Re: Cisco Smart Install script
Gordon Fyodor Lyon <[email protected]> Wed, 18 Sep 2019 21:59:47 -0700
| Newsgroups | gmane.comp.security.nmap.devel |
|---|---|
| Message-ID | <CAJjO9MkCHtnqAOAEQgmKE6w+HQScBzQxRrEu5-VPNv8a1xWvCg@mail.gmail.com> |
--===============2217938353851645325== Content-Type: multipart/alternative; boundary="000000000000bfc4c90592e0d418" --000000000000bfc4c90592e0d418 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable That sounds good. Once you're happy with the script, can you submit a Github pull request so people can start testing it out? Cheers, Fyodor On Mon, Sep 9, 2019 at 10:50 AM XenoN. w0w <[email protected]> wrote: > I am really honored that I got response from you. By default, nmap can > detect that whether it is running smart-install service. When passing -sV > flag, nmap can=E2=80=99t detect the version. Here is the sample output. > > > > $ sudo nmap -Pn -sV -p 4786 <TARGET_IP> > > Starting Nmap 7.80SVN ( https://nmap.org ) at 2019-09-09 19:42 CEST > > Nmap scan report for <TARGET_IP> > > Host is up (0.20s latency). > > > > PORT STATE SERVICE VERSION > > 4786/tcp open smart-install? > > > > Script that I already have created and haven=E2=80=99t pushed it will by = default > test whether device is vulnerable by crafting packet and sending it to th= e > port 4786, then it will check if we got the right response and if so, > device is vulnerable and we can grab config, perhaps change config etc. > Below is output of the script I tested on one of the devices which are > vulnerable to this. > > > > $ sudo nmap -Pn -p 4786 <TARGET_IP> --script "./cisco-siet.nse" > > Starting Nmap 7.80SVN ( https://nmap.org ) at 2019-09-09 19:42 CEST > > Nmap scan report for <TARGET_IP> > > Host is up (0.20s latency). > > > > PORT STATE SERVICE > > 4786/tcp open smart-install > > | cisco-siet: > > | Host: <TARGET_IP> > > |_ Status: VULNERABLE > > > > Also, I have added option to the script to pass argument to the script to > get config, this requires running nmap as root user (or sudo) because it > will start tftp server onto which cisco device will send config. By > default, script will only test if the device is vulnerable or not. > > > > *From: *Gordon Fyodor Lyon <[email protected]> > *Date: *Monday, 9 September 2019 at 19:34 > *To: *"XenoN. w0w" <[email protected]> > *Cc: *"[email protected]" <[email protected]> > *Subject: *Re: Cisco Smart Install script > > > > > > > > On Mon, Aug 26, 2019 at 4:08 AM XenoN. w0w <[email protected]> wrote: > > Hello guys, during penetration testing engagements I often come to cisco > devices which allows me to grab their config over smart install protocol. > > I would like to make a script and add functionality of testing and gettin= g > config within the script. > > Here is the link for reference exploit https://github.com/Sab0tag3d/SIET > > > > What do you guys think about it? > > > > Thanks for the details. And wow, the Cisco advisory[1] really tries to > shirk all responsibility for this mess by writing: > > > > "Cisco does not consider this a vulnerability in Cisco IOS, IOS XE, or th= e > Smart Install feature itself but a misuse of the Smart Install protocol, > which does not require authentication by design." > > > > Well maybe they shouldn't have introduced such a lame "feature" in the > first place. And even though it is broken by design, there are lots of > ways that Cisco could have at least mitigated the problem. Apparently th= ey > only recently added a command to turn this crap off. > > > > Anyway, yeah, we'd like to see an NSE script or other Nmap features > related to this. For example, does Nmap version detection (-sV) detect > this properly? Are there good ways to detect the vulnerability (beyond ju= st > port 4786 being open) without reconfiguring the device or otherwise being > too intrusive? I mean an exploitation feature is nice too, but often Nma= p > users just want to learn as much as possible about the device and > vulnerability without doing anything too intrusive. > > > > Cheers, > > Fyodor > > > > > > [1] > https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cis= co-sa-20170214-smi > > > > > --000000000000bfc4c90592e0d418 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">That sounds good.