Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
# -*- coding: binary -*-
2

3
module Msf
4
  ###
5
  #
6
  # This module provides methods for working with Cisco equipment
7
  #
8
  ###
9
  module Auxiliary::Cisco
10
    include Msf::Auxiliary::Report
11

12
    def cisco_ios_decrypt7(inp)
13
      xlat = [
14
        0x64, 0x73, 0x66, 0x64, 0x3b, 0x6b, 0x66, 0x6f,
15
        0x41, 0x2c, 0x2e, 0x69, 0x79, 0x65, 0x77, 0x72,
16
        0x6b, 0x6c, 0x64, 0x4a, 0x4b, 0x44, 0x48, 0x53,
17
        0x55, 0x42
18
      ]
19

20
      return nil if !(inp[0, 2] =~ /\d\d/)
21

22
      seed = nil
23
      clear = ''
24
      inp.scan(/../).each do |byte|
25
        if !seed
26
          seed = byte.to_i
27
          next
28
        end
29
        byte = byte.to_i(16)
30
        clear << [ byte ^ xlat[seed]].pack('C')
31
        seed += 1
32
      end
33
      clear
34
    end
35

36
    def cisco_ios_config_eater(thost, tport, config)
37

38
      if framework.db.active
39
        credential_data = {
40
          address: thost,
41
          port: tport,
42
          protocol: 'tcp',
43
          workspace_id: myworkspace_id,
44
          origin_type: :service,
45
          private_type: :password,
46
          service_name: '',
47
          module_fullname: fullname,
48
          status: Metasploit::Model::Login::Status::UNTRIED
49
        }
50
      end
51

52
      # Default SNMP to UDP
53
      if tport == 161
54
        credential_data[:protocol] = 'udp'
55
      end
56

57
      store_loot('cisco.ios.config', 'text/plain', thost, config.strip, 'config.txt', 'Cisco IOS Configuration')
58

59
      tuniface = nil
60

61
      host_info = {
62
        host: thost,
63
        os_name: 'Cisco IOS'
64
      }
65
      report_host(host_info)
66

67
      config.each_line do |line|
68
        case line
69
          #
70
          # Cover host details
71
          #
72
        when /^version (\d\d\.\d)/i
73
          host_info[:os_flavor] = Regexp.last_match(1).to_s
74
          report_host(host_info)
75
        when /^hostname (\S+)/i
76
          host_info[:name] = Regexp.last_match(1).to_s
77
          report_host(host_info)
78
          #
79
          # Enable passwords
80
          #
81
        when /^\s*enable (password|secret) (\d+) (.*)/i
82
          stype = Regexp.last_match(2).to_i
83
          shash = Regexp.last_match(3).strip
84

85
          if framework.db.active
86
            cred = credential_data.dup
87
            cred[:private_data] = shash
88
          else
89
            cred = {} # throw away
90
          end
91

92
          case stype
93
          when 5
94
            print_good("#{thost}:#{tport} MD5 Encrypted Enable Password: #{shash}")
95
            cred[:jtr_format] = 'md5'
96
            cred[:private_type] = :nonreplayable_hash
97
            create_credential_and_login(cred) if framework.db.active
98
          when 0 # unencrypted
99
            print_good("#{thost}:#{tport} Enable Password: #{shash}")
100
            create_credential_and_login(cred) if framework.db.active
101
          when 7
102
            shash = begin
103
                    cisco_ios_decrypt7(shash)
104
                    rescue StandardError
105
                      shash
106
                  end
107
            print_good("#{thost}:#{tport} Decrypted Enable Password: #{shash}")
108
            cred[:private_data] = shash
109
            create_credential_and_login(cred) if framework.db.active
110
          end
111

112
        when /^\s*enable password (.*)/i
113
          spass = Regexp.last_match(1).strip
114
          print_good("#{thost}:#{tport} Unencrypted Enable Password: #{spass}")
115

116
          if framework.db.active
117
            cred = credential_data.dup
118
            cred[:private_data] = spass
119
            create_credential_and_login(cred)
120
          end
121

