EquationGroup Tool Leak – ExtraBacon Demo

Re:EquationGroup Tool Leak – ExtraBacon Demo by a2tech on Tuesday August 16, 2016 @11:38AM (#12298141)

On a Cisco router you login via SSH or Telnet, then you run a command to become 'enabled'. enable is a command like sudo on Linux-it elevates your permission level so you can make changes (although not all changes require you to be enabled, most do).

If you used ExtraBacon to clear the login user/password you would get a basic shell on connection. This would open at least 2 options to you as an attacker-1) using a local exploit to become an enabled user and 2) you can now send traffic to ALL the networks that the firewall/router knows about-for example, a non-internet connected management network that might be filled with never upgraded KVM/OOB control equipment.

[ Parent | on HN ]

Re:EquationGroup Tool Leak – ExtraBacon Demo by Zombieball on Tuesday August 16, 2016 @04:47PM (#12300519)

Thanks! #2 definitely seems like a big issue. I can imagine many "internal" services that are potentially insecure.

[ Parent | on HN ]

Re:EquationGroup Tool Leak – ExtraBacon Demo by Vendan on Tuesday August 16, 2016 @11:54PM (#12302417)

My fav is IPMI. Many devices allow you to log in using cipher 0... basically, if you know the username, you get access. The rest... well, IMPI has a hash disclosure built into the protocol. If you can guess a username, you can get (and try to crack) the password.

[ Parent | on HN ]