📄 sigscr101.html
字号:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- saved from url=(0057)http://212.187.6.213/cgi-bin/down/down.cgi?sigscr101.html -->
<HTML><HEAD><TITLE>Securing IGS Cisco Routers v 1.01</TITLE>
<META content="text/html; charset=ISO-8859-1" http-equiv=content-type>
<META content="Data Wizard" name=author>
<META content="MSHTML 5.00.2614.3500" name=GENERATOR></HEAD>
<BODY>
<DIV align=center><BIG><BIG><BIG><B>Securing IGS Cisco Routers v
1.01<BR></B></BIG></BIG></BIG></DIV><BR><BR>This paper will describe how you
should obtain remote and local, information about an IGS Cisco Router. It’s
recommended if you have some experience with configuring Cisco Routers before
reading this paper, by the way it doesn’t matter which model you own. And more
important, you must own and know how to use a Unix oriented operating system.
After we have collected some information that is useful to us, we’ll try to
secure the router as good as possible. And please note, this paper is for
educational purposes only and I’m not responsible in any way for your stupid
actions if you’ll be caught.<BR><BR>Because the probability you don’t have an
IGS Cisco Router but a newer model like the IOS, it could happen you get
different outputs at programs like “nmap”. Also while securing the router it’s
possible you have to use some other commands than I do. Grab your manual if you
have one and try to find the correct command.<BR><BIG><BR></BIG><BIG><B>Getting
the information remote:</B></BIG><BR><BR>I assume you already have configured
you Cisco Router and your Unix box with the proper outfit. But because I know
there still are people who don’t know where to download the tools we’re going to
use, I’ve placed some links at the bottom of this paper which could be
useful.<BR><BR>I always start with an “nmap”-scan, we need to know first which
daemons are running at the remote host. Because I do own a couple of IGS Cisco
Routers myself, I’ll use the router with IP “169.254.0.10” for this paper. A
daemon can listen on various sockets, like UDP, TCP, IPX and SPX it could take a
long time before they all are scanned. And if you’re not at the same segment as
where the remote router is located, it’s completely useless to scan sockets
other than TCP and UDP. Protocols other than 802.3(Standard LLC, SNAP LLC and
RAW) & IP will standard not be rotated by any (internet)-router!<BR><BR>Well
we only will scan all listening TCP and UDP sockets and we use the following
command at the Unix shell: “nmap -sT -sU -p 1-65535 169.254.0.10”. For a
complete overview of all possibilities type: “man nmap”.<BR><BR>Port
State Service<BR><BR>7/tcp
open echo<BR>7/udp open
echo<BR>9/tcp open
discard<BR>9/udp open
discard<BR>23/tcp open telnet<BR>49/udp
open tacacs<BR>67udp open
bootps<BR>79/tcp open
finger<BR>161/udp open
snmp<BR>1993/tcp open
snmp-tcp-port<BR><BR>Above you notice an output of nmap, now I try to describe
every daemon…<BR><BR>By default many FTP daemons will use 20/TCP and 21/TCP,
while many Gopher daemons will only listen on 70/TCP, every daemon uses it’s
standard port. Of course you can configure the daemon so it listens at a
different port. So it’s possible that ‘behind’ 79/TCP at the IGS Cisco Router
there is listening another daemon then a finger daemon. There are two ways to
discover what daemon will really listen on a socket, one search in your IGS
Cisco Router manual; two establish a telnet session to the daemon. I’m trying to
establish a telnet session to all daemons, most times you get enough information
from the ‘banner’.<BR><BR>Echo (7/TCP&UDP)<BR><BR>SorNOT:~ # telnet
169.254.0.10 7<BR>Trying 169.254.0.10...<BR>Connected to 169.254.0.10.<BR>Escape
character is '^]'.<BR>hu<BR>hu<BR>:)<BR>:)<BR>echo<BR>echo<BR><BR>This daemon
will echo all commands nicely… but will not be really useful to us. So it’s
recommended to kill the daemon. Unless you want to have some digital chat friend
if you’re feeling bored… :-P<BR><BR><BR>Discard (9/TCP&UDP)<BR><BR>This
daemon is kind of funny (check the RFC), but isn’t also very useful, so kill
it...<BR><BR><BR>Telnet (23/TCP)<BR><BR>lappie:~/IGS # telnet 169.254.0.10
23<BR>Trying 169.254.0.10...<BR>Connected to 169.254.0.10.<BR>Escape character
is '^]'.<BR>User Access Verification<BR>Password:<BR>CiscoRouter><BR><BR>This
is a well-known daemon… I suppose you are familiar with it.<BR><BR><BR>Tacacs
(49/UDP)<BR><BR>This (Terminal Access Controller Access Control System) daemon
has a function I will never use… this daemon control dial-up lines. This option
is being used (only?) by Internet Service Providers, where their customers… well
create a connection to the Internet perhaps?<BR><BR><BR>Bootps
(67/UDP)<BR><BR>With this protocol you can remote configure a Cisco Router…
because your router has already been configured it’s not necessary anymore to
keep the daemon alive.<BR><BR><BR>Finger (79/TCP)<BR><BR>lappie:~/IGS # telnet
169.254.0.10 79<BR>Trying 169.254.0.10...<BR>Connected to
169.254.0.10.<BR>Escape character is '^]'.<BR><BR> Line
User Host(s)
Idle Location<BR>* 2 vty 0
idle
0
169.254.0.3<BR><BR>Connection closed by foreign host.<BR><BR>Here we get some
pretty valuable information, about who has established a connection to the
IGS-CR and from where… this daemon can also being used by a command within a
shell. So if you want to kill the daemon remember you cannot anymore use it from
within a shell.<BR><BR><BR>SNMP (161/UDP)<BR><BR>This (Simple Network Management
Protocol) daemon will come in handy in some situations, but I don’t see any
reason to let it ‘live’.<BR><BR><BR>SNMP-tcp-port (1993/tcp)<BR><BR>This is the
tcp version of the SNMP at 161/udp… so if you want to stop this daemon you have
to check if the daemon behind 1993/tcp is stopped
too.<BR><BR><BIG><BR></BIG><BIG><B>Getting the information
local:</B></BIG><BR><BR>We also can request information about the IGS-CR
locally, you don’t need to have ‘enable’ privileges for this. With the command
“show processes” you’ll get the following output like
below.<BR><BR>CiscoRouter#show processes<BR><BR> CPU utilization for one
minute: 15%; for five minutes: 15%<BR><BR> PID Q T PC
Runtime (ms) Invoked uSecs Stacks TTY
Process<BR><BR> 1 M E 1019D28 49052
5275 9298 876/1000 0 Net
Background<BR> 2 L E 102D2EC
0 4 0
880/1000 0 Logger<BR> 27 M * F14
548 55 9963
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -