Cisco iOS process debugging

Create time: 2003-07-31 Article property: Reprinted article Submit:

Freedemon

(Freedemon_at_citiz.net) Ciscox notes (Anthony C. Zboralski Gaius) Research is being done on a useless Cisco 1600 with 4 megs of flashrunning IOS 11.1.Recently after writting my first cisco warez (tunnelx), I told myself heywe need to find a way to inject arbitrary code, poke and peek at the memoryon a cisco, hide interfaces, route-maps, access-lists.Let's look around: scep # show procCPU utilization for five seconds: 10% / 4%; one minute: 14% ; five minutes: 14% PID qTy PC Runtime (ms) Invoked uSecs Stacks TTY Process 1 M * 0 1248 107 11663 2204/4000 1 Virtual Exec 2 Lst 802DF16 34668 313 110760 1760/2000 0 Check heaps 3 Cwe 801D5DE 0 1 0 1736 / 2000 0 Pool Manager 4 MST 8058B20 0 2 0 1708/2000 0 Timers 5 LWE 80BFD4A 24 46 521 1448/2000 0 ARP INPUT 6 MWE 81F78F0 4 1 4000 1744/2000 0 serial A '

Detect 7 LWE 80D935A 4 1 4000 1656/2000 0 ProBe Input 8 MWE 80D8CD6 0 1 0 1744/2000 0 RARP Input 9 HWE 80ca966 80 89 898 3116/4000 0 IP Input 10 MWE 80F41BA 16 322 49 1348/2000 0 TCP Timer 11 Lwe 80F5EB8 8 3 2666 3244/4000 0 TCP Protocols 12 Mwe 813785E 80 177 451 1588/2000 0 CDP Protocol 13 Mwe 80D5770 0 1 0 1620/2000 0 BOOTP Server 14 Mwe 81112C0 1356 1522 890 1592/2000 0 IP Background 15 Lsi 8121298 0 25 0 1792/2000 0 IP Cache Ager 16 CWE 80237BE 0 1 0 1748/2000 0 critical bkgnd 17 MWE 802365A 12 5 2400 1476/2000 0 Net Background 18 LWE 804E82E 16 4 4000 1192/2000 0 logger 19 MSP 80456DE 80 1493 53 1728/2000 0 TTY Background 20 MSP 802345C 20 1494 13 1800/2000 0 per-Second Jobs 21 MSP 80233F2 68 1494 45 1488/2000 0 Net Periodic 22 HWE 80234DC 4 1 4000 1724/2000 0 Net Input 23 MSP 8023482 772 25 30880 1800/2000 0 per-minute Jobs 24 LWE 8109834 4 2 2000 3620/4000 0 IP SNMP 25 MWE 815CE08 0 1 0 1712/2000 0 SNMP Traps 26 ME 811805A 0 26 0 1892/2000 0 IP-RT Background 27 ME 803B0F8 32 11 2909 2760/4000 2 Virtual EXEC now You Can Even dump the memory with 'show memory'

. Good but there isn'ta write memory command, too bad. Maybe not ... I started looking for undocumented and hidden commands and found quite a bunchof them.Among all the stupid hidden command, the best candidate for taking full controlof the cisco is' ​​gdb'.The IOS gdb command offers three subcommands: gdb debug PID examine PID kernelthe kernel subcommand works only on the console.However 'examine' and 'debug' works perfectly; the debug subcommand is a bittricky to use though.scep # GDB Debug 27 ||| OOps .. ok grab a copy of gdb-4.18 and try to compile a version for yourCISCO.MKDIR M68K-Cisco ../ Configure - Target M68k-Ciscomakeif You Have a Mips Based Cisco, Just S / m68k / mips64 / the above 4 lines.now type make install and you should have a m68-cisco-gdb binary in your path.fire # m68k-cisco-gdbGNU gdb 4.18Copyright 1998 Free Software Foundation, Inc.GDB is free software , Covered by the gnu general public license, and you arewelcome to change it and / or distribute copies of it Under Certain Co NDitions.Type "show copying" to see the conditions.there is absolutely no warranty for gdb. Type "show warranty" for details.this gdb WAS configured as "--host = i686-pc-linux-gnu --target = m68k -CISCO "(CISCO-68K-GDB) My Cisco 1600 IS Connected to / dev / TTYS0, SCEP>

EN Password: SCEP # gdb debug 18 Scep # as you can see it book. While Examine Works it sees.scep # gdb Examine 18 ||| Now the console seem lockd.go Back to Our GDB-4.18 source tree and check out gdb / remote.c whichcontains a nice documentation of the gdb remote communication protocol.added. IOS gdbserver implementationDon't get too excited, IOS gdbserver supports only a limited subset of thosecommands. I'll grab a binary of IOS 12 and check if new commands were added.i Didn't Have to test every command by hand .. let '

s just say I have reliable sources and I know that in IOS 11.2-8 (hum hum), the followingcommands are supported: Request Packet read registers g write regs GXX..XX Each byte of register data is described by two hex digits Registers. Are In The Internal ORDER for GDB, AND The bytes in a Register Are In The Same Order The Machine Uses. Read Mem MAA..AA, LLLL AAY IS Address, LLLL IS Length. Write Mem MAA..AA, LLLL : XX..xx aa..a is address, llll is number of bytes, xx..x is data continue cara. AA..AA is Address To Resume IF AA..AA IS OMITTED RESUME AT SAME Address. Step SAA ..Aa aa..a is address to resume if aa..aa is omitted, resume at Same Address. Kill Request K Last Signal? R . Eply the current reason for stopping This is the same reply as is generated for step or cont:. SAA where AA is the signal number toggle debug d toggle debug flag (see 386 & 68k stubs) All other commands will be ignored ... too bad 'search' is not implemented.The protocol is simple, quoting remote.c comments:. A debug packet whose contents are is encapsulated for transmissionin the form $ # CSUM1 CSUM2 must be ASCII AlphaC and Cannot Include Characters '$' or '#'. If starts with two characters Followed by ':'

, Then the existing stubs interpret this as a sequence number.CSUM1 and CSUM2 are ascii hex representation of an 8-bit checksum of , the most significant nibble is sent first.the hex digits 0-9, af are used.Before trying to make gdb work i wrote a little program that computed the rightchecksum: #include unsigned char const hexchars [] = "0123456789abcdef"; char tohexchar (unsigned char c) {c & = 0x0f; return (hexchars [ C]);} int main (int Argc, char ** argv) {unsigned char checksum; int count; char * command; char ch; if (argc <= 1) exit (1); Printf ("GDB protocol command: "); Command = argv [1]; putchar ('$'); checksum = count = 0; while (ch = command [count])) {PUTCHAR (CH); Checksum = CH; count ;} Putchar ( '#'); Putchar (shouldhexchar (Checksum >> 4); Putchar (tohexchar (checksum)); Putchar ('/ n');} ./ GDBPROTO GGDB Protocol Command: $ g # 67now paste That on the || || Prompt and you get register output: SCEP # GDB EXA 18 |||| $ 0 * 1b20 * 3320c0490 * 1920c02440 * 1080726ce0 * e7 # 14let's read 4 bytes of mem at 0x804e82e./gdbproto m804e82e, 4gdb protocol command: $ m804e82e, 4 # 9dTrying to read big chunk of mem really tilts and gdb defaults to 4 bytes ata time. you can still dump memory with show memory, which is more efficient.and for patching a bit, efficiency is not an issue. one nop here, one jump here. If you're using minicom, make use Ctrl-a w to enableline wrap.scep # GDB EXA 18 ||||

