################################################# Lecture Log May 04th 2002 By Vegas ################################################# ___Lecture : Cisco IOS security___ Cisco solutions are today deployed in many companies. Security is the principal point of this companies. Thats why Cisco systems is so deploy coz it offer a nice security level. We can consider IOS (Internetworking Operating System) as the OS of Cisco routers. We can't find much vulnerabilities on that OS. Securityfocus for example survey about 5 or 6 vulnerabilities only. Thats poor considering all the IOS cisco has made. There's meanwhile a hot topic Cisco doesn't want to talk, the password encryption on IOS systems. Before talking about this security hole, i will first explain some way you can use to find and steal the configuration file where the encrypted (or not) password is. I will start with SNMP and some other vulnerabilities, then i will explain the different ways you have to decrypt the acquired passwords. btw you can see if a router is a Cisco router by portscanning it and see if the port 1999 tcp and udp are open and are responding with a special Cisco RST packet. I - SNMP Adopted in 1988 (RFC 1067) and modified in 1989 (RFC 1098) and in 1990 (RFC 1057), SNMPv1 is the most impanted version of SNMP. The Simple Network Management Protocol (SNMP) is another method that can be used to access network devices. SNMP can be used to gather statistics or configure the router. The network manager may gather statistics with SNMP get-request and get-next-request messages and change router configurations with set-request messages. Each of these SNMP messages has a community string that is a clear text password sent in every packet between a management station and the router (which contains an SNMP agent). The SNMP community string is used to authenticate messages sent between the manager and agent. The agent will respond only when the manager sends a message with the correct community string. SNMP community strings are sent on the network in clear ASCII text. Anyone who has the ability to capture a packet on the network can discover the community string. This may allow unauthorized users to query or modify routers via SNMP. This may also allow an attacker to catch the configuration file and obtain an encryted password. You can refer to "Hijacking a session with dsniff and Hunt" on http://www.advknowledge.net to have some more precisions on how to sniff a connection and capture packets sent. Now here is a known exploit for the SNMP service. This exploit isn't only used to hack a Cisco IOS but can also be used for many hosts running that service (installed by default on most windows and unix systems.) The exploit is using the community string i were talking about. Some infos first, SNMP is using the UDP protocol (ports 161 and 162). The PDU (Protocol Data Unit) getRequest is used to reclaim a data registerted in a table on the server, a MIB (Management Information Base). An OID (Object IDentifier) is assigned to all MIB objects and will look like that : 1.3.6.1.2.1.1.1 By running getRequest 1.3.6.1.2.1.1.1, you will have informations on the network disposition and a system description. getNextRequest reclaims the data next to the obtain data. setRequest permiss a client to define a variable on the MIB. This fonction is very powerfull and need a community string with a write access on the authentification. I know thats long but you have to know that to understand the exploit :) The authentification contain two elements : a version number and a community string including an IP. The community string define two access levels : a read only access and a read/write access. With the first level, get commands can be executed and with the second level, setRequest is auauthorized. Name of this strings can be easiely guess with a special brute force attack. Here is a SNMP brute forcer, Solarwinds : http://www.solarwinds.net/_Tools/Security/SNMP%20Brute%20Force/index.htm Most used community strings are private and public Errors won't be register in any log files so you can do and try what you want to find strings Names of strings can also be found by a sniffing attack. With a valid IP, you can also send setRequest PDU and change the configuration file. Now, how does it work ? You can choose the SNMP client you want, i personally use SNMPUTIL which can be found in the NT4 and W2k ressource kits. snmputil walk hostname community