Table of contents
- 1. Cisco ASA 5500 Series Firewall
- 2. Siemens SIMATIC S7-1200 PLC
- 3. Palo Alto Networks PA-220 Firewall
- 4. Ubiquiti EdgeRouter X
- 5. Schneider Electric Modicon M221 PLC
- 6. Honeywell Experion PKS Controller
- 7. Hikvision DS-7600 NVR
- 8. APC Smart-UPS SMT1500RM2U
- 9. GE RX3i Controller
- 10. Cisco Catalyst 2960 Switch
- 11. Rockwell Automation Allen-Bradley CompactLogix PLC
- 12. Juniper EX2200 Switch
- 13. Siemens SIMATIC S7-1500 PLC
- 14. Dell PowerEdge R640 Server
- 15. Aruba Networks 2930F Switch
- 16. Axis M3106-LVE Network Camera
- 17. Fortinet FortiGate 30E Firewall
- 18. Yokogawa CENTUM VP DCS Controller
- 19. Panasonic KX-NS700 PBX
- 20. Mitsubishi Electric MELSEC-Q Series PLC
In the realm of Red Team operations, one advanced technique involves exploiting hardware reset functionalities to disrupt critical systems and gain unauthorized access. This approach capitalizes on the inherent vulnerability of various devices to factory reset methods, which can be leveraged to bypass security configurations, restore default settings, or trigger service disruptions. By performing multiple power cycles or initiating factory resets, Red Teamers can effectively nullify customized configurations, forcing a system to revert to its default state. This can expose default credentials, remove security measures, and cause operational interruptions, providing an avenue for further exploitation.
This method is particularly potent in high-stakes environments where security and operational continuity are paramount. It applies to a range of critical devices, including network firewalls, industrial control systems (ICS), and data center hardware. The ability to reset hardware using multiple power-off techniques is a strategic move that can undermine network defenses, disrupt industrial processes, and compromise data integrity. By understanding and employing these reset techniques, Red Teamers can simulate realistic attack scenarios that test the resilience of an organization's security posture and response mechanisms.
Device | Vendor | Model | Industry | Instructions | Impact |
Cisco ASA Firewall | Cisco | ASA 5505, ASA 5516-X | Enterprise Networks | Power cycle 5 times, enter ROMMON mode, conf factory-default . | Firewall rules, VPN, and user settings wiped out. |
Siemens SIMATIC PLC | Siemens | S7-1200 | Industrial Control Systems (ICS) | Power cycle 3 times, hold MRES button, release when STOP LED flashes. | Control programs and configurations erased. |
Palo Alto Firewall | Palo Alto Networks | PA-220 | Enterprise Networks | Power cycle 5 times, boot into maintenance mode, select Factory Reset. | All firewall rules and network settings wiped out. |
Ubiquiti EdgeRouter X | Ubiquiti Networks | EdgeRouter X | SMB and ISP Networks | Power cycle 3 times, hold reset button for 15 seconds. | All configurations reset, default credentials enabled. |
Schneider Modicon PLC | Schneider Electric | M221 | Industrial Automation (ICS) | Power cycle 3 times, hold reset button for 10 seconds. | Automation processes disrupted, configurations erased. |
Honeywell Experion Controller | Honeywell | Experion PKS | SCADA/ICS Systems | Power cycle 4 times, hold reset button for 30 seconds. | SCADA configurations removed. |
Hikvision NVR | Hikvision | DS-7600 | Surveillance Systems | Power cycle 3 times, hold reset button for 20 seconds. | Enables default credentials for access. |
APC Smart-UPS | APC by Schneider | SMT1500RM2U | Critical Power Management | Power cycle 5 times, hold reset button for 10 seconds. | Removes custom power settings, affecting uptime. |
GE RX3i Controller | General Electric | RX3i PACSystems Controller | ICS/SCADA Systems | Power cycle 3 times, hold reset button for 15 seconds. | Automation control disrupted, configurations erased. |
Cisco Catalyst Switch | Cisco | Catalyst 2960 | Enterprise Networks | Power cycle 5 times, hold mode button for 10 seconds. | VLAN, routing, and security configurations removed. |
Rockwell CompactLogix PLC | Rockwell Automation | CompactLogix 1769-L16ER | ICS/Industrial Automation | Power cycle 3 times, hold reset button for 10 seconds. | Ladder logic and configurations erased. |
Juniper Switch | Juniper Networks | EX2200 | Enterprise Networks | Power cycle 3 times, hold reset button for 10 seconds. | VLAN, port, and security settings cleared. |
Siemens SIMATIC PLC | Siemens | S7-1500 | Industrial Control Systems (ICS) | Power off and on 4 times, hold MRES button for 10 seconds. | Configuration and programs erased, requires manual reprogramming. |
Dell PowerEdge Server | Dell | PowerEdge R640 | Data Centers | Power cycle 5 times, hold reset button for 15 seconds. | Wipes all server configurations and storage data. |
Aruba Switch | Aruba Networks | 2930F | Enterprise Networks | Power cycle 3 times, hold reset button for 20 seconds. | Network settings removed, default access enabled. |
Axis Network Camera | Axis Communications | M3106-LVE | Surveillance Systems | Power cycle 4 times, hold reset button for 10 seconds. | Default credentials re-enabled for camera control. |
Fortinet Firewall | Fortinet | FortiGate 30E | Enterprise Networks | Power cycle 5 times, hold reset button for 20 seconds. | Firewall rules wiped out, default credentials enabled. |
Yokogawa DCS Controller | Yokogawa | CENTUM VP DCS | Process Automation/SCADA | Power cycle 3 times, hold reset button for 15 seconds. | Process control configurations lost. |
Panasonic PBX | Panasonic | KX-NS700 | Telecommunications | Power cycle 3 times, hold reset button for 10 seconds. | Telephony settings erased, requires reconfiguration. |
Mitsubishi Electric PLC | Mitsubishi Electric | MELSEC-Q Series | Industrial Automation | Power cycle 3 times, hold reset button for 20 seconds. | Automation processes interrupted, forcing reprogramming. |
1. Cisco ASA 5500 Series Firewall
Vendor: Cisco
Model: ASA 5505, ASA 5516-X
Industry: Enterprise Networks
Objective: Reset firewall to disrupt configurations and force use of default credentials.
