Re: dev Digest, Vol 174, Issue 8🔐🕷😄
HUMBERTO TOSCANO <[email protected]> Thu, 19 Sep 2019 12:16:51 +0200
| Newsgroups | gmane.comp.security.nmap.devel |
|---|---|
| Message-ID | <CADwxGqhLLXaroFJmyScto-Rym53rK42dOAAoSFDMk_q9+4dCoQ@mail.gmail.com> |
--===============5483011341421479795== Content-Type: multipart/alternative; boundary="0000000000003fecc10592e541d4" --0000000000003fecc10592e541d4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable MM mgeen El El jue, 19 sept 2019 a las 9:10, <[email protected]> escribi=C3=B3: > Send dev mailing list submissions to > [email protected] > > To subscribe or unsubscribe via the World Wide Web, visit > https://nmap.org/mailman/listinfo/dev > or, via email, send a message with subject or body 'help' to > [email protected] > > You can reach the person managing the list at > [email protected] > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of dev digest..." > > > Today's Topics: > > 1. Re: Cisco Smart Install script (Gordon Fyodor Lyon) > 2. Re: Cisco Smart Install script (Robin Wood) > 3. Re: Cisco Smart Install script (XenoN. w0w) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 18 Sep 2019 21:59:47 -0700 > From: Gordon Fyodor Lyon <[email protected]> > To: "XenoN. w0w" <[email protected]> > Cc: "[email protected]" <[email protected]> > Subject: Re: Cisco Smart Install script > Message-ID: > < > CAJjO9MkCHtnqAOAEQgmKE6w+HQScBzQxRrEu5-VPNv8a1xWvCg@mail.gmail.com> > Content-Type: text/plain; charset=3D"utf-8" > > That sounds good. Once you're happy with the script, can you submit a > Github pull request so people can start testing it out? > > Cheers, > Fyodor > > On Mon, Sep 9, 2019 at 10:50 AM XenoN. w0w <[email protected]> wrote: > > > I am really honored that I got response from you. By default, nmap can > > detect that whether it is running smart-install service. When passing -= sV > > flag, nmap can?t detect the version. Here is the sample output. > > > > > > > > $ sudo nmap -Pn -sV -p 4786 <TARGET_IP> > > > > Starting Nmap 7.80SVN ( https://nmap.org ) at 2019-09-09 19:42 CEST > > > > Nmap scan report for <TARGET_IP> > > > > Host is up (0.20s latency). > > > > > > > > PORT STATE SERVICE VERSION > > > > 4786/tcp open smart-install? > > > > > > > > Script that I already have created and haven?t pushed it will by defaul= t > > test whether device is vulnerable by crafting packet and sending it to > the > > port 4786, then it will check if we got the right response and if so, > > device is vulnerable and we can grab config, perhaps change config etc. > > Below is output of the script I tested on one of the devices which are > > vulnerable to this. > > > > > > > > $ sudo nmap -Pn -p 4786 <TARGET_IP> --script "./cisco-siet.nse" > > > > Starting Nmap 7.80SVN ( https://nmap.org ) at 2019-09-09 19:42 CEST > > > > Nmap scan report for <TARGET_IP> > > > > Host is up (0.20s latency). > > > > > > > > PORT STATE SERVICE > > > > 4786/tcp open smart-install > > > > | cisco-siet: > > > > | Host: <TARGET_IP> > > > > |_ Status: VULNERABLE > > > > > > > > Also, I have added option to the script to pass argument to the script = to > > get config, this requires running nmap as root user (or sudo) because i= t > > will start tftp server onto which cisco device will send config. By > > default, script will only test if the device is vulnerable or not. > > > > > > > > *From: *Gordon Fyodor Lyon <[email protected]> > > *Date: *Monday, 9 September 2019 at 19:34 > > *To: *"XenoN. w0w" <[email protected]> > > *Cc: *"[email protected]" <[email protected]> > > *Subject: *Re: Cisco Smart Install script > > > > > > > > > > > > > > > > On Mon, Aug 26, 2019 at 4:08 AM XenoN. w0w <[email protected]> wrote: > > > > Hello guys, during penetration testing engagements I often come to cisc= o > > devices which allows me to grab their config over smart install protoco= l. > > > > I would like to make a script and add functionality of testing and > getting > > config within the script. > > > > Here is the link for reference exploit https://github.com/Sab0tag3d/SIE= T > > > > > > > > What do you guys think about it? > > > > > > > > Thanks for the details. And wow, the Cisco advisory[1] really tries to > > shirk all