122
          #
123
          # SNMP
124
          #
125
        when /^\s*snmp-server community ([^\s]+) (RO|RW)/i
126
          stype = Regexp.last_match(2).strip
127
          scomm = Regexp.last_match(1).strip
128
          print_good("#{thost}:#{tport} SNMP Community (#{stype}): #{scomm}")
129

130
          cred = credential_data.dup
131
          cred[:access_level] = stype.upcase
132
          cred[:protocol] = "udp"
133
          cred[:port] = 161
134
          cred[:private_data] = scomm
135
          create_credential_and_login(cred)
136
#
137
# VTY Passwords
138
#
139
        when /^\s*password 7 ([^\s]+)/i
140
          spass = Regexp.last_match(1).strip
141
          spass = begin
142
                  cisco_ios_decrypt7(spass)
143
                  rescue StandardError
144
                    spass
145
                end
146

147
          print_good("#{thost}:#{tport} Decrypted VTY Password: #{spass}")
148

149
          if framework.db.active
150
            cred = credential_data.dup
151
            cred[:private_data] = spass
152
            create_credential_and_login(cred)
153
          end
154

155
        when /^\s*(password|secret) 5 (.*)/i
156
          shash = Regexp.last_match(2).strip
157
          print_good("#{thost}:#{tport} MD5 Encrypted VTY Password: #{shash}")
158
          if framework.db.active
159
            cred = credential_data.dup
160
            cred[:jtr_format] = 'md5'
161
            cred[:private_data] = shash
162
            cred[:private_type] = :nonreplayable_hash
163
            create_credential_and_login(cred)
164
          end
165

166
        when /^\s*password (0 |)([^\s]+)/i
167
          spass = Regexp.last_match(2).strip
168
          print_good("#{thost}:#{tport} Unencrypted VTY Password: #{spass}")
169

170
          if framework.db.active
171
            cred = credential_data.dup
172
            cred[:private_data] = spass
173
            create_credential_and_login(cred)
174
          end
175

176
          #
177
          # WiFi Passwords
178
          #
179
        when /^\s*encryption key \d+ size \d+bit (\d+) ([^\s]+)/
180
          spass = Regexp.last_match(2).strip
181
          print_good("#{thost}:#{tport} Wireless WEP Key: #{spass}")
182

183
        when /^\s*wpa-psk (ascii|hex) (\d+) ([^\s]+)/i
184

185
          stype = Regexp.last_match(2).to_i
186
          spass = Regexp.last_match(3).strip
187

188
          if framework.db.active
189
            cred = credential_data.dup
190
            cred[:private_data] = spass
191
          else
192
            cred = {} # throw away
193
          end
194

195
          case stype
196
          when 5
197
            print_good("#{thost}:#{tport} Wireless WPA-PSK MD5 Password Hash: #{spass}")
198
            cred[:jtr_format] = 'md5'
199
            cred[:private_type] = :nonreplayable_hash
200
            create_credential_and_login(cred) if framework.db.active
201
          when 0
202
            print_good("#{thost}:#{tport} Wireless WPA-PSK Password: #{spass}")
203
            create_credential_and_login(cred) if framework.db.active
204
          when 7
205
            spass = begin
206
                    cisco_ios_decrypt7(spass)
207
                    rescue StandardError
208
                      spass
209
                  end
210
            print_good("#{thost}:#{tport} Wireless WPA-PSK Decrypted Password: #{spass}")
211
            cred[:private_data] = spass
212
            create_credential_and_login(cred) if framework.db.active
213
          end
214

215
          #
216
          # VPN Passwords
217
          #
218
        when /^\s*crypto isakmp key ([^\s]+) address ([^\s]+)/i
219
          spass = Regexp.last_match(1)
220
          shost = Regexp.last_match(2)
221

222
          print_good("#{thost}:#{tport} VPN IPSEC ISAKMP Key '#{spass}' Host '#{shost}'")
223
          if framework.db.active
224
            cred = credential_data.dup
225
            cred[:private_data] = spass
226
            cred[:private_type] = :nonreplayable_hash
227
            create_credential_and_login(cred)
228
          end
229

