CiscoInTheSkyWithDiamonds

More documents

Recommendations

Info

#!/bin/bash mkdir -p /cisco/5 mkdir -p /cisco/6 mount /dev/sda5 /cisco/5 mount /dev/sda6 /cisco/6 cd /cisco/5/linux/ tar xvzf linux_cfg.tar.gz tar xvf linux_files.tar echo 'admin2:x:2003:503::/var/home/admin:/bin/bash' >> etc/passwd echo 'admin2:$1$6UVxCBYm$jVKidjHAeYOjYdElDJjXd.:15827:0:99999:7:::' >> etc/shadow cat > etc/xinetd.d/smtp .cksum rm -rf linux_files.tar etc isan cp linux_cfg.tar.gz .cksum /cisco/6/linux/ cd / umount /cisco/5 umount /cisco/6 reboot
The N1kV requires license files to be installed Uses the FlexNet Publisher License Manager For compatibility reasons, we had to look at that implementation (more later) One can easily grab all binaries from the system and disassemble them in IDA We start with the shell, which implements the “install license” command
Page 1: Observed by Greg & FX
Page 4 and 5: 1967: First systems with IBM CP-67
Page 6 and 7: 10 GigE Virtual Switch
Page 9 and 10: Cisco Nexus Operating System (NX-OS
Page 11: This being a VMware VM, we can boot
Page 15 and 16: Let‘s see what that function does
Page 17 and 18: Exploitation is a bit tricky though
Page 19 and 20: The jailbreak script adds a user to
Page 21 and 22: Why talk about licensing? CSCud0142
Page 23 and 24: 6 bytes (12 hex chars) “signature
Page 25 and 26: We could now exercise our 1337 reve
Page 28 and 29: CDP is everywhere in Cisco land VM
Page 30 and 31: The VSM stores a set of “opaque d
Page 32 and 33: Offset Size Meaning 0x0 8 Bit Proto
Page 35 and 36: VEMs register themselves with the V
Page 37 and 38: Cisco’s documentation says 128 Bi
Page 39: 1. Compromise a web server in a vir
Page 42 and 43: At Phenoelit, FtR is the go-to-guy
Page 45: Our work with Cisco PSIRT goes back

CiscoInTheSkyWithDiamonds

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?