responsibility for this mess by writing: > > > > > > > > "Cisco does not consider this a vulnerability in Cisco IOS, IOS XE, or > the > > Smart Install feature itself but a misuse of the Smart Install protocol= , > > which does not require authentication by design." > > > > > > > > Well maybe they shouldn't have introduced such a lame "feature" in the > > first place. And even though it is broken by design, there are lots of > > ways that Cisco could have at least mitigated the problem. Apparently > they > > only recently added a command to turn this crap off. > > > > > > > > Anyway, yeah, we'd like to see an NSE script or other Nmap features > > related to this. For example, does Nmap version detection (-sV) detect > > this properly? Are there good ways to detect the vulnerability (beyond > just > > port 4786 being open) without reconfiguring the device or otherwise bei= ng > > too intrusive? I mean an exploitation feature is nice too, but often > Nmap > > users just want to learn as much as possible about the device and > > vulnerability without doing anything too intrusive. > > > > > > > > Cheers, > > > > Fyodor > > > > > > > > > > > > [1] > > > https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cis= co-sa-20170214-smi > > > > > > > > > > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > https://nmap.org/mailman/private/dev/attachments/20190918/37bc11b1/attach= ment.html > > > > ------------------------------ > > Message: 2 > Date: Thu, 19 Sep 2019 08:06:39 +0100 > From: Robin Wood <[email protected]> > To: Fyodor <[email protected]> > Cc: "XenoN. w0w" <[email protected]>, nmap list <[email protected]> > Subject: Re: Cisco Smart Install script > Message-ID: > <CALmccy7PhNDi-tRT3uwRgm_xNYVb0kisN3=3D > [email protected]> > Content-Type: text/plain; charset=3D"utf-8" > > If it's the same issue I think it is, Nessus reports it as an info. The o= ne > that they report on can also be used to do unauthenticated code exec but = is > a feature not "vulnerability" so not a problem. > > Robin > > On Mon, 9 Sep 2019, 18:34 Gordon Fyodor Lyon, <[email protected]> wrote: > > > > > > > On Mon, Aug 26, 2019 at 4:08 AM XenoN. w0w <[email protected]> wrote: > > > >> Hello guys, during penetration testing engagements I often come to cis= co > >> devices which allows me to grab their config over smart install > protocol. > >> > >> I would like to make a script and add functionality of testing and > >> getting config within the script. > >> > >> Here is the link for reference exploit > https://github.com/Sab0tag3d/SIET > >> > >> > >> > >> What do you guys think about it? > >> > > > > Thanks for the details. And wow, the Cisco advisory[1] really tries to > > shirk all responsibility for this mess by writing: > > > > "Cisco does not consider this a vulnerability in Cisco IOS, IOS XE, or > the > > Smart Install feature itself but a misuse of the Smart Install protocol= , > > which does not require authentication by design." > > > > Well maybe they shouldn't have introduced such a lame "feature" in the > > first place. And even though it is broken by design, there are lots of > > ways that Cisco could have at least mitigated the problem. Apparently > they > > only recently added a command to turn this crap off. > > > > Anyway, yeah, we'd like to see an NSE script or other Nmap features > > related to this. For example, does Nmap version detection (-sV) detect > > this properly? Are there good ways to detect the vulnerability (beyond > just > > port 4786 being open) without reconfiguring the device or otherwise bei= ng > > too intrusive? I mean an exploitation feature is nice too, but often > Nmap > > users just want to learn as much as possible about the device and > > vulnerability without doing anything too intrusive. > > > > Cheers, > > Fyodor > > > > > > [1] > > > https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cis= co-sa-20170214-smi > > > > > > _______________________________________________ > > Sent through the dev mailing list > > https://nmap.org/mailman/listinfo/dev > > Archived at http://seclists.org/nmap-dev/ > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > https://nmap.org/mailman/private/dev/attachments/20190919/a7d11120/attach= ment.html > > > > ------------------------------ > > Message: 3 > Date: Thu, 19 Sep 2019 07:09:44 +0000 > From: "XenoN. w0w" <[email protected]> > To: Robin Wood <[email protected]>, Fyodor <[email protected]> > Cc: nmap list <[email protected]> > Subject: Re: Cisco Smart Install script > Message-ID: > < > VI1PR0902MB17896F77F296C8D7CDC94F55FC890@VI1PR0902MB1789.eurprd09.prod.ou= tlook.com > > > > Content-Type: text/plain; charset=3D"us-ascii" > > What do you think should i submit PR for it at all? Even though it is > feature, during pentesting engagements you can find out a lots of > information and perhaps gain code exec depending on ios version. > ________________________________ > From: Robin Wood <[email protected]> > Sent: Thursday, September 19, 2019 9:06:39 AM > To: Fyodor <[email protected]> > Cc: XenoN. w0w <[email protected]>; nmap list <[email protected]> > Subject: Re: Cisco Smart Install script > > If it's the same issue I think it is, Nessus reports it as an info. The > one that they report on can also be used to do unauthenticated code exec > but is a feature not "vulnerability" so not a problem. > > Robin > > On Mon, 9 Sep 2019, 18:34 Gordon Fyodor Lyon, <[email protected]<mailto: > [email protected]>> wrote: > > > On Mon, Aug 26, 2019 at 4:08 AM XenoN. w0w <[email protected]<mailto: > [email protected]>> wrote: > Hello guys, during penetration testing engagements I often come to cisco > devices which allows me to grab their config over smart install protocol. > I would like to make a script and add functionality of testing and gettin= g > config within the script. > Here is the link for reference exploit https://github.com/Sab0tag3d/SIET > > What do you guys think about it? > > Thanks for the details. And wow, the Cisco advisory[1] really tries to > shirk all responsibility for this mess by writing: > > "Cisco does not consider this a vulnerability in Cisco IOS, IOS XE, or th= e > Smart Install feature itself but a misuse of the Smart Install protocol, > which does not require authentication by design." > > Well maybe they shouldn't have introduced such a lame "feature" in the > first place. And even though it is broken by design, there are lots of > ways that Cisco could have at least mitigated the problem. Apparently th= ey > only recently added a command to turn this crap off. > > Anyway, yeah, we'd like to see an NSE script or other Nmap features > related to this. For example, does Nmap version detection (-sV) detect > this properly? Are there good ways to detect the vulnerability (beyond ju= st > port 4786 being open) without reconfiguring the device or otherwise being > too intrusive? I mean an exploitation feature is nice too, but often Nma= p > users just want to learn as much as possible about the device and > vulnerability without doing anything too intrusive. > > Cheers, > Fyodor > > > [1] > https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cis= co-sa-20170214-smi > > > _______________________________________________ > Sent through the dev mailing list > https://nmap.org/mailman/listinfo/dev > Archived at http://seclists.org/nmap-dev/ > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > https://nmap.org/mailman/private/dev/attachments/20190919/eeb97a0a/attach= ment.html > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > dev mailing list > [email protected] > https://nmap.org/mailman/listinfo/dev > > > ------------------------------ > > End of dev Digest, Vol 174, Issue 8 > *********************************** > --0000000000003fecc10592e541d4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div><div dir=3D"auto">MM mgeen</div></div><div><br><div class=3D"gmail_quo= te"><div dir=3D"ltr" class=3D"gmail_attr">El El jue, 19 sept 2019 a las 9:1= 0, <<a href=3D"mailto:[email protected]">[email protected]</a>>= escribi=C3=B3:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:= 0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send dev mailing li= st submissions to<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"mailto:[email protected]" target=3D"_blan= k">[email protected]</a><br> <br> To subscribe or unsubscribe via the World Wide