Scribd Logo
Upload

Welcome to Scribd!

  • 59 views

    BlackHat EU 2011 Hedfors Owning The Datacenter-Slides

    Uploaded by

    Tomek Turba
    George Hedfors presented on vulnerabilities found in Cisco's NX-OS operating system at Black Hat Europe 2011. He discovered that NX-OS is based on embedded Linux and found exploitable vulnerabilities including undocumented CLI commands, CLI escapes using GDB that allowed privilege escalation, a layer 2 attack using long hostnames in CDP, an undocumented "ftpuser" account with a default password, and references to undocumented "IDDQD" commands that appeared to enable administrative privileges. Several of the issues were added to Cisco's bug tracking system and had workarounds of disabling affected services or were later fixed in an NX-OS update.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    BlackHat EU 2011 Hedfors Owning The Datacenter-Slides

    Uploaded by

    Tomek Turba
    59 views21 pages
    George Hedfors presented on vulnerabilities found in Cisco's NX-OS operating system at Black Hat Europe 2011. He discovered that NX-OS is based on embedded Linux and found exploitable vulnerabilities including undocumented CLI commands, CLI escapes using GDB that allowed privilege escalation, a layer 2 attack using long hostnames in CDP, an undocumented "ftpuser" account with a default password, and references to undocumented "IDDQD" commands that appeared to enable administrative privileges. Several of the issues were added to Cisco's bug tracking system and had workarounds of disabling affected services or were later fixed in an NX-OS update.

    Original Title

    BlackHat EU 2011 Hedfors Owning the Datacenter-Slides

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    George Hedfors presented on vulnerabilities found in Cisco's NX-OS operating system at Black Hat Europe 2011. He discovered that NX-OS is based on embedded Linux and found exploitable vulnerabilities including undocumented CLI commands, CLI escapes using GDB that allowed privilege escalation, a layer 2 attack using long hostnames in CDP, an undocumented "ftpuser" account with a default password, and references to undocumented "IDDQD" commands that appeared to enable administrative privileges. Several of the issues were added to Cisco's bug tracking system and had workarounds of disabling affected services or were later fixed in an NX-OS update.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    59 views21 pages

    BlackHat EU 2011 Hedfors Owning The Datacenter-Slides

    Uploaded by

    Tomek Turba
    George Hedfors presented on vulnerabilities found in Cisco's NX-OS operating system at Black Hat Europe 2011. He discovered that NX-OS is based on embedded Linux and found exploitable vulnerabilities including undocumented CLI commands, CLI escapes using GDB that allowed privilege escalation, a layer 2 attack using long hostnames in CDP, an undocumented "ftpuser" account with a default password, and references to undocumented "IDDQD" commands that appeared to enable administrative privileges. Several of the issues were added to Cisco's bug tracking system and had workarounds of disabling affected services or were later fixed in an NX-OS update.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 21

    Owning the data centre, Cisco NX-OS

    George Hedfors Working for Cybercom Sweden East AB (http://www.cybercomgroup.com) 12 years as IT- and information security consultant
    Previously worked for iX Security, Defcom, NetSec, n.runs and Pinion

    Contact george.hedfors@cybercomgroup.com Web page http://george.hedfors.com

    2011-03-18

    Black Hat Europe 2011

    Topics
    Short intro to Cisco NX-OS History of research Overview of underlying Linux Disclosure of vulnerabilities
    Undocumented CLi commands Command line interface escape Layer 2 attack Undocumented user account 2nd CLi escape (delayed) IDDQD

    FAQ
    2011-03-18 2 Black Hat Europe 2011

    What is NX-OS?
    Based on MontaVista (http://www.mvista.com) embedded Linux with kernel 2.6.10 VDC Virtualization, Virtual Device Context
    Nexus 4000 (for IBM BladeCenter) Nexus 5000 Nexus 7000 MDS 9500 FC Directors MDS 9222i FC Switch MDS 9100 FC Switches

    2011-03-18

    Black Hat Europe 2011

    What has been done


    Accidentally made a Cisco-7020 fall over due to an 9 years old denial of service attack Was able to recover CORE dumps from the attack Able to extract all files from the Cisco .bin installation package Found a number of exploitable vulnerabilities To do Dig deeper into Cisco VDC/VRF security

    2011-03-18

    Black Hat Europe 2011

    Cisco 7000-series
    Typical environment Banking/finance Other large data centers Impact Full exposure of interconnected networks and VLANs Possibility to eavesdrop and traffic modification Switch based rootkit installation?

    2011-03-18

    Black Hat Europe 2011

    Overview

    LINUX

    2011-03-18

    Black Hat Europe 2011

    Teh Linux

    root?!?

    2011-03-18

    Black Hat Europe 2011

    Hidden commands
    DC3 Shell the regular Cisco cli Configurations contain hidden commands

    2011-03-18

    Black Hat Europe 2011

    Escaping CLi

    2011-03-18

    Black Hat Europe 2011

    How could that happened?!


    o What could possibly g wrong here?

    /usr/bin/gdbserve

    2011-03-18

    10

    Black Hat Europe 2011

    Br0ken architecture

    Everything is running as root

    Even binaries execute using SUDO..

    bl SUDO Everyone can execute with fixa en ev his Is t

    ... ?? e

    2010-07-06

    11

    Company presentation

    What about layer 2?


    Cisco Discovery Protocol (CDP) 2001, FX crafted the first CDP DoS attack 2010, the CDP attack was rediscovered in NX-OS

    CDP has become demonized and is now running under the root user context

    2011-03-18

    12

    Black Hat Europe 2011

    The core dump

    2011-03-18

    13

    Black Hat Europe 2011

    CDP Daemon vulnerability analysis


    More then 255 bytes is used as Device ID to cause the segfault. The protocol specification allows length as a 16-bit integer.

    2010-07-06

    14

    Company presentation

    CDP Daemon vulnerability analysis


    Debugging:
    = (unsigned __int16)(payload - 4); // size field (void *) memset( memcpy( = payload - 4 + 1; = cdpd_malloc(13, );

    , 0, ); , (const void *)(packet_ptr + 4),

    );

    0x 57 8 0x 57

    (int) 1400 (byte) 87 Anything larger than 255 is truncated causing a consecutive HEAP overflow

    2010-07-06

    15

    Company presentation

    Undocumented user account


    So, where ftpuser come from?

    Default user? Backdoor? Easter egg? Recovered password nbv123


    2011-03-18 16 Black Hat Europe 2011

    Searching for nbv123

    2011-03-18

    17

    Black Hat Europe 2011

    IDDQD?

    God Mode!!

    2011-03-18

    18

    Black Hat Europe 2011

    Bug tracking
    CSCti03724 CLI escape in NX-OS using GDB
    Workaround: None Fixed in NX-OS 4.1(4)

    CSCti04026 Undocumented user available with default password on NX-OS system


    Workaround: None

    CSCtf08873 CDP with long hostname crashes CDPD on N7k


    Workaround: Disable CDP

    CSCti85295 NX-OS: SUDO privilege escalation


    Workaround: None
    2011-03-18 19 Black Hat Europe 2011

    Thanks
    Special thanks to Juan-Manuel Gonzales, PSIRT Incident Manager <juagonza@cisco.com>

    2011-03-18

    20

    Black Hat Europe 2011

    FAQ

    Questions?

    Contact george.hedfors@cybercomgroup.com
    2011-03-18 21 Black Hat Europe 2011

    You might also like