Embedded Systems Security

High quality versions of the three Cisco IOS shellcode demonstration


Bind Shell

· Requires four hard-coded addresses of functions within IOS

· Creates a new VTY

· Sets a password on the VTY

· Privilege escalates to level 15

Video: Bind Shell

http://www.irmplc.com/content/videos...bindshell.html


Reverse Shell

· Requires five hard-coded addresses of functions within IOS

· Creates a new VTY

· Privilege escalates to level 15

· Opens a new TCP connection

· Binds the VTY to the TCP connection

Video: Reverse Shell

http://www.irmplc.com/content/videos...ell_final.html


Two byte rootshell or Tiny Shell

· Requires up to one (sometimes none) hard-coded addresses within IOS

· Removes the requirement to authenticate to a currently active VTY

· Privilege escalates to level 15

Video: "Two byte rootshell" or Tiny Shell

http://www.irmplc.com/content/videos...ell_final.html


More Info:

http://www.irmplc.com/index.php/153-...stems-Security