Web, visit<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"https://nmap.org/mailman/listinfo/de= v" rel=3D"noreferrer" target=3D"_blank">https://nmap.org/mailman/listinfo/d= ev</a><br> or, via email, send a message with subject or body 'help' to<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"mailto:[email protected]" target= =3D"_blank">[email protected]</a><br> <br> You can reach the person managing the list at<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"mailto:[email protected]" target=3D= "_blank">[email protected]</a><br> <br> When replying, please edit your Subject line so it is more specific<br> than "Re: Contents of dev digest..."<br> <br> <br> Today's Topics:<br> <br> =C2=A0 =C2=A01. Re: Cisco Smart Install script (Gordon Fyodor Lyon)<br> =C2=A0 =C2=A02. Re: Cisco Smart Install script (Robin Wood)<br> =C2=A0 =C2=A03. Re: Cisco Smart Install script (XenoN. w0w)<br> <br> <br> ----------------------------------------------------------------------<br> <br> Message: 1<br> Date: Wed, 18 Sep 2019 21:59:47 -0700<br> From: Gordon Fyodor Lyon <<a href=3D"mailto:[email protected]" target=3D"_= blank">[email protected]</a>><br> To: "XenoN. w0w" <<a href=3D"mailto:[email protected]" targe= t=3D"_blank">[email protected]</a>><br> Cc: "<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a= >" <<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]<= /a>><br> Subject: Re: Cisco Smart Install script<br> Message-ID:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 <<a href=3D"mailto:CAJjO9MkCHtnqAOAEQgmKE6w%= [email protected]" target=3D"_blank">CAJjO9MkCHtn= [email protected]</a>><br> Content-Type: text/plain; charset=3D"utf-8"<br> <br> That sounds good.=C2=A0 Once you're happy with the script, can you subm= it a<br> Github pull request so people can start testing it out?<br> <br> Cheers,<br> Fyodor<br> <br> On Mon, Sep 9, 2019 at 10:50 AM XenoN. w0w <<a href=3D"mailto:e-net15@ho= tmail.com" target=3D"_blank">[email protected]</a>> wrote:<br> <br> > I am really honored that I got response from you. By default, nmap can= <br> > detect that whether it is running smart-install service. When passing = -sV<br> > flag, nmap can?t detect the version. Here is the sample output.<br> ><br> ><br> ><br> > $ sudo nmap -Pn -sV -p 4786 <TARGET_IP><br> ><br> > Starting Nmap 7.80SVN ( <a href=3D"https://nmap.org" rel=3D"noreferrer= " target=3D"_blank">https://nmap.org</a> ) at 2019-09-09 19:42 CEST<br> ><br> > Nmap scan report for <TARGET_IP><br> ><br> > Host is up (0.20s latency).<br> ><br> ><br> ><br> > PORT=C2=A0 =C2=A0 =C2=A0STATE SERVICE=C2=A0 =C2=A0 =C2=A0 =C2=A0 VERSI= ON<br> ><br> > 4786/tcp open=C2=A0 smart-install?<br> ><br> ><br> ><br> > Script that I already have created and haven?t pushed it will by defau= lt<br> > test whether device is vulnerable by crafting packet and sending it to= the<br> > port 4786, then it will check if we got the right response and if so,<= br> > device is vulnerable and we can grab config, perhaps change config etc= .<br> > Below is output of the script I tested on one of the devices which are= <br> > vulnerable to this.<br> ><br> ><br> ><br> > $ sudo nmap -Pn -p 4786 <TARGET_IP> --script "./cisco-siet.= nse"<br> ><br> > Starting Nmap 7.80SVN ( <a href=3D"https://nmap.org" rel=3D"noreferrer= " target=3D"_blank">https://nmap.org</a> ) at 2019-09-09 19:42 CEST<br> ><br> > Nmap scan report for <TARGET_IP><br> ><br> > Host is up (0.20s latency).<br> ><br> ><br> ><br> > PORT=C2=A0 =C2=A0 =C2=A0STATE SERVICE<br> ><br> > 4786/tcp open=C2=A0 smart-install<br> ><br> > | cisco-siet:<br> ><br> > |=C2=A0 =C2=A0Host: <TARGET_IP><br> ><br> > |_=C2=A0 Status: VULNERABLE<br> ><br> ><br> ><br> > Also, I have added option to the script to pass argument to the script= to<br> > get config, this requires running nmap as root user (or sudo) because = it<br> > will start tftp server onto which cisco device will send config. By<br= > > default, script will only test if the device is vulnerable or not.