Confidence 2009.02 – Router Exploitation – Felix “FX” Lindner
Unlike the last time I was actually on time for Felix’ talk. Due to last nights activity I was surprised that he was on time himself. Again his slides included the Blackhat-O-Meter.
The first part of his presentation explained why routers are interesting targets (they are in the core), but also why routers are not actually exploited that much. One of the reasons is that the attack surface of router is quite small because routers don’t expose that much services to a truly remote attacker and are rarely used as clients.
The exception to the rule is “cisco-sa-20070124-crafted-ip-option” which is a remotely exploitable bug that causes a stack overflow on the router. Since “nobody ever updates router software” this vulnerability is still very much alive.
But routers need to support more and more, like IPv6, VoIP, XML configuration interface, luckily most services off.
Writing exploits for Cisco IOS is hard because it is not a real OS, but a single ELF binary. It is not based on a real OS we know hoe to exploit. Its only option to recover from a critical fault is a full reboot.
Another thing that makes exploitation hard is the memory layout. It is different from each single IOS version that it out there, and there are quite a few, currently there are over 270,000 different IOS images known by Cisco and you cannot get the version number remotely.
Best bet for getting a reliable return address for router exploitation is Rommon, the routers bios which loads the IOS and then remains in memory. It is at a fix address and there are big pools of the same versions present on the internet.
Unlike his talk at BlackHat Felix actually showed how the crafted ip option exploit can be used to get working reliable exploit. But since IOS is not an OS you need to get away with it without killing the router. If the stack is not completely overwritten, the return registers remain in tack and thus can be used to reliably return. His method has one drawback, in order for it to work, you need to know the version, but it is not remotely identifiable.
As an alternative there are code similarities in IOS images, but this still has problems.
Felix also made progress on shell code, he showed code that would cause the password evaluation function to always return true.
How do you protect your router?
• Have faith.
• Don’t allow people to talk to your router
• Protect your routing protocols
• Don’t run services on routers
• Treat your service cards as the linux machines they are
Running Rancid helps, modification of the data structures show up here.
Turn crash dumping on, this will make sure you keep evidence of any attacks.