OID Now here is an example of a request made to an NT4 SP5 : snmputil walk target public 1.3.6.1.4.1.77.1.2.25 Variable = .iso.org.dod.internet.private.entreprises.lanmanager.lanmgr-2.server.svUserTable.svUserEntry.svUserName.5.71.117.101.115.116 Value = OCTET STRING - Guest Variable = .iso.org.dod.internet.private.entreprises.lanmanager.lanmgr-2.server.svUserTable.svUserEntry.svUserName.13.65.100.109.105.110.105.115.116.114.97.116.111.114 Value = OCTET STRING - Administrator End of MIB subtree. As you can see, we now have the list of username accounts on the server. The command has been made just after an install but we would have all users' names if there were any other. As you can see, i've put "public" as the community string which is usually the default string for any system. Now that you see how it work, how will you do on a cisco router ? I will here use Snmpset (this example has been took from a Phrack article about SNMP security) : Snmpset -v 1 -e 10.0.10.12 router.pitfiful.com cisco00 system.sysName.0 s "owned" Snmpset is here use to change the hostname of a Cisco router. Here are some free SNMP tools you can use : snmpscan : the program sweeps host and routers using SNMPD (the SNMP Daemon) to search for common community strings. http://www.linux.org/apps/AppId_886.html SNMP Sniff : The program decode all SNMP v1 and v2 packets that are circulating on a network. Thats a perl program. http://linas.org/linux/NMS.html Scns.c : Sniff for community names. http://www.s0ftpj.org/en/site.html Ucd-SNMP : Advanced Snmp toolkit. http://net-snmp.sourceforge.net/ Scotty : Network tools including a SNMP client. http://www.home.cs.utwente.nl/~schoenw/scotty/ Now if you want to know what version of the IOS is running on a Cisco router try Ucd-SNMP and more especially Snmpwalk [root@hackerbox /etc]# snmpwalk target public system system.sysDescr.0 = Cisco Internetwork Operating System Software IOS C2900XL Software , Version 11.2<8>SA5, RELEASE SOFTWARE ... The "..." is for some more infos like the name of the administartor and the address and some other stuff. This will allow you to try a social engeneering method to have some passwords perhaps. The version of the software (Server C2900XL with the version 11.2(8) of the IOS) will help you to find exploits for the target. Also try WS PING Pro Pack for Windows (http://www.ipswitch.com) The SNMP tool is very usefull coz it show you the MIB architecture in graphic mode and will tell you what version of cisco is running on a router. SNMP is a big chunk and i think i've already said too much about it even if you don't have all the skills you need to start this type of attacks. If you want to know more about SNMP, have a look at the RFC 1574 and 1212. Also look at http://www?inforamp.net/~kjvallil/t/snmp.html and http://www.snmpframeworks.com/Download/index.html. II - Some other vulnerabilities on Cisco IOS * Cisco IOS HTTP %% Vulnerability A denial of service attack exists in versions of Cisco IOS, running on a variety of different router hardware. If the router is configured to have a web server running, for configuration and other information, via: ip http server in the configuration, by requesting: http:///%% a user can cause the router to crash. Some routers will automatically reboot, while others will require a power cycling to start routing packets again. Most Cisco IOS are vulnerable to this exploit (From Cisco IOS 11.1 to 12.0.7). * Cisco IOS HTTP Configuration Arbitrary Administrative Access Vulnerability When HTTP server is enabled and local authorization is used, it is possible, under some circumstances, to bypass the authentication and execute any command on the device. It that case, the user will be able to exercise complete control over the device. All commands will be executed with the highest privilege (level 15). Use this URL : http://CiscoIP/level/XX/exec/... where "XX" is an number between 16 and 99 and "..." is the program you want to execute. It is possible for a remote user to gain full administrative access. This problem makes it possible for a remote user to gain full administrative privileges, which may lead to further compromise of the network or result in a denial of service. Most Cisco IOS are vulnerable to this exploit (From Cisco IOS 11.3 to 12.2) Here are the addresses where you will find an exploit : - http://online.securityfocus.com/data/vulnerabilities/exploits/cishttpex.pl - http://online.securityfocus.com/data/vulnerabilities/exploits/ios-http-auth.sh - http://online.securityfocus.com/data/vulnerabilities/exploits/cisco-http.c - http://online.securityfocus.com/data/vulnerabilities/exploits/IOScan.pl - http://online.securityfocus.com/data/vulnerabilities/exploits/ios.pl * Cisco NRP2 Unauthorized Telnet Access Vulnerability The Cisco Node Route Processor 2 card is a module designed to enhance the services of the Cisco 6400 series broadband aggregators. It is distributed by Cisco Systems (of course) :) A problem in the Node Route Processor 2 (NRP2) makes it possible for remote users to gain unauthorized access to vtys. The default configuration of the NRP2 allows access to the vtys of the module when no password has been set. By default configuration, the NRP2 should allow no access until a password has been set. This makes it possible for a remote user to gain access to systems behind the NRP2 module, potentially accessing secure systems. III - Cisco IOS password cracking A weakness in the encryption protocol allows a hacker to crack IOS passwords using type 7 Cisco encrytion. This password can be found in the configuration file of any Cisco IOS. Here is an extract of the configuration file from a Cisco 3640 router with the version 12.1 of IOS : Current configuration : 656 bytes ! version 12.1 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname Router ! enable secret 5 $1$2ZTf$9UBtjkoYo6vW9FwXpnbuA. ! username admin privilege 15 password 0 cisco ! ip subnet-zero ! ip audit notify log ip audit po max-events 100 ! interface Serial0/0 ip address X.X.X.X.X.X.X.X ! interface Serial0/0 no ip address shutdown ! interface Serial0/1 no ip address shutdown ! ip classless ip route 0.0.0.0.0.0.0.0. X.X.X.X no ip http server First, what are the 3 types of passwords we can find on a Cisco IOS : * Type 0 passwords An IOS command allows to encrypt all passwords in the configuration file. If this command isn't done, all passwords (exept when you see "enable secret") are in plaintext : username admin privilege 15 password 0 cisco Here, we can see that the user is named "admin" and his password is "cisco". * Type 7 passwords This mode is set when you use the encrypt command "service password-encryption". With this command, all type 0 passwords transform to type 7 password and will look like that : username admin privilege 15 password 7 0822455D0A16 * Type 5 passwords The third type of password is encrypt with a MD5 algorithm. This will encrypt "enable secret" passwords : enable secret 5 $1$2ZTf$9UBtjkoYo6vW9FwXpnbuA. Type 5 passwords encryption are more strong and need a brute force attack to decrypt it. I won't explain how to decrypt manually the type 7 password, my lecture is enough long but i will, perhaps, in a tutorial. I will just say that Cisco IOS use a XOR fonction to encrypt the password (xorstring) Now what are the tools to decrypt it automatically ? Here are two programs that can crack the password but there are many others * The first program is ios7decrypt.pl (for Unix people) -> http://www.alcrypto.co.uk/cisco/perl/ios7decrypt.pl Thats a simple program, just past the line you want : username admin privilege 15 password 7 0822455D0A16 and here is the result : username admin privilege 15 password 7 cisco * The second program is GetPass! v1.1 (for bill's children) -> http://www.boston.com/download/eula.htm Very easy to use, just paste the encrypted password (0822455D0A16) in the dilog box, press GetOut and you've got it ! The decrypted password is : cisco As you can see, the harder work will be to steal the configuration file before cracking the passwords. I hope this lecture will help you 1 day. Even if i knew you were not hacking Cisco routers everyday, I've lectured about that topic to forge some hackers mind on what hacking is really. Learning is hard but the reward is gratifying. I will try to lecture here on #lecture every friday on different subjects and i'd like to have some feedback about what topics you want me to talk about. This lecture will be loged, like all the lecture i made and i will make, in http://www.advknowledge.net ################################################## # #Post lecture rambling # ################################################## Now if you have questions ... :D cool lecture -_IRIX- it was cool ! i'll be here next friday too! thx some hot topic * Criptik claps bravo bravo thats not for newbies cool wow well done sonny great lecture THANK YOU