<br> ><br> ><br> ><br> > *From: *Gordon Fyodor Lyon <<a href=3D"mailto:[email protected]" targ= et=3D"_blank">[email protected]</a>><br> > *Date: *Monday, 9 September 2019 at 19:34<br> > *To: *"XenoN. w0w" <<a href=3D"mailto:[email protected]= " target=3D"_blank">[email protected]</a>><br> > *Cc: *"<a href=3D"mailto:[email protected]" target=3D"_blank">dev@nmap= .org</a>" <<a href=3D"mailto:[email protected]" target=3D"_blank">dev@nm= ap.org</a>><br> > *Subject: *Re: Cisco Smart Install script<br> ><br> ><br> ><br> ><br> ><br> ><br> ><br> > On Mon, Aug 26, 2019 at 4:08 AM XenoN. w0w <<a href=3D"mailto:e-net= [email protected]" target=3D"_blank">[email protected]</a>> wrote:<br> ><br> > Hello guys, during penetration testing engagements I often come to cis= co<br> > devices which allows me to grab their config over smart install protoc= ol.<br> ><br> > I would like to make a script and add functionality of testing and get= ting<br> > config within the script.<br> ><br> > Here is the link for reference exploit <a href=3D"https://github.com/S= ab0tag3d/SIET" rel=3D"noreferrer" target=3D"_blank">https://github.com/Sab0= tag3d/SIET</a><br> ><br> ><br> ><br> > What do you guys think about it?<br> ><br> ><br> ><br> > Thanks for the details.=C2=A0 And wow, the Cisco advisory[1] really tr= ies to<br> > shirk all responsibility for this mess by writing:<br> ><br> ><br> ><br> > "Cisco does not consider this a vulnerability in Cisco IOS, IOS X= E, or the<br> > Smart Install feature itself but a misuse of the Smart Install protoco= l,<br> > which does not require authentication by design."<br> ><br> ><br> ><br> > Well maybe they shouldn't have introduced such a lame "featur= e" in the<br> > first place.=C2=A0 And even though it is broken by design, there are l= ots of<br> > ways that Cisco could have at least mitigated the problem.=C2=A0 Appar= ently they<br> > only recently added a command to turn this crap off.<br> ><br> ><br> ><br> > Anyway, yeah, we'd like to see an NSE script or other Nmap feature= s<br> > related to this.=C2=A0 For example, does Nmap version detection (-sV) = detect<br> > this properly? Are there good ways to detect the vulnerability (beyond= just<br> > port 4786 being open) without reconfiguring the device or otherwise be= ing<br> > too intrusive?=C2=A0 I mean an exploitation feature is nice too, but o= ften Nmap<br> > users just want to learn as much as possible about the device and<br> > vulnerability without doing anything too intrusive.<br> ><br> ><br> ><br> > Cheers,<br> ><br> > Fyodor<br> ><br> ><br> ><br> ><br> ><br> > [1]<br> > <a href=3D"https://tools.cisco.com/security/center/content/CiscoSecuri= tyAdvisory/cisco-sa-20170214-smi" rel=3D"noreferrer" target=3D"_blank">http= s://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-= 20170214-smi</a><br> ><br> ><br> ><br> ><br> ><br> -------------- next part --------------<br> An HTML attachment was scrubbed...<br> URL: <<a href=3D"https://nmap.org/mailman/private/dev/attachments/201909= 18/37bc11b1/attachment.html" rel=3D"noreferrer" target=3D"_blank">https://n= map.org/mailman/private/dev/attachments/20190918/37bc11b1/attachment.html</= a>><br> <br> ------------------------------<br> <br> Message: 2<br> Date: Thu, 19 Sep 2019 08:06:39 +0100<br> From: Robin Wood <<a href=3D"mailto:[email protected]" target=3D"_blan= k">[email protected]</a>><br> To: Fyodor <<a href=3D"mailto:[email protected]" target=3D"_blank">fyodor@= nmap.org</a>><br> Cc: "XenoN. w0w" <<a href=3D"mailto:[email protected]" targe= t=3D"_blank">[email protected]</a>>, nmap list <<a href=3D"mailto:d= [email protected]" target=3D"_blank">[email protected]</a>><br> Subject: Re: Cisco Smart Install script<br> Message-ID:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 <CALmccy7PhNDi-tRT3uwRgm_xNYVb0kisN3=3D<a hr= ef=3D"mailto:[email protected]" target=3D"_blank">XupcWBGYtwXp= [email protected]</a>><br> Content-Type: text/plain; charset=3D"utf-8"<br> <br> If it's the same issue I think it is, Nessus reports it as an info. The= one<br> that they report on can also be used to do unauthenticated code exec but is= <br> a feature not "vulnerability" so not a problem.<br> <br> Robin<br> <br> On Mon, 9 Sep 2019, 18:34 Gordon Fyodor Lyon, <<a href=3D"mailto:fyodor@= nmap.org" target=3D"_blank">[email protected]</a>> wrote:<br> <br> ><br> ><br> > On Mon, Aug 26, 2019 at 4:08 AM XenoN. w0w <<a href=3D"mailto:e-net= [email protected]" target=3D"_blank">[email protected]</a>> wrote:<br> ><br> >> Hello guys, during penetration testing engagements I often come to= cisco<br> >> devices which allows me to grab their config over smart install pr= otocol.