Skip to content
KitploitKITPLOIT
工具博客
提交
工具博客
提交

黑客、渗透测试和网络安全工具，武装您的安全武器库！

Kitploit 是一个黑客、网络安全和渗透测试工具的目录。发现最新的项目更新，查找漏洞、分析系统、自动化测试并加强你的安全。

··订阅源·联系·隐私·© 2026 Kitploit

工具目录

分类

查看所有分类
Loading categories
yersinia — 第二层网络攻击框架，用于利用STP和CDP协议，对Cisco交换机实施拒绝服务、根角色劫持及内存耗尽攻击。 | Kitploit
工具/GitHubGitHub/tomac/yersinia
IDS/IPS规避网络安全渗透测试红队
GitHubtomac/yersinia

yersinia

第二层网络攻击框架，用于利用STP和CDP协议，对Cisco交换机实施拒绝服务、根角色劫持及内存耗尽攻击。

查看仓库
86113923年前Kitploit 审核通过

最受欢迎

查看全部 →

发现我们社区最常用的工具。

探索所有工具

浏览我们的工具集合

查看所有工具 →
分享

Build Status

生成树

1: 发送配置BPDU的DoS攻击

root@kitploit:~
让我们发送一些配置BPDU，声称自己是根！！！通过持续发送根路径开销为0、桥ID随机生成（因此根ID相同）以及其余字段使用默认值的配置BPDU，我们试图干扰附近的交换机，导致其STP引擎在解析和重新计算时发生DoS。

源MAC：随机生成。
目的MAC：01:80:c2:00:00:00
桥ID：8000:source_mac
根ID：8000:source_mac
Hello时间：2
转发延迟：15
最大老化时间：20
根路径开销：0

<output from the cisco log>
01:20:26: STP: VLAN0001 heard root 32768-d1bf.6d60.097b on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-9ac6.0f72.7118 on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-85a3.3662.43dc on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-3d84.bc1c.918e on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-b2e2.1a12.dbb4 on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-4ba6.2d45.5844 on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-deb0.4f14.7288 on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-4879.8036.0e24 on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-2776.e340.9222 on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-299e.de76.c07d on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-d38b.bc5b.e90d on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-78ee.0205.afdb on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-b32b.e969.81b1 on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-b16b.c428.88a3 on Fa0/8
01:20:26: STP: VLAN0001 heard root 32768-dd01.1436.9044 on Fa0/8
</output>

2: 发送TCN BPDU的DoS攻击

root@kitploit:~
此攻击持续发送TCN BPDU，迫使根交换机发送配置BPDU确认拓扑变化。此外，根交换机还会向树中成员发送拓扑变更通知，这些成员必须重新计算其STP引擎以学习新的变更。

源MAC：随机生成。
目的MAC：01:80:c2:00:00:00

<output from the cisco log>
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
01:35:39: STP: VLAN0001 Topology Change rcvd on Fa0/8
</output>

3: 非DoS攻击：声称根角色

root@kitploit:~
现在我们的目标是获取树的根角色。如何做到呢？只需监听网络找出哪个是根角色，然后开始发送优先级更低的配置BPDU，从而成为根。

源MAC：与被嗅探到的BPDU相同。
目的MAC：与被嗅探到的BPDU相同。
桥ID：嗅探到的桥ID稍作修改，使其优先级更低。
根ID：8000: 与桥ID相同。
Hello时间：与被嗅探到的BPDU相同。
转发延迟：与被嗅探到的BPDU相同。
最大老化时间：与被嗅探到的BPDU相同。
根路径开销：与被嗅探到的BPDU相同。

<output from the cisco log>
01:58:48: STP: VLAN0001 heard root 32769-000e.84d4.2280 on Fa0/8
01:58:48:     supersedes 32769-000e.84d5.2280
01:58:48: STP: VLAN0001 new root is 32769, 000e.84d4.2280 on port Fa0/8, cost 19
</output>

4 非DoS攻击：声称非根角色

我们假装是另一台奇怪的交换机，玩弄STP并吹嘘我们的根ID :)

5 导致永恒根选举的DoS攻击

root@kitploit:~
通过发送优先级自动递减的配置BPDU，我们可以在STP树中引起无限次的根选举。这类似于重新计票以确定胜者的选举（还记得佛罗里达吗？）

