借助TCLtools,你可以将任何Cisco IOS硬件转变为跳板站。设置和使用都非常简单!
TCLproxy 是一款用于通过Cisco设备进行跳板渗透的工具。它能够转发任意TCP端口或启动代理服务器。
TCLproxy v0.0.3
Usage: tclsh ./tclproxy.tcl [-L address]... [-D address]...
Proxy server implementation. Binary protocols are supported.
-L [bind_address:]port:remote_host:remote_port
Forward a remote port to a local port.
Multiple connections and multiple forwards are supported.
-D [bind_address:]port
Launch a SOCKS4a proxy server.
Forwarding between VRF tables:
-D [VRF_table_for_listening@][bind_address]:port[@VRF_table_for_outbound_connections]
-L [VRF_table_for_listening@][bind_address]:port[@VRF_table_for_outbound_connections]:remote_host:remote_port
optional arguments:
-f, --disable-eof-check Speed increases by 1-15 KB/s, but connections don't close automatically. Dangerous!
-h, --help Show this help message and exit.
-q, --disable-output Quite mode. In this mode, you can disconnect from the console without script termination. Dangerous!
-l, --low-ports Use privileged source ports. Required for NFS (source port increments from 1 to 1023 every connection)
-n, --disable-dns Do not resolve DNS names in SOCKS mode
The effect of --disable-eof-check and --disable-output options depends on hardware architecture and firmware version.
TCLproxy will not work for port scanning, use tclmap.tcl instead.
example:
$ sudo py3tftp -p 69
cisco# configure terminal
cisco(config)# scripting tcl low-memory 5242880
cisco(config)# end
cisco# copy tftp://192.168.1.10/tclproxy.tcl flash:/
cisco# tclsh tclproxy.tcl -h
cisco# tclsh tclproxy.tcl -L 5901:10.0.0.1:445 -D :5902@enterpriseVRF -D 5900
...
cisco# del flash:/tclproxy.tcl
TCL是一种高级、通用、解释型动态编程语言。Cisco IOS实现了TCL 8.3.4:
cisco# tclsh
cisco(tcl)# puts $tcl_version
8.3
cisco(tcl)# puts $tcl_patchLevel
8.3.4
TCLtools需要在硬件上拥有特权级别15。
上传TCL脚本有四种方法:
$ sudo py3tftp -p 69
or
$ python2 -m pyftpdlib
cisco# copy tftp://192.168.1.10/tclproxy.tcl flash:/
cisco# copy ftp://192.168.1.10:2121/tclproxy.tcl flash:/
cisco# tclsh tclproxy.tcl
or
cisco# tclsh ftp://192.168.1.10:2121/tclproxy.tcl
$ cat tclproxy.tcl | sed -E 's/([{}$\[])/\\\1/g'
cisco# tclsh
cisco(tcl)# puts [open "flash:tclproxy.tcl" w+] {
cisco(tcl)# ; Copy file contents onto this
cisco(tcl)# }
cisco(tcl)# exit
cisco#
cisco# tclsh tclproxy.tcl
cisco# tclsh
cisco(tcl)# set argv [list -D 1080]
cisco(tcl)# ; Copy file contents onto this
cisco# configure terminal
cisco(config)# scripting tcl init ftp://192.168.1.10/tclproxy.tcl
cisco(config)# end
cisco# tclsh
一个好的做法是设置最小空闲内存大小:
cisco# configure terminal
cisco(config)# scripting tcl low-memory 5242880
cisco(config)# end
除了上面这些,或者作为替代,你可以通过以下命令查看设备性能:
cisco# show processes cpu | i Tcl
cisco# show processes mem | i Tcl
已在Cisco 2811 / Cisco 2821集成服务路由器、Cisco Catalyst 2960和Cisco Catalyst 3750-X上测试通过。
你可以打开一个新的Issue来报告Bug或建议新功能以改进项目。或者你也可以发送邮件至[email protected]。