disk0
　　BIOS drive D: is disk1
　　BIOS 622kB/3392176kB available memory
　　...
　　...
　　...
　　/boot/modules/mac_pcap.ko size 0x1878 at 0xdf8000
　　Hit [Enter] to boot immediately, or space bar for command prompt.
　　Booting [/kernel] in 5 second...(sometimes the waittime is changeable)
　　3.
　　Type '?' for a list of commands, 'help' for more detailed help.
　　OK
　　4.Enter into the single-user mode Type into :boot -s (and press Enter...
　　platform_early_bootinit: M/T Series Early Boot Initialization
　　GDB: debug ports: sio
　　...
　　...
　　...
　　5.If you have the following system output ,enter :recovery ,and hit Enter and skip to step 9
　　System watchdog timer disabled
　　Enter full pathname of shell or 'recovery' for root password recovery or RETURN for /bin/sh: recovery
　　6.Enter the shell:
　　System watchdog timer disabled
　　Jan 1 00:36:47 init: /etc/spwd.db: No such file or directory
　　Enter full pathname of shell or RETURN for /bin/sh:
　　7.Mount the virtual file systems .(Note that it is not necessary to mount the jbase package ;however the other packages still need to be mounted):
　　Note:To go to multi-user operation,exit the sing-user shell(with ctrl+D )
　　# cd /packages
　　# ./mount jbase
　　Mounted jbase package on /dev/vn1...
　　# ./mount jkernel
　　Mounted jkernel package on /dev/vn2...
　　# ./mount jroute
　　Mounted jroute package on /dev/vn3...
　　8.Enter the recovery mode :
　　# /user/libexec/ui/recovery-mode
　　9.Enter configure mode and change the root authentication password:
　　root>edit
　　Entering the configuration mode
　　[edit]
　　root# set system root-authentication plain-text-password
　　New password: Juniperlab
　　Retry new password:Juniperlab
　　10.Commit the changes ,and exit configuration mode
　　[edit]
　　# commit
　　commit complete
　　[edit]
　　# exit
　　Exiting configuration mode
　　root@router>exit
　　11.Exit recovery mode and enter 'y'when promted to reboot the system:
　　Reboot the system? [y/n] y
　　Terminated
　　The system now reboots and changes made to root authentication are activated.
　　我用的是一台现网中的核心高端路由器MX 960做的。。。
　　1.重启MX960，通过console线(RJ-45转DB9接口)连到路由器
　　2.当出现下面的提示时，快速按下空格键(有时候设置的等待时间不一样)
　　Hit [Enter] to boot immediately, or space bar for command prompt.
　　Booting [/kernel] in 5 second...
　　3.让其自动加载，当出现下面提示时，输入：(空格)boot -s
　　Type '?' for a list of commands, 'help' for more detailed help.
　　OK
　　4.回车;然后输入：recovery 回车，让其自动启动。
　　启动过程中会提示缺少或无法在指定默认目录下找到系统密码所在db文件，所以要手动创建;上面有创建方法和相应的操作步骤
　　5.进入恢复模式：
　　# /user/libexec/ui/recovery-mode
　　6.创建新的管理密码：
　　。。。(上面有操作方法和步骤。。不详述)
　　7.保存配置，退出。
　　8.重启系统，即可完成密码破解。