<output from the cisco log>
00:20:21: STP: VLAN0001 heard root 32769-000e.84d4.2280 on Fa0/9
00:20:21:     supersedes 32769-000e.84d5.2280
00:20:21: STP: VLAN0001 new root is 32769, 000e.84d4.2280 on port Fa0/9, cost 19
00:20:23: STP: VLAN0001 heard root 32769-000e.84d3.2280 on Fa0/9
00:20:23:     supersedes 32769-000e.84d4.2280
00:20:23: STP: VLAN0001 new root is 32769, 000e.84d3.2280 on port Fa0/9, cost 19
00:20:25: STP: VLAN0001 heard root 32769-000e.84d2.2280 on Fa0/9
00:20:25:     supersedes 32769-000e.84d3.2280
00:20:25: STP: VLAN0001 new root is 32769, 000e.84d2.2280 on port Fa0/9, cost 19
00:20:27: STP: VLAN0001 heard root 32769-000e.84d1.2280 on Fa0/9
00:20:27:     supersedes 32769-000e.84d2.2280
00:20:27: STP: VLAN0001 new root is 32769, 000e.84d1.2280 on port Fa0/9, cost 19
00:20:29: STP: VLAN0001 heard root 32769-000e.84d0.2280 on Fa0/9
00:20:29:     supersedes 32769-000e.84d1.2280
00:20:29: STP: VLAN0001 new root is 32769, 000e.84d0.2280 on port Fa0/9, cost 19
00:20:31: STP: VLAN0001 heard root 32769-000e.84cf.2280 on Fa0/9
00:20:31:     supersedes 32769-000e.84d0.2280
00:20:31: STP: VLAN0001 new root is 32769, 000e.84cf.2280 on port Fa0/9, cost 19
00:20:33: STP: VLAN0001 heard root 32769-000e.84ce.2280 on Fa0/9
00:20:33:     supersedes 32769-000e.84cf.2280
00:20:33: STP: VLAN0001 new root is 32769, 000e.84ce.2280 on port Fa0/9, cost 19
00:20:35: STP: VLAN0001 heard root 32769-000e.84cd.2280 on Fa0/9
00:20:35:     supersedes 32769-000e.84ce.2280
00:20:35: STP: VLAN0001 new root is 32769, 000e.84cd.2280 on port Fa0/9, cost 19
00:20:37: STP: VLAN0001 heard root 32769-000e.84cc.2280 on Fa0/9
00:20:37:     supersedes 32769-000e.84cd.2280
00:20:37: STP: VLAN0001 new root is 32769, 000e.84cc.2280 on port Fa0/9, cost 19
00:20:39: STP: VLAN0001 heard root 32769-000e.84cb.2280 on Fa0/9
00:20:39:     supersedes 32769-000e.84cc.2280
00:20:39: STP: VLAN0001 new root is 32769, 000e.84cb.2280 on port Fa0/9, cost 19
</output>

6 导致根消失的DoS攻击

root@kitploit:~
这次我们试图耗尽根选举过程。我们先成为STP树中的根，然后停止发送配置BPDU，直到达到max_age秒（通常为20），从而强制进行新的选举过程。

<output from the cisco log>
02:02:43: STP: VLAN0001 heard root 32769-000e.84d4.2280 on Fa0/9
02:02:43:     supersedes 32769-000e.84d5.2280
02:02:43: STP: VLAN0001 new root is 32769, 000e.84d4.2280 on port Fa0/9, cost 19
02:03:03: STP: VLAN0001 we are the spanning tree root
02:03:04: STP: VLAN0001 heard root 32769-000e.84d4.2280 on Fa0/9
02:03:04:     supersedes 32769-000e.84d5.2280
02:03:04: STP: VLAN0001 new root is 32769, 000e.84d4.2280 on port Fa0/9, cost 19
02:03:04: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:06: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:08: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:10: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:12: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:14: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:16: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:18: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:20: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:22: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:24: STP: VLAN0001 we are the spanning tree root
02:03:24: STP: VLAN0001 heard root 32769-000e.84d4.2280 on Fa0/9
02:03:24:     supersedes 32769-000e.84d5.2280
02:03:24: STP: VLAN0001 new root is 32769, 000e.84d4.2280 on port Fa0/9, cost 19
02:03:24: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:26: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:28: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:30: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:32: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:34: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:36: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:38: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:40: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:42: STP: VLAN0001 sent Topology Change Notice on Fa0/9
02:03:44: STP: VLAN0001 we are the spanning tree root
</output>

减缓措施（仅限Cisco）

  • 使用端口安全，并在不需要STP的端口上禁用STP。 有关端口安全的信息，请访问以下URL： http://www.cisco.com/en/US/products/hw/switches/ps628/products_configuration_guide_chapter09186a0080150bcd.html

  • 如果在STP配置中使用了PortFast功能，请同时启用BPDU Guard，以避免端口自动进入转发状态时遭受这些攻击： http://www.cisco.com/warp/public/473/65.html

  • 使用Root Guard功能，防止恶意设备成为根： http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00800ae96b.shtml

延伸阅读

  • Guillermo Marro的优秀硕士论文： http://seclab.cs.ucdavis.edu/papers/Marro_masters_thesis.pdf

  • Oleg K. Artemjev, Vladislav V. Myasnyankin。Fun with the Spanning Tree Protocol http://phrack.org/issues/61/12.html

