Description of Cisco IOS Vulnerabilities

In this essay, the author

• Explains that vulnerabilities and back doors into devices are proving heaven for hackers and hell for administrators. the report aims to research vulnerabilities in cisco's ios operating system.
• Describes how cisco's gns3 (graphical network simulator) is used in conjunction with backtrack 5 to demonstrate the exploit tools of cisco.
• Explains that the default telnet password for cisco is 'cisco'. the password was found very quickly due to the small password list file which only contains slight variations.
• Advises network administrators to be aware that telnet sends information in plain text and is open to a plethora of attacks.
• Recommends using a combination of username and password on telnet, as it increases the time it could take for hacker to brute force them.
• Explains that the cisco auditing tool is a limited tool because it only discovers telnet passwords.
• Explains that when no telnet password is set, the router is not vulnerable to this type of attack.
• Explains how the scanner reveals that the default password of telnet is set on the router.
• Explains that if the default enable password of cisco is set on the router, ocs scanner will identify it and aided with the telnet password.
• Explains that password telnet and enable mode are set to default! ip router vulnerable.
• Describes cisco passwd scanner as a tool that scans class a, b, or c ip addresses for cisco routers that haven't changed their default password.
• Explains that the routers in the topology were not configured with line vty passwords, so cisco scanner doesn't return a result.
• Explains that the routers were configured with the default password of 'cisco' in the vty terminal.
• Explains that the cisco passwd scanner tool has limited functionality and renders ineffectual if a different password is set for line vty.
• Analyzes how the brute force attack of the router reveals that the community strings are set to public and private.
• Explains that the snmpcheck tool checks the community strings to determine if there read/write or read only. the community string public on the router from the topology has been inadvertently set to read
• Explains that the pubic community string is set to read/write, making the router configuration vulnerable.
• Explains that the configuration file is sent to the log viewer on the tftpd server.
• Explains that john the ripper is a widely used password cracker.
• Explains that question defence (2012) copy-router-config is available from backtrack 5, vulnerability assessment, network assessment and cisco tools.
• Explains null byte (2014) hack like a pro: how to crack private & public snmp passwords using onesixtyone.
• Explains that question defence (2012) copy-router-config is available from backtrack 5, vulnerability assessment, network assessment and cisco tools.
• Describes the features of the penetration testers open source toolkit.
• Explains the cisco auditing tool's main function is to scan cisco routers to look for well known vulnerabilities.
• Explains that if the telnet password is not set to a default value, it's easy to brute force the password.
• Explains that an nmap scan is one of the most efficient ways to discover the open ports on a router or network.
• Describes how cisoc ocs scans a range of ip address on cisco routers looking for the default telnet and enable passwords.
• Explains that virtual teletype (vty) is used to connect to the daemon via telnet. a simple topology set up in gns3 easily demonstrates the tool.
• Explains that the cisco scanner scans the network searching for the default password of the company on line vty.
• Explains that the tool copy cisco router config is only possible if the router is configured with the read/write (rw) community string.
• Explains that the copy router config tool copies the router configuration file and a trivial file transfer protocol (tftp) server stores the copied configuration files.
• Explains that the config file can be viewable from the tftpd server folder. an attacker can view sensitive information like usernames and passwords.