Slides presented at SEC-T September 10th, 2010.

1. Owning the data centre, Cisco NX-OS George Hedfors Working for Cybercom Sweden East AB(http://www.cybercomgroup.com) 12 years as IT- and information security consultant Previously worked for iX Security, Defcom, NetSec, n.runs and Pinion Contact george.hedfors@cybercomgroup.com Web page http://george.hedfors.com 2010-08-10 SEC-T 2010 1

2. Short intro to Cisco NX-OS History of research Overview of underlying Linux Disclosure of vulnerabilities Undocumented CLi commands Command line interface escape Layer 2 attack Undocumented user account 2ndCLi escape (delayed) FAQ Topics 2010-08-10 SEC-T 2

3. Based on MontaVista (http://www.mvista.com)embedded Linux with kernel 2.6.10 VDC Virtualization, Virtual Device Context What is NX-OS? 2010-08-10 SEC-T 2010 3 Nexus 4000 (for IBM BladeCenter) Nexus 5000 Nexus 7000 MDS 9500 FC Directors MDS 9222i FC Switch MDS 9100 FC Switches

4. Accidentally made a Cisco-7020 fall over due to an 9 years old denial of service attack Was able to recover CORE dumps from the attack Able to extract all files from the Cisco .bin installation package Found a number of exploitable vulnerabilities To do Dig deeper into Cisco VDC/VRF security What has been done 2010-08-10 SEC-T 4

5. Typical environment Banking/finance Other large data centers Impact Full exposure of interconnected networks and VLAN’s Possibility to eavesdrop and trafficmodification Switch based rootkit installation? Cisco 7000-series 2010-08-10 SEC-T 5

6. Overview 2010-08-10 SEC-T 6 Linux

7. Teh Linux 2010-08-10 SEC-T 7 root?!?

8. DC3 Shell ‘the regular Cisco cli’ Configurations contain ‘hidden’ commands Hidden commands 2010-08-10 SEC-T 8

9. Escaping CLi 2010-08-10 SEC-T 9

10. How could that happened?! 2010-08-10 SEC-T 10 What could possibly go wrong here? /usr/bin/gdbserver

12. So, where ‘ftpuser’ come from? Default user? Backdoor? Easter egg? Recovered password ‘nbv123’ Undocumented user account 2010-08-10 SEC-T 13

13. Searching for ‘nbv123’ 2010-08-10 SEC-T 14

14. CSCti03724 – CLI escape in NX-OS using GDB Workaround: None Fixed in NX-OS 4.1(4) CSCti04026 – Undocumented user available with default password on NX-OS system Workaround: None CSCtf08873 – CDP with long hostname crashes CDPD on N7k Workaround: Disable CDP CSCti85295 – NX-OS: SUDO privilege escalation Workaround: None Bug tracking 2010-08-10 SEC-T 15

15. Special thanks to Juan-Manuel Gonzales, PSIRT Incident Manager <juagonza@cisco.com> Thanks 2010-08-10 SEC-T 16

16. Questions? Contact george.hedfors@cybercomgroup.com FAQ 2010-08-10 SEC-T 17