except pivot into a higher-privileged management network full of juicy--and typically totally unpatched--Out-of-Band management equipment (consoles, IPMI, industrial gear)

Could you elaborate to those of us not familiar with Cisco routers?

My understanding is this exploit disables password authentication and allows you to access the device. A seperate command allows you to re-enable it.

Would this re-enabling kill your current connection? Is the password later needed to change settings on the router (like if you typed sudo and are forced to re-authenticate)?

On a Cisco router you login via SSH or Telnet, then you run a command to become 'enabled'. enable is a command like sudo on Linux-it elevates your permission level so you can make changes (although not all changes require you to be enabled, most do).

If you used ExtraBacon to clear the login user/password you would get a basic shell on connection. This would open at least 2 options to you as an attacker-1) using a local exploit to become an enabled user and 2) you can now send traffic to ALL the networks that the firewall/router knows about-for example, a non-internet connected management network that might be filled with never upgraded KVM/OOB control equipment.

Thanks! #2 definitely seems like a big issue. I can imagine many "internal" services that are potentially insecure.

My fav is IPMI. Many devices allow you to log in using cipher 0... basically, if you know the username, you get access. The rest... well, IMPI has a hash disclosure built into the protocol. If you can guess a username, you can get (and try to crack) the password.

In my lab, re-enabling did not kill the current connection, so it could be a very quick switch flick, login, revert to try and avoid detection.

The "enable" password is sort of like the root account on Cisco gear. When you first connect, you're in a low-priv state where you can do simple things like see the uptime of the device, interface info, etc. But to make any changes to the settings on the router, you have to run the "enable" command which typically asks for a password which is separate from the login password.

I guess the name comes from enabling admin functionality, but I don't know why Cisco didn't call the command admin. Anyway, this enable is different from enabling/disabling the login authentication.

For those without `showdead` on: (@dang / @sctb: this seems to be a false positive)

> XORcat 18 minutes ago [dead] [-]

> In my lab, re-enabling did not kill the current connection, so it could be a very quick switch flick, login, revert to try and avoid detection.

Instead of copying & pasting, you should be able to click on the timestamp of the comment and then click "Vouch" (which I just did for XORcat's comment).

Maybe you need a certain minimum karma level to have access to vouch?

This seems to be the case, at 926 karma I have comment downvotes but no vouch button yet.

Thanks for the tip and the vouching - as schoen suggests, it seems like I need a little bit more karma for this.