Using The Shoretel 90V Serial Console to Factory Reset

How to Connect to the Shoretel 90V Serial Console Like a Boss

You just bought a pre-owned Shoretel 90V from a grey market source, and now you find that you cannot logon anymore as anonymous.  The Shoregear90V is quite different from the Shoregear 90.  For one, it runs WindRiver Linux on top of VXWorks,  Whereas the Shoregear 90 just runs WindRiver VXWorks.  As a result Shoregear90V boots into Linux, while Shoregear 90 just has the old familiar VXWorks configuration pages. Both of them have a RS232 serial port that you can use to configure them.   Shoretel is full of hidden and secret passwords, including a secret CDR database with its own passwords. The Shoretel switch is no exception.  You may need to factory reset it, or you just need to set the root password.  Well, here are some ways to get in.  First step is to get a RS232 serial port added to your computer. You can always use a USB to Serial adapter (such as the venerable Tripp-Lite Keyspan USA-19HS) or you can just use the built in RS232 port. On most computers, it looks like a DB9 connector. Here are some pictures that will help you get in.  I buy and sell these grey market Shoretel switches all the time and this is often the first thing you need to do to clear them out and get them ready for the next user.  There is no user called anonymous, that was a feature from the previous generation of switches. On the 90V, the Linux root user is called "root" and his password is "ShoreTel"  The previous generation 90 used Wind River VXWorks, The 90V runs Linux.  Curiously enough, there is removable compact flash drive inside the 90V that contains the ext4 file system. You can always remove it and mount it in ubuntu and them edit the /etc/shadow file . On the 90V there is a message that will tell you to press a key to stop booting so you can edit the environment variables. You will be hitting that.   If you like what you see here, please leave comment and thank us for our work!  If you are getting in over your head and need to hire a Shoretel/Mitel Pro, see our website for contact details.

Shoretel Switch Connectors

Your Shoretel switch has a pair of female DB9 connectors.  The bottom connector is labeled "maint" you will use that one.  The top one is just marked "10101" that is reserved for things such as CDR etc...  The reset button is located in the left of the little blue light.

root@Default:/root# fdisk -l /dev/kcfa

Disk /dev/kcfa: 2096 MB, 2096898048 bytes
16 heads, 63 sectors/track, 4063 cylinders
Units = cylinders of 1008 * 512 = 516096 bytes
Disk identifier: 0xdbe3ac07

    Device Boot      Start         End      Blocks   Id  System
/dev/kcfa1               1        4063     2047720+  83  Linux

how to factory reset:  reboot, then use the option to stop auto boot, (press a key as soon as you see the "al tests passed message) and then type:
> bootc static flash vxworks
> saveenv
> reset

or just change the IP address and set to DHCP
All tests passed
Hit any key to stop autoboot:  0
=> printenv
serial#=90VF13152E94F4
ethaddr=00:10:49:2E:94:F4
bootdelay=3
user=anonymous
pass=tsk
autoload=FLASH
partition=nand0,1
flags=0x0000
gatewayip=10.90.2.1
ipaddr=10.90.2.30
netmask=255.255.255.0
serverip=10.70.2.32
cntrlsrv=10.70.2.32
bootfile=vImage
bootcmd=jboot;bootm

Environment size: 267/492 bytes
=> setenv flags 0x40
=> setenv host 10.0.11.45
=> setenv serverip 10.0.11.45
=> saveenv
Saving Environment to EEPROM...

The Meaning of Flags

Setting the flags to 0x40 will enable DHCP, while setting it to 0x0 will enable the use of the static IP address in the ipaddr field of env vars.

Shoretel Boot Flags

Use a Cisco DB9 to RJ45 Cable with a Null Modem

Connect it to the bottom port /maint port using a gender changer

Set your RS232 port to 19200 Baud,8 bits, 1 stop bit, no parity

Use Putty with the serial port option

Power up your 90V, press a key when prompted to stop in env console

Logon as root, with password ShoreTel

As you can see, it just runs Wind River Linux

Thats all you need to do. I recommend pressing the reset button and holding it for 10 seconds to reset the root password back to ShoreTel.  If you found this bit of advice useful or if you know of more ways to get in, please leave us a comment.

Set the IP Address and Server Address of SG-T1K

Connect a serial cable to the console port and wait for your switch to fully startup. then logon as anonymous with password=ShoreTel Once Connected, use option (3) to set the network parameters. Save them and then (4) reboot!

Other Curious Tidbits

After you boot up into Wind River Linux, you will see the flag value in /proc/ubootenv/flags and there is a networks script in /nand/etc/sysconfig/network-scripts/ifcfg-eth0 that you can play with.