Instructions:
Power cycle the device 5 times rapidly (5 seconds between each cycle).
After the fifth reboot, the device will enter ROMMON mode.
Use the command
conf factory-default
to restore to factory defaults.Reboot, and access the device with default credentials (
admin/admin
).
Impact: Firewall rules, VPN, and user settings are wiped out.
Reference: Cisco ASA Configuration Guide.
2. Siemens SIMATIC S7-1200 PLC
Vendor: Siemens
Model: SIMATIC S7-1200
Industry: Industrial Control Systems (ICS)
Objective: Reset PLC controlling critical industrial processes.
Instructions:
Power cycle the PLC 3 times (5 seconds between cycles).
Press and hold the MRES button for 3-5 seconds until the STOP LED flashes.
Release and press again for 10 seconds until the LED stays solid.
The PLC will reset to factory defaults.
Impact: All control programs and configurations are erased, forcing reprogramming.
Reference: Siemens S7-1200 Manual.
3. Palo Alto Networks PA-220 Firewall
Vendor: Palo Alto Networks
Model: PA-220
Industry: Enterprise Networks
Objective: Reset firewall and use default credentials for access.
Instructions:
Power cycle the firewall 5 times (5-10 seconds between cycles).
The firewall will boot into maintenance mode.
Select Factory Reset from the console.
Reboot with default credentials (
admin/admin
).
Impact: All firewall rules and network settings are wiped out.
Reference: Palo Alto PA-220 Admin Guide.
4. Ubiquiti EdgeRouter X
Vendor: Ubiquiti Networks
Model: EdgeRouter X
Industry: SMB and ISP Networks
Objective: Reset router to factory defaults, removing all configurations.
Instructions:
Power cycle the router 3 times.
Press the reset button (pinhole) for 15 seconds.
The router will reset and reboot to factory defaults.
Impact: Allows access via default credentials (
ubnt/ubnt
).
Reference: Ubiquiti EdgeRouter Manual.
5. Schneider Electric Modicon M221 PLC
Vendor: Schneider Electric
Model: Modicon M221
Industry: Industrial Automation (ICS)
Objective: Reset PLC managing automation systems.
Instructions:
Power cycle the PLC 3 times.
Hold the reset button on the module for 10 seconds.
The system will reset, erasing all user configurations.
Impact: Automation processes are disrupted, forcing the user to reload settings.
Reference: Schneider Electric Modicon M221 Manual.
6. Honeywell Experion PKS Controller
Vendor: Honeywell
Model: Experion PKS
Industry: SCADA/ICS Systems
Objective: Reset SCADA control system to factory defaults.
Instructions:
Power cycle the controller 4 times.
After the fourth cycle, hold the reset button for 30 seconds.
The system will reboot with default configurations.
Impact: All SCADA configurations are removed.
Reference: Honeywell Experion PKS Manual.
7. Hikvision DS-7600 NVR
Vendor: Hikvision
Model: DS-7600 Series
Industry: Surveillance Systems
Objective: Reset the NVR and gain access to default credentials.
Instructions:
Power cycle the NVR 3 times (10 seconds between cycles).
Press the reset button (pinhole) for 20 seconds.
The system will reboot with default settings (
admin/12345
).
Impact: Complete access to the surveillance system.
Reference: Hikvision NVR Quick Start Guide.
8. APC Smart-UPS SMT1500RM2U
Vendor: APC by Schneider Electric
Model: SMT1500RM2U
Industry: Critical Power Management
Objective: Reset UPS to disrupt power configurations.
Instructions:
Power cycle the UPS 5 times.
Hold the reset button for 10 seconds to trigger a factory reset.
Reboot and reconfigure from scratch.
Impact: Removes custom power settings, affecting uptime.
Reference: APC Smart-UPS User Manual.
9. GE RX3i Controller
Vendor: General Electric
Model: RX3i PACSystems Controller
Industry: ICS/SCADA Systems
Objective: Disrupt industrial control and force factory reset.