230
        when /^\s*interface tunnel(\d+)/i
231
          tuniface = Regexp.last_match(1)
232

233
        when /^\s*tunnel key ([^\s]+)/i
234
          spass = Regexp.last_match(1)
235
          siface = tuniface
236

237
          print_good("#{thost}:#{tport} GRE Tunnel Key #{spass} for Interface Tunnel #{siface}")
238
          if framework.db.active
239
            cred = credential_data.dup
240
            cred[:private_data] = spass
241
            cred[:private_type] = :nonreplayable_hash
242
            create_credential_and_login(cred)
243
          end
244

245
        when /^\s*ip nhrp authentication ([^\s]+)/i
246
          spass = Regexp.last_match(1)
247
          siface = tuniface
248

249
          print_good("#{thost}:#{tport} NHRP Authentication Key #{spass} for Interface Tunnel #{siface}")
250
          if framework.db.active
251
            cred = credential_data.dup
252
            cred[:private_data] = spass
253
            cred[:private_type] = :nonreplayable_hash
254
            create_credential_and_login(cred)
255
          end
256

257
          #
258
          # Various authentication secrets
259
          #
260
        when /^\s*username ([^\s]+) privilege (\d+) (secret|password) (\d+) ([^\s]+)/i
261
          user = Regexp.last_match(1)
262
          priv = Regexp.last_match(2)
263
          stype = Regexp.last_match(4).to_i
264
          spass = Regexp.last_match(5)
265

266
          if framework.db.active
267
            cred = credential_data.dup
268
            cred[:username] = user.to_s
269
            cred[:private_data] = spass
270
          else
271
            cred = {} # throw away
272
          end
273

274
          case stype
275
          when 5
276
            print_good("#{thost}:#{tport} Username '#{user}' with MD5 Encrypted Password: #{spass}")
277
            cred[:jtr_format] = 'md5'
278
            cred[:private_type] = :nonreplayable_hash
279
            create_credential_and_login(cred) if framework.db.active
280
          when 0
281
            print_good("#{thost}:#{tport} Username '#{user}' with Password: #{spass}")
282
            create_credential_and_login(cred) if framework.db.active
283
          when 7
284
            spass = begin
285
                    cisco_ios_decrypt7(spass)
286
                    rescue StandardError
287
                      spass
288
                  end
289
            print_good("#{thost}:#{tport} Username '#{user}' with Decrypted Password: #{spass}")
290
            cred[:private_data] = spass
291
            create_credential_and_login(cred) if framework.db.active
292
          end
293

294
          # This regex captures ephones from Cisco Unified Communications Manager Express (CUE) which come in forms like:
295
          # username "phonefour" password 444444
296
          # username test password test
297
          # This is used for the voicemail system
298
        when /^\s*username "?([\da-z]+)"? password ([^\s]+)/i
299
          user = Regexp.last_match(1)
300
          spass = Regexp.last_match(2)
301
          print_good("#{thost}:#{tport} ePhone Username '#{user}' with Password: #{spass}")
302
          if framework.db.active
303
            cred = credential_data.dup
304
            cred[:username] = user.to_s
305
            cred[:private_data] = spass
306
            create_credential_and_login(cred)
307
          end
308

309
        when /^\s*username ([^\s]+) (secret|password) (\d+) ([^\s]+)/i
310
          user = Regexp.last_match(1)
311
          stype = Regexp.last_match(3).to_i
312
          spass = Regexp.last_match(4)
313

314
          if framework.db.active
315
            cred = credential_data.dup
316
            cred[:username] = user.to_s
317
            cred[:private_data] = spass
318
          else
319
            cred = {}
320
          end
321

322
          case stype
323
          when 5
324
            print_good("#{thost}:#{tport} Username '#{user}' with MD5 Encrypted Password: #{spass}")
325
            cred[:jtr_format] = 'md5'
326
            cred[:private_type] = :nonreplayable_hash
327
            create_credential_and_login(cred) if framework.db.active
328
          when 0
329
            print_good("#{thost}:#{tport} Username '#{user}' with Password: #{spass}")
330
            create_credential_and_login(cred) if framework.db.active
331
          when 7
332
            spass = begin
333
                    cisco_ios_decrypt7(spass)
334
                    rescue StandardError
335
                      spass
336
                  end
337
            print_good("#{thost}:#{tport} Username '#{user}' with Decrypted Password: #{spass}")
338
            cred[:private_data] = spass
339
            create_credential_and_login(cred) if framework.db.active
340
          end
341

