connect to serial console on the PIX

set up a tftp server (e.g. on a laptop) and connect it to one of the
interfaces on the pix.

boot the pix, and hit break or escape to interrupt boot when prompted

do something like this:

monitor>interface 0
0: i8255X @ PCI(bus:0 dev:13 irq:10)
1: i8255X @ PCI(bus:0 dev:14 irq:7 )
 
Using 0: i82559 @ PCI(bus:0 dev:13 irq:10), MAC: 0050.54ff.82b9
monitor>address 192.168.0.2
address 192.168.0.2
monitor>server 192.168.0.1
server 192.168.0.1
monitor>file np63.bin
file np63.bin
monitor>ping 192.168.0.1
Sending 5, 100-byte 0xf8d3 ICMP Echoes to 192.168.0.1, timeout is 4 seconds:
!!!!!
Success rate is 100 percent (5/5)
monitor>tftp
tftp np63.bin@192.168.0.1 ...................................
Received 93164 bytes
 
Cisco Secure PIX Firewall password tool (3.0) #0: Tue Aug 22 23:22:19 PDT 2000
Flash=i28F640J5 @ 0x300
BIOS Flash=AT29C257 @ 0xd8000
 
Do you wish to erase the passwords? [yn] y
Passwords have been erased.
 
Rebooting....



The enable password is now blank (i.e. no password; to enable just
'enable<enter><enter>'), and the default telnet password is 'cisco'.