Re: [Full-disclosure] Creating Backdoors in Cisco IOS using Tcl

IRM Research wrote:
Tcl (Tool Command Language) is a scripting language used extensively in
embedded systems, which is easy to use and has some powerful features.
The language has been supported by Cisco IOS for some time now and is
used, for example, in IOS IVR configuration as well as for automating
mundane tasks regularly performed by network administrators. This short
technical briefing describes a technique using Tcl to create a backdoor
within IOS that would allow a remote attacker to execute privileged
commands on a networking device. The document (which includes a
proof-of-concept Tcl script) can be downloaded here:

http://www.irmplc.com/index.php/153-Embedded-Systems-Security

That's what happens when you sit too long on research and don't have
time to finish & publish...

I haven't checked with recent IOS, but in older releases if you bind
to port 23/tcp, your script is called before the CLI, i.e. you can do
a nice MITM (and thus hide that you are in).

If you don't load it over TFTP but copy/paste into TCLSH you would
only see it in the process list and not in the running configuration.

You can even disconnect and leave it running in the background, surviving
till reboot. But in my tests at some point it would start to consume a
lot of CPU with no reason (except maybe my weak TCL skills :)

Nico.
--
Nicolas FISCHBACH
Senior Manager - Network Engineering/Security - COLT Telecom
e:(nico@xxxxxxxxxxxx) w:<http://www.securite.org/nico/>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: [Full-disclosure] Creating Backdoors in Cisco IOS using Tcl
    ... IRM Research wrote: ... The language has been supported by Cisco IOS for some time now and is ... technical briefing describes a technique using Tcl to create a backdoor ... Senior Manager - Network Engineering/Security - COLT Telecom ...
    (Bugtraq)
  • Re: Cisco VPN AIM: is really needed for me?
    ... IOS 12.4ADV SECURITY ... public /29 range for my servers ... I would like to establish the tunnel from the site A (using network link ...
    (comp.dcom.sys.cisco)
  • Re: Desktop Support Access
    ... On some versions of IOS I know you can have different user accounts created ... Better Management for Network Security ... Ensure robust IP security through policy-based management ...
    (Security-Basics)
  • Re: Bitwise Not operators
    ... > When I try X from the command line, it complains, "Q" ... > What version of Tcl does IOS give you? ... info patchlevel gives 104 ...
    (comp.lang.tcl)
  • Re: Bitwise Not operators
    ... >Cisco routers now, in later versions of IOS, have a version of a tcl ... When I try X from the command line, it complains, "Q" ... What version of Tcl does IOS give you? ...
    (comp.lang.tcl)