Home‎ > ‎Projects‎ > ‎


Research and Development Progress On The 3Com IntelliJack Switch NJ220 Project Codenamed "Operation Prybar"

20131120: Back on track! Setting up environment this weekend.
20130928: Side-tracked by a similar but different project that was higher priority this week on APC UPS zero touch password recovery.
20130920: NJ220 unit arrived! Phase One Tests begin soon.
20130917: Planning Phase One - 1. unit inspection, 2. data, 3. pictures, 4. default operation, 5. basic physical dissection, 6. basic software dissection.
20130916: Ordered a random NJ220 Unit! Playing the waiting game. Hoping to get it before the weekend.
20130916: Downloaded all available information from HP in regards to this unit (software, manuals, and misc. support information)
20130916: Posted more information in regards to the default password information from the NJ220 User Guide (PDF 1.7MB), HP conversion and file info.
20130915: Currently gathering Model, P/N, Rev info from previous inquires all over the world. 
20130915: A few parties have shown interest in donating a unit for testing - Thank you! In the meanwhile I'm currently seeking my own independent unit prior to testing with outside units. I will post this unit's profile in the variation list below. Hopefully this will turn into the support/known tested list.

NJ220 Unit - Pictured with Power Adapter and Cord

Testing Configuration
[Power Supply]---[NJ220]---[Uplink Port]---[Computer/Hub/Switch]
                                  |---[Port 1]---[Computer]
                                  |---[Port 2]---[Computer]
                                  |---[Port 3]---[Computer]
                                  |---[Port 4]---[Computer]
                                  |---[Reset Switch - Face]
                                  |---[Jumper Switches - Rear]

IntelliJack Switch Security
Network login with IEEE 802.1X user authentication
MAC address filtering and port-based rate limiting

IntelliJack Switch NJ220 Dimensions
Height: 11.4 cm (4.50 in) Width: 7.0 cm (2.75 in) Depth: 5.8 cm (2.30 in)

NJ220 AC power supply Dimensions
Height: 3.8 cm (1.50 in) Width: 5.1 cm (2.00 in) Depth: 8.9 cm (3.50 in)

3Com IntelliJack Switch NJ220 Default Password:
Page 26 of the User Guide: The default password is "password" (without the quotes)

3Com acquisition by HP (Hewlett Packard)
"On April 12, 2010, Hewlett-Packard completed the acquisition of 3Com.[2] Since the HP acquisition, 3Com has been fully absorbed by HP and no longer exists as a separate entity." - http://en.wikipedia.org/wiki/3Com#Acquisition_by_HP

3Com to HP Conversion Support Documents
NOTE: This information is provided for support purposes only. 
This product has been discontinued and is not for sale by HP in any region.
3Com 3CNJ220-BLK : HP NJ220 IntelliJack Black Managed Switch JD475A
3Com 3CNJ220-CRM : HP NJ220 IntelliJack Cream Managed Switch JD477A
3Com 3CNJ220-BLK-20 : HP NJ220 IntelliJack Black 20-pack Switches JD476A
3Com 3CNJ220-CRM-20 : HP NJ220 IntelliJack Cream 20-pack Switches JD478A

Software support ceased in 2010 with the following releases (Date, MD5, Size, File)
03-May-2010 1bdaf49e570eed951a1051f4f4b32bd2 025.0 MB NJ2xx2_5_0
28-Jun-2007 a780745ab8190d21c922a00d262c62d4 030.9 MB NJ2XX2_4_107
27-Jun-2007 f80093d00f07980151d57675e036ef0c 193.0 KB nj220_2_0_23
17-Apr-2006 4477e09d50958876f0a8dcec7bf8e448 180.0 KB nj220_2_0_15
20-Jun-2004 6b7b5bf3a6738510da820a7b293fb1fb 030.0 MB NJ2XX207
16-Jan-2004 d2cf150c5b21fac3282d41e0e3a5bc99 014.0 MB NJ220CM2_0_1

3Com IntelliJack NJ220 Variations: Below are the profiles (Model, Product Number, Revision) that interested parties have made inquiries on. The "profile contributors" have been redacted to simple initials and date of profile contribution:

#Contribution: RH 20131120
Model: 3CNJ220-BLK
P/N: 9092A011
Rev: 16-AB

#Contribution: IT 20130920
Model: 3CNJ220-BLK
P/N: 9092A011
Rev: 16-AB

#Contribution: JM 20130915
Model: 3CNJ200-BLK
P/N: 16-082-000
Rev: A

#Contribution: JM 20130915
Model: 3CNJ220-BLK
P/N: 9092A011
Rev: 16-AB

#Contribution: JO 20130915
Model: 3CNJ220-BLK
P/N: 9092A011
Rev: 16-AB; 16-AC; 17-AC; 23-AC

#Contribution: JO 20130915
Model: 3CNJ220-CRM
P/N: B9092A012G
Rev: 21

#Contribution: KC 20130915
Model: 3CNJ220-BLK
P/N: 9092A011
Rev: 22-AC; 16-AB

Project Details: Current research is undergoing into creating a new multi-platform tool from scratch to find/reset/clear the password from this switch. This will focus on easy usability for users that simply want to reset switches they bought in bulk from wholesale/eBay where the seller does not reveal the password after they've been purchased as-is by the buyer, Administrators forget the password they've set and don't want to or can't send it back to 3Com to be reset, Penetration Testers that are auditing the LAN for weak passwords and bad network configurations.

Historical Reference: Most inquires come from the youtube video "n0xn0x-NJ220.exe : 3Com IntelliJack Switch NJ220" where a Windows executable tool was built in 2008 to find the password using an automated dictionary attack. This came from the n0xn0x (pronounced knock-knock) suite of switch penetration testing tools.