Mikro. Tik Password Recoverylast update 2. WARNING The author makes no guarantees and holds no responsibility for any damage, injury or loss of property that may result after reading this page. Following text is for education purposes only Information on this page as well as mtpass tool are intended to help to recover passwords without loosing configuration mikrotik administrator andor owners ONLYChange Mikrotik Software Id CardUsing it for other purposes ie. According to information on Mikro. Tiks wiki page. it is not possible to recovery the passwords without loosing configuration. It is not true ill try to proof that below News. RB4. 11 5n. H. 2. Router. OS files. Router. OS 5. 5. RB4. AR8. RB1xx. 2. 00. RB4. 11. 2. 00. 8 1. Hardware needed. computer laptop is a good choice for hard conditions. Router. Board ive tested it on versions 5. A and 4. 11 but should work on all Open. Wrt supported Router. Boards, Cesco tested it on RB1. C. serial console cable. Soft needed. Due the fact that i dont like the big bills operating system, so this tutorial will be based on linux, the distribution should not matter, but its based on debian. So here we go. Our goal is to set the Router. Download Area. Halaman ini merupakan mirror download area, supaya pengguna yang ada di Indonesia dan terhubung ke jaringan OpenIXP bisa mendownload installer ataupun. Stepbystep description how to recover MikroTik password without touching existing RouterOS. Mikrotik RouterOS FAQ Frequently Asked Questions. FAQ Content. About MikroTik RouterOS What is MikroTik RouterOS Can I test the RouterOS befor i buy itBoard BIOS to boot the system via network. In this way we will load our custom kernel. With that kernel we will be able to. Mikro. Tik passwords. Then we will be able to decrypt the passwords. Minicom configuration. If we dont chage default settings the Router. Boards console port should be accessible with the following transmission parameters 1. N1. So we need to set Mikro. Tik like that. If minicom is launched for the first time, theres need to setup. Select Serial port setup and a window with parameters should appear. In my case i set. A Serial Device devtty. Change Mikrotik Software Ideas' title='Change Mikrotik Software Ideas' />USB0. E BpsParBits 1. N1. F Hardware Flow Control Yes. G Software Flow Control No. Ive set the devtty. USB0 as serial port, due using a USBlt RS2. In the case of computer with a standard COM1COM2 port, so you should of course set the path to devtty. S0 or devtty. S1. After setting, you need to accept these values with hit the Enter key, then youll return to main menu. Now you need to save minicom configuration as default. Save setup as dfl and were ready with minicom. You should setup dhcp to assign the IP address to Mikro. Tik and then to pass the server and path to kernel image, which will be booted. How to configure the dhcp server is a topic for different kind of article, so Ill confine to minimum needed information i used the following dhcpd. You need to copy the linuxrc file to tftpboot directory. This file is a kamikaze Open. Wrt firmware. Ive compiled it with ramdisk support it doesnt need to put on Compact. Flash, because this is the not point I dont want to make changes to Mikro. Tik filesystem. itself so i need to boot the Open. Wrt from ramdisk. The image has also hardcoded IP address for eth. If you want to compile the kernel and Open. Wrt by yourself here is a link for a configuration file. Kernel for RB4. 11 If you have RB4. Kernel for RB4. 11 5n. H As reported by Igor K., if you have RB4. H you need the following kernel file which you need to put as tftpbootlinuxrc http www. Kernel for RB4. 11 with AR8. Thanks to Mirek i found out, that there are RB4. AR8. 01. 2 instead of KSZ8. NLmore info about it https forum. He compiled and tested password recovery on such hardware using his Open. WRT firmware openwrt ar. Kernel for RB1xx Cesco compiled kamikaze 8. Infineon ADM5. 12. RB1xx Router. BOARD so if you have such a hardware download it and put it as tftpbootlinuxrc openwrt adm. NOTE Sometimes if tftp server is chrooting into tftpboot after start like in Fedora tftp server you. Lets do it. The following text is based on Router. Board 5. 32 ive also tested it on 5. A and 4. 11. We connect the mikrotik with computer via serial console cable and via patch cord, but we have to connect it to main ethernet adapter in my RB theres a Po. E sticker. If you have not do that already its time to configure ethernet interface and launch the dhcp server on computer. Now its time to run a minicom without modem initialization this is not needed at all minicom o. If Mikro. Tik is now running you need to reboot it, and if doesnt you need to power it up. Router. Boards BIOS. Router. BOOT booter 1. Router. Board 5. 32. CPU frequency 2. MHz. Memory size 3. MB. Press any key within 1 seconds to enter setup. You have a short time to hit any key default one second can be changed later and than youll see. What do you want to configure Select boot device. Ethernet. n boot from NAND. CF. 1 boot Ethernet once, then NAND. Ethernet once, then CF. If you have a system on NAND memory you need to choose. Ethernet once, then NAND 1. CF asterisk next to c selection then you need to press 2. In my case ive pressed 1 and i was back in main menu. Then ive selected the boot protocol configuration p. What do you want to configureChoose which boot protocol to use. Premiere Pro Cs6 Effects Presets. After return to main menu you need to press x to save settings and reboot the kernel from your computer. What do you want to configure OK. Router. BOOT booter 1. Router. Board 5. 32. CPU frequency 2. MHz. Memory size 3. MB. Press any key within 1 seconds to enter setup. OK. trying dhcp protocol. OK. resolved mac address 0. B FC 4. 1 BE 4. Gateway 1. OK. jumping to kernel code. Busy. Box v. 1. 4. CET multi call binary. Please press Enter to activate this console. PPP generic driver version 2. After enter we have a Open. Wrt running on Mikro. Tik. Busy. Box v. CET Built in shell ash. Enter help for a list of built in commands. W I R E L E S S F R E E D O M. KAMIKAZE 7. 0. 9 . Vodka Shake well with ice and strain. Triple sec mixture into 1. Salute . Open. Wrt. If you have problem like flash write. Ethernet, and then press b boot chosen device4. Mounting. Now its time to mount NAND memory and send a file with passwords. You may check for sure if kernel correctly found a NAND chip. If you cant see it on screen, then type. Router. Board NAND Boot. Router. Board NAND Main. The above result is for my 1. MB memory chip i dont know how should it be for other capacities. At this stage you need to know a important thing i dont know if its true or not but i heard that when. NAND even in read only mode it is a risk that the data on chip can be damaged. Fortunatelly. it wasnt happend in my case but it doesnt meen youll be lucky too and keep in mind, that youve been warned So its time to mount the NAND memory chip in read only mode. NOTE in RB4. 11 ive got this partition scheme. Creating 3 MTD partitions on NAND 6. Mi. B 3,3. V 8 bit 0x. I need to mount devmtdblock. File system should be mounted right now. The crypted passwords for Mikro. Tik users are in mntnovastoreuser. Router. OS versions in mntrwstoreuser. Its need to send that file to computer, and then decrypt the password. I used a simple method to do that netcat tool. All you need to do is send that file from Mikro. Tik and receive on computer. You need to run netcat on computer in listening mode ie. Mikro. Tik you can send a file. In this simple way we have on computer the intrested file. The next boot of mikrotik should be the standard way from that medium we set before.