=C2=A0 Once you're happy with the scr= ipt, can you submit a Github pull request so people can start testing it ou= t?<br><br>Cheers,<br>Fyodor<br></div><br><div class=3D"gmail_quote"><div di= r=3D"ltr" class=3D"gmail_attr">On Mon, Sep 9, 2019 at 10:50 AM XenoN. w0w &= lt;<a href=3D"mailto:[email protected]">[email protected]</a>> wrote= :<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.= 8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div lang=3D"EN-US"> <div class=3D"gmail-m_3775660731673673476WordSection1"> <p class=3D"MsoNormal"><span>I am really honored that I got response from y= ou. By default, nmap can detect that whether it is running smart-install se= rvice. When passing -sV flag, nmap can=E2=80=99t detect the version. Here i= s the sample output.<u></u><u></u></span></p> <p class=3D"MsoNormal"><span><u></u>=C2=A0<u></u></span></p> <p class=3D"MsoNormal"><span>$ sudo nmap -Pn -sV -p 4786 <TARGET_IP><= u></u><u></u></span></p> <p class=3D"MsoNormal"><span>Starting Nmap 7.80SVN ( <a href=3D"https://nma= p.org" target=3D"_blank">https://nmap.org</a> ) at 2019-09-09 19:42 CEST<u>= </u><u></u></span></p> <p class=3D"MsoNormal"><span>Nmap scan report for <TARGET_IP><u></u><= u></u></span></p> <p class=3D"MsoNormal"><span>Host is up (0.20s latency).<u></u><u></u></spa= n></p> <p class=3D"MsoNormal"><span><u></u>=C2=A0<u></u></span></p> <p class=3D"MsoNormal"><span>PORT=C2=A0=C2=A0=C2=A0=C2=A0 STATE SERVICE=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 VERSION<u></u><u></u></span></p> <p class=3D"MsoNormal"><span>4786/tcp open=C2=A0 smart-install?<u></u><u></= u></span></p> <p class=3D"MsoNormal"><span><u></u>=C2=A0<u></u></span></p> <p class=3D"MsoNormal"><span>Script that I already have created and haven= =E2=80=99t pushed it will by default test whether device is vulnerable by c= rafting packet and sending it to the port 4786, then it will check if we go= t the right response and if so, device is vulnerable and we can grab config, perhaps c= hange config etc. Below is output of the script I tested on one of the devi= ces which are vulnerable to this.<u></u><u></u></span></p> <p class=3D"MsoNormal"><span><u></u>=C2=A0<u></u></span></p> <p class=3D"MsoNormal"><span>$ sudo nmap -Pn -p 4786 <TARGET_IP> --sc= ript "./cisco-siet.nse"<u></u><u></u></span></p> <p class=3D"MsoNormal"><span>Starting Nmap 7.80SVN ( <a href=3D"https://nma= p.org" target=3D"_blank">https://nmap.org</a> ) at 2019-09-09 19:42 CEST<u>= </u><u></u></span></p> <p class=3D"MsoNormal"><span>Nmap scan report for <TARGET_IP><u></u><= u></u></span></p> <p class=3D"MsoNormal"><span>Host is up (0.20s latency).<u></u><u></u></spa= n></p> <p class=3D"MsoNormal"><span><u></u>=C2=A0<u></u></span></p> <p class=3D"MsoNormal"><span>PORT=C2=A0=C2=A0=C2=A0=C2=A0 STATE SERVICE<u><= /u><u></u></span></p> <p class=3D"MsoNormal"><span>4786/tcp open=C2=A0 smart-install<u></u><u></u= ></span></p> <p class=3D"MsoNormal"><span>| cisco-siet:<u></u><u></u></span></p> <p class=3D"MsoNormal"><span>|=C2=A0=C2=A0 Host: <TARGET_IP><u></u><u= ></u></span></p> <p class=3D"MsoNormal"><span>|_=C2=A0 Status: VULNERABLE<u></u><u></u></spa= n></p> <p class=3D"MsoNormal"><span><u></u>=C2=A0<u></u></span></p> <p class=3D"MsoNormal"><span>Also, I have added option to the script to pas= s argument to the script to get config, this requires running nmap as root = user (or sudo) because it will start tftp server onto which cisco device wi= ll send config. By default, script will only test if the device is vulnerable= or not.