Hey folks,
It turns out that the tar file Shanphen mentions below is empty. I found it at: http://www.k-otik.com/exploits/07.21.cisco-bug-44020.c.php
with a link to working .gz as well. It looks like a cleanup of the original exploit but still relying completely on exploiting via protocols 53, 55, 77 and 103.
FWIW, I grabbed a copy of shadowchode.c and ran it against a lab 2611 running 12.1(16) and it locks the interface quite nicely after 38 iterations of the code (one half of 76 ;-). This takes about 0.4 seconds to complete. I was also serially connected at the time and although IP traffic was blocked I could easily work within the router and save to NVRAM and issue a reload command. Good news for those of you still vulnerable with terminal access to your equipment.
After re-booting, (lol!) I applied an ACL to block those protocols on the incoming interface from my laptop and the exploit no longer worked against that interface or one on the other side of the router.
For giggles I decided to recompile the code for protocols 54, 56, 78 and 104 and tried all over again and was not successful. I don't remember seeing in any of the threads if the protocols were specific but from my ever-so-random test it appears they are. Granted, I may have overlooked that part somewhere and I'm still reviewing all of this, especially for new exploits that may be uncovered because of all of this.
Cheers,
-Bill
-----Original Message-----
From: Shanphen Dawa [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, July 22, 2003 1:45 PM
To: [EMAIL PROTECTED]
Subject: [Full-Disclosure] Cisco Bug 44020
Here is supposedly a working Cisco exploit:
http://www.elxsi.de/cisco-bug-44020.tar.gz
This is pasted from security focus:
http://www.securityfocus.com/archive/1/329765/2003-07-19/2003-07-25/0
To:
BugTraq
Subject:
Cisco IOS exploit (44020)
Date:
Jul 21 2003 4:01PM
Author:
Martin Kluge <martin elxsi de>
Message-ID:
<[EMAIL PROTECTED]>
.. snip ..
_____________________________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
