Reading (For Dummies)

Cisco switch secret features

The cat's out of the bag, so to speak.

A while ago, I bought a Cisco/Linksys SRW2016 switch. It's a nice gigabit, managed, 16-port switch. I bought it for doing some silly things in the house like vlan tagging, and dealing with large amounts of traffic.

The switch can be managed via a serial port on the front, or by telnet or ssh. The switch runs vxWorks under the hood, has an ARM 946ET processor if I recall correctly. So it's fairly capable, and it could definitely run ucLinux if someone were so inspired to port the kernel to it (the processor inside the switch lacks an MMU, so running a 'normal' ARM variant of linux would not work).

When you SSH to the device, you can hit Ctrl+Z. This suspends the normal menu-driven system and gives a shell prompt. From there, you can execute a few commands. 'lcli' gives an IOS-like command-line. 'mcli' gives a SNMP trap and mib editor (which is password protected, the passwords aren't published). 'debug' gives a very weird debugger, which allows you poke at i2c (it's definitely not your father's process debugger, I don't really get it). 'debug' is also password-protected.

I managed to extract the passwords from my device. I did it by un-ROS'ing a firmware update I downloaded from Cisco. I stared at the binaries extracted from this and figured out that they were lempel-ziv compressed, so I decompressed them. I was then able to find the accounts for the switch stored in one of the binary files (no disassembly needed, I just searched for strings, so hopefully I am clear of any wrongdoing with respect to the EULA that came with the firmware).

I was a little shocked about a few things: the passwords are stored in plaintext on the switch. In fact, all of the switch passwords, including normal user accounts, have their passwords stored in plaintext it seems. Bad, Cisco. Very bad, especially when the switch is already running openSSL. How hard would it be to store hashes of passwords? Second, I'm surprised that these features were left in at all. It doesn't seem like they were intended. They look like developer cruft. Tracking the communication that occurs between chips on the switch is probably not something the average admin cares to do.

I posted the passwords for these special functions on the LCLI wiki. Note that you need an account to log in to the switch with, so these aren't security bypasses. They would probably allow the ambitious to do a thorough RE job on the switch, though, without having to invest in hardware like a Bus Pirate.