4 ms·
Could you elaborate to those of us not familiar with Cisco routers? My understanding is this exploit disables password authentication and allows you to access
by Zombieball 10y ago
Could you elaborate to those of us not familiar with Cisco routers?
My understanding is this exploit disables password authentication and allows you to access the device. A seperate command allows you to re-enable it.
Would this re-enabling kill your current connection? Is the password later needed to change settings on the router (like if you typed sudo and are forced to re-authenticate)?
- XORcat 10y agoIn my lab, re-enabling did not kill the current connection, so it could be a very quick switch flick, login, revert to try and avoid detection.
- tmm 10y agoThe "enable" password is sort of like the root account on Cisco gear. When you first connect, you're in a low-priv state where you can do simple things like see the uptime of the device, interface info, etc. But to make any changes to the settings on the router, you have to run the "enable" command which typically asks for a password which is separate from the login password. I guess the name comes from enabling admin functionality, but I don't know why Cisco didn't call the command admin. Anyway, this enable is different from enabling/disabling the login authentication.
- a2tech 10y agoOn a Cisco router you login via SSH or Telnet, then you run a command to become 'enabled'. enable is a command like sudo on Linux-it elevates your permission level so you can make changes (although not all changes require you to be enabled, most do). If you used ExtraBacon to clear the login user/password you would get a basic shell on connection. This would open at least 2 options to you as an attacker-1) using a local exploit to become an enabled user and 2) you can now send traffic to ALL the networks that the firewall/router knows about-for example, a non-internet connected management network that might be filled with never upgraded KVM/OOB control equipment.
- Zombieball 10y agoThanks! #2 definitely seems like a big issue. I can imagine many "internal" services that are potentially insecure.
- Vendan 10y agoMy fav is IPMI. Many devices allow you to log in using cipher 0... basically, if you know the username, you get access. The rest... well, IMPI has a hash disclosure built into the protocol. If you can guess a username, you can get (and try to crack) the password.
- eth1 10y agoSo, I just did this. this is how i gained access to the ASA. ssh alsjfailjgfakjndfakldflkajd@10.1.1.1 and I was in. Then i did: en it asked for a password, and i typed: al;kdf;aklfjglkadfjglkadjfgljfglksjdf and i was in. kind of scary
- raphman_ 10y agoFor those without `showdead` on: (@dang / @sctb: this seems to be a false positive) > XORcat 18 minutes ago [dead] [-] > In my lab, re-enabling did not kill the current connection, so it could be a very quick switch flick, login, revert to try and avoid detection.
- deleted 10y ago[deleted]
- moyix 10y agoInstead of copying & pasting, you should be able to click on the timestamp of the comment and then click "Vouch" (which I just did for XORcat's comment).
- schoen 10y agoMaybe you need a certain minimum karma level to have access to vouch?
- Phlarp 10y agoThis seems to be the case, at 926 karma I have comment downvotes but no vouch button yet.
- raphman_ 10y agoThanks for the tip and the vouching - as schoen suggests, it seems like I need a little bit more karma for this.