Instructions:
Power cycle the device 3 times.
Press and hold the reset button for 15 seconds.
The system will reboot and erase all configuration.
Impact: Automation control is disrupted, and the factory reset erases programs.
Reference: GE RX3i Technical Documentation.
10. Cisco Catalyst 2960 Switch
Vendor: Cisco
Model: Catalyst 2960
Industry: Enterprise Networks
Objective: Reset switch configuration to default settings.
Instructions:
Power cycle the switch 5 times.
Hold the mode button for 10 seconds during the final boot.
The switch will reset to factory defaults.
Impact: Removes all VLAN, routing, and security configurations.
Reference: Cisco Catalyst 2960 Reset Guide.
11. Rockwell Automation Allen-Bradley CompactLogix PLC
Vendor: Rockwell Automation
Model: CompactLogix 1769-L16ER
Industry: ICS/Industrial Automation
Objective: Reset PLC controlling industrial processes.
Instructions:
Power cycle the PLC 3 times.
Press and hold the reset button for 10 seconds.
Reboot to factory settings.
Impact: All ladder logic and configurations are erased.
Reference: Rockwell CompactLogix Manual.
12. Juniper EX2200 Switch
Vendor: Juniper Networks
Model: EX2200
Industry: Enterprise Networks
Objective: Reset switch to factory defaults.
Instructions:
Power cycle the switch 3 times.
Press the reset button for 10 seconds.
Reboot with factory defaults.
Impact: Clears all VLAN, port, and security settings.
Reference: Juniper EX2200 Manual.
13. Siemens SIMATIC S7-1500 PLC
Vendor: Siemens
Model: SIMATIC S7-1500
Industry: Industrial Control Systems (ICS)
Objective: Reset PLC to default configuration, disrupting industrial control systems.
Instructions:
Power off the device and turn it back on 4 times.
Hold the MRES button for 10 seconds to trigger a factory reset.
Release the button and wait for a system reboot.
Impact: All configuration data and user programs are erased, forcing manual reprogramming.
Reference: Siemens SIMATIC S7-1500 Manual.
14. Dell PowerEdge R640 Server
Vendor: Dell
Model: PowerEdge R640
Industry: Data Centers
Objective: Factory reset to wipe server configuration.
Instructions:
Power off the server, then turn it on and off 5 times.
During the final boot, press the reset button for 15 seconds.
The system will factory reset.
Impact: Wipes all configurations and storage data.
Reference: Dell PowerEdge Reset Guide.
15. Aruba Networks 2930F Switch
Vendor: Aruba Networks
Model: 2930F
Industry: Enterprise Networks
Objective: Reset switch to factory settings for default access.
Instructions:
Power cycle 3 times.
Hold the reset button for 20 seconds.
The switch will reset to factory defaults.
Impact: Removes all network settings, enabling default access.
Reference: Aruba 2930F Manual.
16. Axis M3106-LVE Network Camera
Vendor: Axis Communications
Model: M3106-LVE
Industry: Surveillance Systems
Objective: Factory reset to gain access to video streams.
Instructions:
Power cycle the camera 4 times.
Press and hold the reset button for 10 seconds.
The camera will reboot to factory settings (
root/pass
).
Impact: Enables default credentials, providing control over the camera.
Reference: Axis M3106-LVE User Manual.
17. Fortinet FortiGate 30E Firewall
Vendor: Fortinet
Model: FortiGate 30E
Industry: Enterprise Networks
Objective: Factory reset to disable firewall settings.
Instructions:
Power off and on the firewall 5 times.
Hold the reset button for 20 seconds.
The firewall will reset and reboot with default credentials.
Impact: Firewall rules and configurations are wiped out.
Reference: Fortinet FortiGate 30E Manual.
18. Yokogawa CENTUM VP DCS Controller
Vendor: Yokogawa
Model: CENTUM VP DCS
Industry: Process Automation/SCADA
Objective: Factory reset to disrupt process control.
Instructions:
Power cycle 3 times.
Hold the reset button for 15 seconds.
The controller will reset, erasing all configurations.
Impact: Critical process control configurations are lost.
Reference: Yokogawa CENTUM VP Technical Guide.
19. Panasonic KX-NS700 PBX
Vendor: Panasonic
Model: KX-NS700
Industry: Telecommunications
Objective: Factory reset to disrupt telecommunication operations.
Instructions:
Power off the PBX and cycle power 3 times.
Hold the reset button for 10 seconds to initiate factory reset.
The system will reboot and require reconfiguration.
Impact: All telephony settings are erased.
Reference: Panasonic KX-NS700 Manual.
20. Mitsubishi Electric MELSEC-Q Series PLC
Vendor: Mitsubishi Electric
Model: MELSEC-Q Series
Industry: Industrial Automation
Objective: Reset PLC controlling automation processes.
Instructions:
Power off and on the PLC 3 times.
Press the reset button for 20 seconds.
The PLC will reset to factory defaults, erasing all configurations.
Impact: Automation processes are interrupted, forcing reprogramming.
Reference: Mitsubishi Electric MELSEC-Q Series Manual.
Cover by supersozdatel