<br> >><br> >> I would like to make a script and add functionality of testing and= <br> >> getting config within the script.<br> >><br> >> Here is the link for reference exploit <a href=3D"https://github.c= om/Sab0tag3d/SIET" rel=3D"noreferrer" target=3D"_blank">https://github.com/= Sab0tag3d/SIET</a><br> >><br> >><br> >><br> >> What do you guys think about it?<br> >><br> ><br> > Thanks for the details.=C2=A0 And wow, the Cisco advisory[1] really tr= ies to<br> > shirk all responsibility for this mess by writing:<br> ><br> > "Cisco does not consider this a vulnerability in Cisco IOS, IOS X= E, or the<br> > Smart Install feature itself but a misuse of the Smart Install protoco= l,<br> > which does not require authentication by design."<br> ><br> > Well maybe they shouldn't have introduced such a lame "featur= e" in the<br> > first place.=C2=A0 And even though it is broken by design, there are l= ots of<br> > ways that Cisco could have at least mitigated the problem.=C2=A0 Appar= ently they<br> > only recently added a command to turn this crap off.<br> ><br> > Anyway, yeah, we'd like to see an NSE script or other Nmap feature= s<br> > related to this.=C2=A0 For example, does Nmap version detection (-sV) = detect<br> > this properly? Are there good ways to detect the vulnerability (beyond= just<br> > port 4786 being open) without reconfiguring the device or otherwise be= ing<br> > too intrusive?=C2=A0 I mean an exploitation feature is nice too, but o= ften Nmap<br> > users just want to learn as much as possible about the device and<br> > vulnerability without doing anything too intrusive.<br> ><br> > Cheers,<br> > Fyodor<br> ><br> ><br> > [1]<br> > <a href=3D"https://tools.cisco.com/security/center/content/CiscoSecuri= tyAdvisory/cisco-sa-20170214-smi" rel=3D"noreferrer" target=3D"_blank">http= s://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-= 20170214-smi</a><br> ><br> ><br> > _______________________________________________<br> > Sent through the dev mailing list<br> > <a href=3D"https://nmap.org/mailman/listinfo/dev" rel=3D"noreferrer" t= arget=3D"_blank">https://nmap.org/mailman/listinfo/dev</a><br> > Archived at <a href=3D"http://seclists.org/nmap-dev/" rel=3D"noreferre= r" target=3D"_blank">http://seclists.org/nmap-dev/</a><br> -------------- next part --------------<br> An HTML attachment was scrubbed...<br> URL: <<a href=3D"https://nmap.org/mailman/private/dev/attachments/201909= 19/a7d11120/attachment.html" rel=3D"noreferrer" target=3D"_blank">https://n= map.org/mailman/private/dev/attachments/20190919/a7d11120/attachment.html</= a>><br> <br> ------------------------------<br> <br> Message: 3<br> Date: Thu, 19 Sep 2019 07:09:44 +0000<br> From: "XenoN. w0w" <<a href=3D"mailto:[email protected]" tar= get=3D"_blank">[email protected]</a>><br> To: Robin Wood <<a href=3D"mailto:[email protected]" target=3D"_blank"= >[email protected]</a>>, Fyodor <<a href=3D"mailto:[email protected]"= target=3D"_blank">[email protected]</a>><br> Cc: nmap list <<a href=3D"mailto:[email protected]" target=3D"_blank">dev@nma= p.org</a>><br> Subject: Re: Cisco Smart Install script<br> Message-ID:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 <<a href=3D"mailto:VI1PR0902MB17896F77F296C8= [email protected]" target=3D"_blank= ">VI1PR0902MB17896F77F296C8D7CDC94F55FC890@VI1PR0902MB1789.eurprd09.prod.ou= tlook.com</a>><br> <br> Content-Type: text/plain; charset=3D"us-ascii"<br> <br> What do you think should i submit PR for it at all? Even though it is featu= re, during pentesting engagements you can find out a lots of information an= d perhaps gain code exec depending on ios version.