How to Hack a 3com Router password.

Try here:

http://www.atstake.com/research/lc3/

Remember, these things are designed to be crack-proof. You might have to scrap it.

1. Connect a terminal (9600/N/8/1) to the NETBuilder
2. Power-on the NETBuilder
3. Enter monitor mode:

a. For the SSII NETBuilder once it had passed the
self-tests, press the hardware interrupt switch located in a round opening on the left side panel where the fan holes are located on the NETBuilder.

b. For the OCNB and NBSI use the ESC key while performing self-tests

c. For the NETBuilder II CEC press the front two middle Attention buttons, then reset, boot, mon from the front panel

d. For the NETBuilder II DPE answer 'Y' when asked if you want to enter monitor mode.

4. Boot the NB using the same image file but a different default directory , using the BT monitor command.
(Example: BT /PRIMARY/BOOT.68K /)

NOTE: On the DPE, the BT will also change the active SysconF-> Boot Source , so it must be restored to it's original setting

For the NETBuilder II CEC , you can also delete the SYSTEM file while in monitor mode using the
de command, specifying the path (ex: DE A:/110/SYSTEM), then reboot the CEC and continue to step #8

5. For all other platforms once in monitor mode, reboot the router with the bt command specifying a
bogus directory for the configuration files.

Example:
bt /PRIMARY/BOOT.68K /JUNK

NOTE: Using the bt command on a DPE will overwrite the firmware primary boot source
configuration

6. Once the router software is initialized & running, login as 'root' with no password

7. Remove the SYSTEM file from the configuration directory, example: RemoveFile /PRIMARY/SYSTEM

8. Reboot the NETBuilder and reconfigure the password using the SPW command from the NETBuilder prompt

Note: The SYSTEM files contains the -sys menu parameters such as NMPrompt, SysLOCation, SysNAMe, SysCallerID etc. If used, these parameters will require re-configuration.