342
          # https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucme/command/reference/cme_cr/cme_cr_chapter_010101.html#wp3722577363
343
        when /^\s*web admin (customer|system) name ([^\s]+) (secret [0|5]|password) ([^\s]+)/i
344
          login = Regexp.last_match(1)
345
          suser = Regexp.last_match(2)
346
          stype = Regexp.last_match(3)
347
          spass = Regexp.last_match(4)
348

349
          if framework.db.active
350
            cred = credential_data.dup
351
            cred[:username] = suser.to_s
352
            cred[:private_data] = spass
353
          else
354
            cred = {}
355
          end
356

357
          case stype
358
          when 'secret 5'
359
            print_good("#{thost}:#{tport} Web Admin Username: #{suser} Type: #{login} MD5 Encrypted Password: #{spass}")
360
            cred[:jtr_format] = 'md5'
361
            cred[:private_type] = :nonreplayable_hash
362
            create_credential_and_login(cred) if framework.db.active
363
          when 'secret 0', 'password'
364
            print_good("#{thost}:#{tport} Web Username: #{suser} Type: #{login} Password: #{spass}")
365
            create_credential_and_login(cred) if framework.db.active
366
          end
367

368
        when /^\s*ppp.*username ([^\s]+) (secret|password) (\d+) ([^\s]+)/i
369

370
          suser = Regexp.last_match(1)
371
          stype = Regexp.last_match(3).to_i
372
          spass = Regexp.last_match(4)
373

374
          if framework.db.active
375
            cred = credential_data.dup
376
            cred[:username] = suser.to_s
377
            cred[:private_data] = spass
378
          else
379
            cred = {}
380
          end
381

382
          case stype
383
          when 5
384
            print_good("#{thost}:#{tport} PPP Username #{suser} MD5 Encrypted Password: #{spass}")
385
            cred[:jtr_format] = 'md5'
386
            cred[:private_type] = :nonreplayable_hash
387
            create_credential_and_login(cred) if framework.db.active
388
          when 0
389
            print_good("#{thost}:#{tport} PPP Username: #{suser} Password: #{spass}")
390
            create_credential_and_login(cred) if framework.db.active
391
          when 7
392
            spass = begin
393
                    cisco_ios_decrypt7(spass)
394
                    rescue StandardError
395
                      spass
396
                  end
397
            print_good("#{thost}:#{tport} PPP Username: #{suser} Decrypted Password: #{spass}")
398
            cred[:private_data] = spass
399
            create_credential_and_login(cred) if framework.db.active
400
          end
401

402
        when /^\s*ppp chap (secret|password) (\d+) ([^\s]+)/i
403
          stype = Regexp.last_match(2).to_i
404
          spass = Regexp.last_match(3)
405

406
          if framework.db.active
407
            cred = credential_data.dup
408
            cred[:private_data] = spass
409
          else
410
            cred = {}
411
          end
412

413
          case stype
414
          when 5
415
            print_good("#{thost}:#{tport} PPP CHAP MD5 Encrypted Password: #{spass}")
416
            cred[:jtr_format] = 'md5'
417
            cred[:private_type] = :nonreplayable_hash
418
            create_credential_and_login(cred) if framework.db.active
419
          when 0
420
            print_good("#{thost}:#{tport} Password: #{spass}")
421
            create_credential_and_login(cred) if framework.db.active
422
          when 7
423
            spass = begin
424
                    cisco_ios_decrypt7(spass)
425
                    rescue StandardError
426
                      spass
427
                  end
428
            print_good("#{thost}:#{tport} PPP Decrypted Password: #{spass}")
429
            cred[:private_data] = spass
430
            create_credential_and_login(cred) if framework.db.active
431
          end
432
        end
433
      end
434
    end
435
  end
436
end
437

438