<br> ________________________________<br> From: Robin Wood <<a href=3D"mailto:[email protected]" target=3D"_blan= k">[email protected]</a>><br> Sent: Thursday, September 19, 2019 9:06:39 AM<br> To: Fyodor <<a href=3D"mailto:[email protected]" target=3D"_blank">fyodor@= nmap.org</a>><br> Cc: XenoN. w0w <<a href=3D"mailto:[email protected]" target=3D"_blank"= >[email protected]</a>>; nmap list <<a href=3D"mailto:[email protected]"= target=3D"_blank">[email protected]</a>><br> Subject: Re: Cisco Smart Install script<br> <br> If it's the same issue I think it is, Nessus reports it as an info. The= one that they report on can also be used to do unauthenticated code exec b= ut is a feature not "vulnerability" so not a problem.<br> <br> Robin<br> <br> On Mon, 9 Sep 2019, 18:34 Gordon Fyodor Lyon, <<a href=3D"mailto:fyodor@= nmap.org" target=3D"_blank">[email protected]</a><mailto:<a href=3D"mailto= :[email protected]" target=3D"_blank">[email protected]</a>>> wrote:<br> <br> <br> On Mon, Aug 26, 2019 at 4:08 AM XenoN. w0w <<a href=3D"mailto:e-net15@ho= tmail.com" target=3D"_blank">[email protected]</a><mailto:<a href=3D"m= ailto:[email protected]" target=3D"_blank">[email protected]</a>>>= ; wrote:<br> Hello guys, during penetration testing engagements I often come to cisco de= vices which allows me to grab their config over smart install protocol.<br> I would like to make a script and add functionality of testing and getting = config within the script.<br> Here is the link for reference exploit <a href=3D"https://github.com/Sab0ta= g3d/SIET" rel=3D"noreferrer" target=3D"_blank">https://github.com/Sab0tag3d= /SIET</a><br> <br> What do you guys think about it?<br> <br> Thanks for the details.=C2=A0 And wow, the Cisco advisory[1] really tries t= o shirk all responsibility for this mess by writing:<br> <br> "Cisco does not consider this a vulnerability in Cisco IOS, IOS XE, or= the Smart Install feature itself but a misuse of the Smart Install protoco= l, which does not require authentication by design."<br> <br> Well maybe they shouldn't have introduced such a lame "feature&quo= t; in the first place.=C2=A0 And even though it is broken by design, there = are lots of ways that Cisco could have at least mitigated the problem.=C2= =A0 Apparently they only recently added a command to turn this crap off.<br= > <br> Anyway, yeah, we'd like to see an NSE script or other Nmap features rel= ated to this.=C2=A0 For example, does Nmap version detection (-sV) detect t= his properly? Are there good ways to detect the vulnerability (beyond just = port 4786 being open) without reconfiguring the device or otherwise being t= oo intrusive?=C2=A0 I mean an exploitation feature is nice too, but often N= map users just want to learn as much as possible about the device and vulne= rability without doing anything too intrusive.<br> <br> Cheers,<br> Fyodor<br> <br> <br> [1] <a href=3D"https://tools.cisco.com/security/center/content/CiscoSecurit= yAdvisory/cisco-sa-20170214-smi" rel=3D"noreferrer" target=3D"_blank">https= ://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2= 0170214-smi</a><br> <br> <br> _______________________________________________<br> Sent through the dev mailing list<br> <a href=3D"https://nmap.org/mailman/listinfo/dev" rel=3D"noreferrer" target= =3D"_blank">https://nmap.org/mailman/listinfo/dev</a><br> Archived at <a href=3D"http://seclists.org/nmap-dev/" rel=3D"noreferrer" ta= rget=3D"_blank">http://seclists.org/nmap-dev/</a><br> -------------- next part --------------<br> An HTML attachment was scrubbed...<br> URL: <<a href=3D"https://nmap.org/mailman/private/dev/attachments/201909= 19/eeb97a0a/attachment.html" rel=3D"noreferrer" target=3D"_blank">https://n= map.org/mailman/private/dev/attachments/20190919/eeb97a0a/attachment.html</= a>><br> <br> ------------------------------<br> <br> Subject: Digest Footer<br> <br> _______________________________________________<br> dev mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br> <a href=3D"https://nmap.org/mailman/listinfo/dev" rel=3D"noreferrer" target= =3D"_blank">https://nmap.org/mailman/listinfo/dev</a><br> <br> <br> ------------------------------<br> <br> End of dev Digest, Vol 174, Issue 8<br> ***********************************<br> </blockquote></div></div> --0000000000003fecc10592e541d4-- --===============5483011341421479795== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sent through the dev mailing list https://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/ --===============5483011341421479795==--