CDP

Cisco设备一直使用不同的语言相互通信，以告知彼此它们还活着以及它们拥有哪些便捷功能。CDP代表Cisco发现协议。通过这种特殊的语言，Cisco设备建立了一个虚拟世界，在那里每个人都很开心，完全没有犯罪。或者至少看起来如此，因为许多网络管理员还没有对CDP感到担忧。尽管CDP数据包中可以发送的某些信息仍未公开（CDP是一种专有协议，似乎Cisco不愿意透露细节），但已知至少有一种旧的攻击（至今仍然有效），并且有公开的实现（由FX完成！）。

这种攻击是一种DoS，试图耗尽设备内存，使其无法为任何设备进程分配更多内存。我们如何做到呢？只需发送带有虚假数据的CDP数据包，模拟真实的Cisco设备。目标设备将开始在其CDP表中分配内存以保存新邻居的信息，却不知道它将拥有成千上万甚至数百万个新朋友。

当前代码中实现的另一种攻击是能够设置一个新的虚拟Cisco设备，其唯一目的就是制造一点混乱，试图迷惑网络管理员。

攻击运行时的截图：

一个Cisco 2503路由器的输出：

root@kitploit:~
athens#sh mem
               Head   Total(b)    Used(b)    Free(b)  Lowest(b)  Largest(b)
Processor     4873C    3893444    3893444          0          0          0
I/O          400000    2097152    2097088         64         64         64

<log>
%SCHED-3-THRASHING: Process thrashing on watched queue 'CDP packets' (count 57).
-Process= "CDP Protocol", ipl= 6, pid= 9
-Traceback= 3159232 31594DE 3201660
%LANCE-5-COLL: Unit 0, excessive collisions. TDR=7
%SCHED-3-THRASHING: Process thrashing on watched queue 'CDP packets' (count 57).
-Process= "CDP Protocol", ipl= 6, pid= 9
-Traceback= 3159232 31594DE 3201660
%SYS-2-MALLOCFAIL: Memory allocation of 100 bytes failed from 0x3201B3E, pool Processor, alignment 0
-Process= "CDP Protocol", ipl= 0, pid= 9
-Traceback= 314E8A4 314FA06 3201B46 32016C8
%SCHED-3-THRASHING: Process thrashing on watched queue 'CDP packets' (count 57).
-Process= "CDP Protocol", ipl= 6, pid= 9
-Traceback= 3159232 31594DE 3201660
%SYS-2-MALLOCFAIL: Memory allocation of 100 bytes failed from 0x3201B3E, pool Processor, alignment 0
-Process= "CDP Protocol", ipl= 0, pid= 9
-Traceback= 314E8A4 314FA06 3201B46 32016C8
%SYS-2-MALLOCFAIL: Memory allocation of 100 bytes failed from 0x3201B3E, pool Processor, alignment 0
-Process= "CDP Protocol", ipl= 0, pid= 9
-Traceback= 314E8A4 314FA06 3201B46 32016C8
</log>

几分钟后停止攻击，路由器意外地挂起了好几秒，然后把你踢出终端 :)

root@kitploit:~
<log>
%SYS-3-CPUHOG: Task ran for 16884 msec (69/69), Process = Exec, PC = 3158D42
-Traceback= 3158CEE 3158D4A 30F7330 30F742A 30FF3A4 30FEF76 30FEF1C 3116860
</log>

一个Cisco 2950交换机的输出：

root@kitploit:~
00:06:08: %SYS-2-MALLOCFAIL: Memory allocation of 224 bytes failed from 0x800118D0, alignment 0
Pool: Processor  Free: 0  Cause: Not enough free memory
Alternate Pool: I/O  Free: 32  Cause: Not enough free memory

-Process= "CDP Protocol", ipl= 0, pid= 26
-Traceback= 801DFC30 801E1DD8 800118D8 80011218 801D932C 801D9318
00:06:08:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:09:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:10:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:11:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:12:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:13:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:14:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:15:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:16:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:17:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:18:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:19:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:20:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:21:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:22:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:23:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:38: %SYS-2-MALLOCFAIL: Memory allocation of 140 bytes failed from 0x801E28BC, alignment 0
Pool: Processor  Free: 0  Cause: Not enough free memory
Alternate Pool: I/O  Free: 32  Cause: Not enough free memory

-Process= "Calhoun Statistics Process", ipl= 0, pid= 21
-Traceback= 801DFC30 801E1DD8 801E28C4 801F13BC 801F1470 802F7C90 802F9190 802F9788 801D932C 801D9318
00:06:38:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:39:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:40:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:41:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:42:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:44:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:45:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:46:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:47:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:48:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:49:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:50:  ../src-calhoun/strata_stats.c at line 137: can't not push event list
00:06:59: %SYS-3-CPUHOG: Task ran for 2076 msec (11/10), process = Net Background, PC = 801ABD40.
-Traceback= 801ABD48 801D932C 801D9318

然后，即使我们停止攻击，CDP进程也完全崩溃了。再也没有CDP宝宝了...

下载工具