<u></u><u></u></span></p> <p class=3D"MsoNormal"><span><u></u>=C2=A0<u></u></span></p> <div style=3D"border-right:none;border-bottom:none;border-left:none;border-= top:1pt solid rgb(181,196,223);padding:3pt 0cm 0cm"> <p class=3D"MsoNormal"><b><span style=3D"font-size:12pt;color:black">From: = </span></b><span style=3D"font-size:12pt;color:black">Gordon Fyodor Lyon &l= t;<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>&= gt;<br> <b>Date: </b>Monday, 9 September 2019 at 19:34<br> <b>To: </b>"XenoN. w0w" <<a href=3D"mailto:[email protected]= " target=3D"_blank">[email protected]</a>><br> <b>Cc: </b>"<a href=3D"mailto:[email protected]" target=3D"_blank">dev@nmap= .org</a>" <<a href=3D"mailto:[email protected]" target=3D"_blank">dev@nm= ap.org</a>><br> <b>Subject: </b>Re: Cisco Smart Install script<u></u><u></u></span></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <div> <div> <p class=3D"MsoNormal">On Mon, Aug 26, 2019 at 4:08 AM XenoN. w0w <<a hr= ef=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>= > wrote:<u></u><u></u></p> </div> <blockquote style=3D"border-top:none;border-right:none;border-bottom:none;b= order-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4= .8pt;margin-right:0cm"> <div> <div> <p class=3D"MsoNormal">Hello guys, during penetration testing engagements I= often come to cisco devices which allows me to grab their config over smar= t install protocol. <u></u><u></u></p> <p class=3D"MsoNormal">I would like to make a script and add functionality = of testing and getting config within the script.<u></u><u></u></p> <p class=3D"MsoNormal">Here is the link for reference exploit <a href=3D"https://github.com/Sab0tag3d/SIET" target=3D"_blank">https://git= hub.com/Sab0tag3d/SIET</a><u></u><u></u></p> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> <p class=3D"MsoNormal">What do you guys think about it?<u></u><u></u></p> </div> </div> </blockquote> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">Thanks for the details.=C2=A0 And wow, the Cisco adv= isory[1] really tries to shirk all responsibility for this mess by writing:= <u></u><u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">"Cisco does not consider this a vulnerability i= n Cisco IOS, IOS XE, or the Smart Install feature itself but a misuse of th= e Smart Install protocol, which does not require authentication by design.&= quot;<u></u><u></u></p> </div> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">Well maybe they shouldn't have introduced such a= lame "feature" in the first place.=C2=A0 And even though it is b= roken by design, there are lots of ways that Cisco could have at least miti= gated the problem.=C2=A0 Apparently they only recently added a command to turn this crap off.<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">Anyway, yeah, we'd like to see an NSE script or = other Nmap features related to this.=C2=A0 For example, does Nmap version d= etection (-sV) detect this properly? Are there good ways to detect the vuln= erability (beyond just port 4786 being open) without reconfiguring the device or otherwise being too intrusive?=C2=A0 I= mean an exploitation feature is nice too, but often Nmap users just want t= o learn as much as possible about the device and vulnerability without doin= g anything too intrusive.<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">Cheers,<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">Fyodor<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">[1]=C2=A0<a href=3D"https://tools.cisco.com/security= /center/content/CiscoSecurityAdvisory/cisco-sa-20170214-smi" target=3D"_bla= nk">https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/c= isco-sa-20170214-smi</a><u></u><u></u></p> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> </div> </div> </div> </div> </div> </blockquote></div> --000000000000bfc4c90592e0d418-- --===============2217938353851645325== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sent through the dev mailing list https://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/ --===============2217938353851645325==--