Bugtraq mailing list archives
Re: [Full-disclosure] Creating Backdoors in Cisco IOS using Tcl
From: Nicolas FISCHBACH <nicolist () securite org>
Date: Tue, 27 Nov 2007 16:19:07 +0100
IRM Research wrote:
Tcl (Tool Command Language) is a scripting language used extensively in embedded systems, which is easy to use and has some powerful features. The language has been supported by Cisco IOS for some time now and is used, for example, in IOS IVR configuration as well as for automating mundane tasks regularly performed by network administrators. This short technical briefing describes a technique using Tcl to create a backdoor within IOS that would allow a remote attacker to execute privileged commands on a networking device. The document (which includes a proof-of-concept Tcl script) can be downloaded here: http://www.irmplc.com/index.php/153-Embedded-Systems-Security
That's what happens when you sit too long on research and don't have time to finish & publish... I haven't checked with recent IOS, but in older releases if you bind to port 23/tcp, your script is called before the CLI, i.e. you can do a nice MITM (and thus hide that you are in). If you don't load it over TFTP but copy/paste into TCLSH you would only see it in the process list and not in the running configuration. You can even disconnect and leave it running in the background, surviving till reboot. But in my tests at some point it would start to consume a lot of CPU with no reason (except maybe my weak TCL skills :) Nico. -- Nicolas FISCHBACH Senior Manager - Network Engineering/Security - COLT Telecom e:(nico () securite org) w:<http://www.securite.org/nico/>
Current thread:
- Creating Backdoors in Cisco IOS using Tcl IRM Research (Nov 27)
- Re: [Full-disclosure] Creating Backdoors in Cisco IOS using Tcl Nicolas FISCHBACH (Nov 27)
- <Possible follow-ups>
- Re: Creating Backdoors in Cisco IOS using Tcl michael (Nov 27)