Example 4-7. Output from cisco-torch
root@rosebud:~# cisco-torch -t -s -w 192.168.86.0/24
Using config file torch.conf...
Loading include and plugin ...
###############################################################
# Cisco Torch Mass Scanner #
# Because we need it... #
# http://www.arhont.com/cisco-torch.pl #
###############################################################
List of targets contains
256
host
(
s
)
Will fork
50
additional scanner processes
Range Scan from 192.168.86.12 to 192.168.86.17
17855: Checking 192.168.86.12 ...
HUH db not found, it should be in fingerprint.db
Skipping
Telnet fingerprint
Range Scan from 192.168.86.6 to 192.168.86.11
17854: Checking 192.168.86.6 ...
HUH db not found, it should be in fingerprint.db
Skipping Telnet fingerprint
Range Scan from 192.168.86.18 to 192.168.86.23
17856: Checking 192.168.86.18 ...
Partially because of Cisco’s market share and the amount of time its devices have been
used on the internet, Cisco devices have known vulnerabilities. Identifying devices
isn’t the same as identifying vulnerabilities. As a result, we need to know what vulner‐
abilities may be on the devices we find. Fortunately, in addition to using OpenVAS for
vulnerability
scanning, a Perl script comes with Kali to look for Cisco vulnerabilities.
This script,
cge.pl
, knows about specific vulnerabilities related to Cisco devices.
Example 4-8
shows the list of vulnerabilities that can be tested with
cge.pl
as well as
how to run the script, which takes a target and a vulnerability number.
Example 4-8. Running cge.pl for Cisco vulnerability scanning
root@rosebud:~# cge.pl
Usage :
perl cge.pl
Vulnerabilities list :
[
1
]
- Cisco 677/678 Telnet Buffer Overflow Vulnerability
[
2
]
- Cisco IOS Router Denial of Service Vulnerability
[
3
]
- Cisco IOS HTTP Auth Vulnerability
[
4
]
- Cisco IOS HTTP Configuration Arbitrary Administrative Access Vulnerability
[
5
]
- Cisco Catalyst SSH Protocol Mismatch Denial of Service Vulnerability
[
6
]
- Cisco
675
Web Administration Denial of Service Vulnerability
[
7
]
- Cisco Catalyst
3500
XL Remote Arbitrary Command Vulnerability
[
8
]
- Cisco IOS Software HTTP Request Denial of Service Vulnerability