$ 001461ff # f8woo it Works! Let's try to read in the Exec Range: $ mff, 4 # 99 $ 04040004 # 8ccisco people: $ m0, 5 # Fe $ badd0104 # 15ster is not a bad address, IT is 0xba 0xda 0xdd.type $ c # 63 to continue and go back to a sane world.I have was having trouble with gdb .. If you have trouble with the serial connection, you can use thecommand `set remotedebug '. This makes GDB report on all packets sentback and forth across the serial line to the remote machine. Thepacket-debugging information is printed on the GDB standard outputstream. `set remotedebug off 'turns it off, and` show remotedebug'

shows you its current state.Says the info documentation for gdb and gives extra hints on the remote gdbprotocol.Now it works over the serial, DO NOT use the option -b or set baud in gdb, this is really error prone. Just do the following: (cisco-68k-gdb) target remote / dev / ttyS0Remote debugging using / dev / ttyS0warning: Remote reply is of odd length: 0200471c00e4f640ffffffffffffffffffff70000000000000000000006100000000000000000000d200204262008071aaa020bb6bc020bb9d4020c52c5020d21cb020d2120020d211c0000a00808071aae000000000000000000000000000000000000000000000000000000000000000000000000070x120020d2 in ?? () (cisco-68k-gdb) scep # show regionRegion Manager: Start End Size (b) Class Media Name0x02000000 0x0217FFFF 1572864 Local R / W main0x02005000 0x02019A43 84548 IData R / W main: data0x02019A44 0x0203D67B 146488 IBss R / W main: bss0x0203D67C 0x0217FFFF 1321348 Local R / W main: heap0x02180000 0x021FFFFF 524288 iomem R / W iomem0x0801A1 E4 0x082D8813 2876976 IText R / W textscep # show region address 0x804E82EAddress 0x0804E82E is located physically in: Name: text Class: IText Media: R / W Start: 0x0801A1E4 End: 0x082D8813 Size: 0x002BE630 (cisco-68k-gdb) set * 0x2180000 = 0Sending Packet: $ m2180000, 4 # 28 ... ACKPACKET receifpaper: AB1234CDBinary Download Not Supported by TargetSending Packet: $ M2180000, 4: 00000000 # C2 ... ACKPACKET Received:

OKshow subsys classshow subsys nameshow memory freeshow memory processesshow memory failures alloc No IOS platform built on the M68k family uses versions of the CPU that have full MMU support. Hence there is no hardware support for write protecting the text segment of the IOS image. The system does checksum the text segment (every 30 seconds) and will crash if the checksum is incorrect. However, finding the offending code is hard.mips At init time, the IOS programs the MMU of these processors to provide write protection of the text segment. If any code tries to write into the code space, the system will crash with a segmentation violation. However the protection is not completely foolproof, although very good. The physical memory in which the code sits is mapped into other segments of the address space and IS WRITABLE THOSE Segments.206EA78 5124 206D118 206FEA4 1 80353F6 * Hardware IDB * 206FEA4 2200 206EA78 2070764 1 803540C * Software IDB * Show Chunk25 Chunks Created, 3 Chunks Destroyed12 Siblings Created,

2 Siblings Trimmed Chunk Flags Size (b) Free Max Saved (b) Name 203D6A0 D 16 0 50 1704 List Elements 204379C DS 16 0 50 1704 (SIBLING) 2043BE4 DS 16 20 50 584 (SIBLING) Total 20 150 3992 203DAE8 D 48 50 50 - 2696 List headers 204114C D 16 50 50 - 1096 Messages 204B714 D 12 0 100 3504 Reg Function 207B278 DS 12 0 100304 (SIBLING) 207E99C DS 12 0 100 3504 (SIBLING) 209FB9C DS 12 0 100 3504 (SIBLING) 20A314C DS 12 0 1004D5C DS 12 0 100 3504 (SIBLING) 20B5ED4 DS 12 0 100 3504 (SIBLING) 20B879C DS 12 0 100 3504 (SIBLING) 20B9064 DS 12 29 100 1996 (SIBLING) 206194C 32 200 200 - 7296 IDB SB Chunks 20635CC 68 200 200 - 14496 IDB List Header Chunks 2066E6C 24 898 900 - 25168 IDB List Element Chunks 206D13C 28 200 200 - 6496 IDB Notification Chunks 20A2178 D 24 49 50 - 1432 IP Addresses 20A5EE4 D 48 99 100 - 5208 IP RDB Chunk 20C24F8 D 3980 3 4 - 12012 parseinfo Blocks 20C6398 D 836 21 21 - 17736 Parse Nodes * syntax: capture dump interface * * descr: This command dumps the captured Packets INTO The Specified * TFTP Server. Eolns (Capture_Dump_