# Default route is being dropped, Well, Finally it is a Cisco Bug

Default route is being dropped,

Troubleshooting around 3 weeks,

Well, Finally it was a Cisco Bug

- CSCsq83540

- Happens on cisco 12000 series
- with SIP Card
- on certain VRF
- default route coming from remote site
- all traffics from CE to default route is dropped (pointing to null interface, what the hell is that)

workarounds
- reboot the card (if there is many customer on it, that will be very problem)
- can try adding new vrf (cannot do that, coz vrf id is fixed here)

Yet Another Cisco Type 7 Password Decryptor

Type 7 Password Decryptor in Bash, and in C

http://www.securiteam.com/tools/6V0011PEBY.html

in Javascript, C , Perl

http://www.busindre.com/exploits-para-encriptacion-tipo-7-de-cisco-escritos-en-c-perl-y-javascript/

Google results for online password decryptors

online decryptors

Almost all of online password decryptor has password length limitations (means fails on long password)

decrypt password using a cisco router (this is perfect, if you have router or emulator)

http://yebo-blog.blogspot.com/2007/12/cisco-iostype-7.html

And Finally, Here is my Cisco Type 7 Password Decryptor with Python (unlimited password length), and Its only One Line :-)

http://www.darkc0de.com/others/cisco_decrypt.py

you can decrypt such long password

print decrypt("12181613140A1F002C2A372C353431170117100550584B57520F10"
"1C10584B53555346500D5A15035E5617170005480F000E324848080A0111131808022B38202E3226"
"261506050707574A5C55551D071E174A5C51524151520A4802015944001507175F0D071C254A4F1A"
"1D0316010F0A05392F22292031241214120500455D5E52470A0519055D5E5640565355185F00064B"
"53021215005D0A150B274D5D0D1F0404160D0D172E2D253B3733230003100212525F59405008020B"
"125F5944575454470F5D07145C51050002025A180209205F4A0F181613140A1F002C2A372C3534311701")

Thanks d3hydr8 for publishing this in my favorite site darkc0de.com, yay!

and thanks for packet storm too

http://packetstorm.linuxsecurity.com/filedesc/cisco_decrypt.py.txt.html
http://packetstorm.linuxsecurity.com/Crackers/cisco_decrypt.py.txt

aTxIvG4001

BGP-EIGRP Redistribution Stuck!

BGP-EIGRP Redistribution Stuck and made me half day to troubleshoot that, Garr!

We use MPLS with BGP on backbone and customer use EIGRP, and redistribution done on both ways on edges routers.

In BGP Routing Table, Routes are there, but its not get redistributed into EIGRP.

and clearing the eigrp session does not work! Garr!

clear ip eigrp vrf <vrfno> neighbor <neighbor_ip> 

All the Configurations are OK.

Finally I have to remove / reconfigure same configurations on all the address-families for redistributions on that customer.

router eigrp <as_num>
 address-family ipv4 vrf <addr_family_name>
  redistribute bgp <as_num> metric <some_values>
  network <ipaddress> <wildcard>
  no auto-summary
  autonomous-system <as_num>
  exit-address-family

router bgp <as_num>
 address-family ipv4 vrf <addr_family_name>
  redistribute eigrp <as_num>
  no auto-summary
  no synchronization
  exit-address-family

And Following commands are helpful during this troubleshooting

sh ip eigrp vrf <vrfno> accounting
sh ip eigrp vrf <vrfno> topology | include <certain_route>
sh ip bgp vpnv4 vrf <vrfno> | include <certain_route>

Hum! I've learned something but BGP only is better :P

Cheers,
Soe Min

#Memo : Telneting into Router with Python (using telnetlib)

% python
>>> 
>>> # importing telnetlib
>>> import telnetlib
>>> 
>>> # telnet into 192.168.1.1
>>> t=telnetlib.Telnet("192.168.1.1")
>>> 
>>> # wait until Username is appear
>>> t.read_until("Username: ")
>>> 
>>> # send the username
>>> t.write("<username>\n")
>>> 
>>> # wait until Password is appear
>>> t.read_until("Password: ")
>>> 
>>> # send the password
>>> t.write("<password>\n")
>>>
>>> # wait until > is appear
>>> t.read_until(">")
>>>
>>> # send the enable password
>>> t.write("<enable>\n")
>>>
>>> # wait till # is appear
>>> t.read_until("#")
>>> 
>>> # Now you are in Global Configuration Mode
>>> 

Cheers,
Soe Min

Point-to-Point Multilink Interface Configurations (Cisco)

ပံုမွန္ E1/T1 Serial Interface တစ္ခုမွာ 1984 kbps ရတာနဲ့ 1536kbps ရတာ၂မ်ိုးရွိပါတယ္။ (very generally)

Multilink နဲ့ဆိုရင္ Interface ၂ခုကို ေပါင္းလိုက္တဲ့ သေဘာမ်ိုးနဲ့ လုပ္လို့ရပါတယ္။ (၂ခုထက္ပိုလို့လဲရပါတယ္)

1984kbps x 2 = 3968kbps စသျဖင့္ေပါ့။

အဲဒီအတြက္ ေဟာဒီလို Cisco Router မွာ Configurations ေပးဖို့လိုပါမယ္။ (just general config)

Multilink virtual interface တစ္ခု create လုပ္ရပါမယ္။

interface Multilink1
 ppp multilink
 multilink-group 1

ျပီးရင္ Serial Interface မွာ multilink-group ကို အတူတူျဖစ္ေအာင္ assign လုပ္ရပါမယ္။

interace Serial0/0/0/1:0
 encapsulation ppp
 ppp multilink
 ppp chap hostname R1
 multilink-group 1
!
interace Serial0/0/0/2:0
 encapsulation ppp
 ppp multilink
 ppp chap hostname R1
 multilink-group 1

ဒါဆို Multilink function အျကမ္းဖ်င္းအလုပ္လုပ္ပါျပီ။ (ip ေတာ့ သပ္သပ္ assign လုပ္တာေတြ ရွိဦးမွာေပါ့)

Multilink interface ကို Serial Interface နဲ့ ခ်ိတ္ေနမေန သိခ်င္ရင္ေတာ့

sh ppp mu int m1

ဆိုျပီး ျကည့္ရင္

interace Serial0/0/0/1:0, no frags rcvd
interace Serial0/0/0/2:0, no frags rcvd

ဆိုျပီး ရပါမယ္။

# Multilink အျဖစ္သံုးမယ့္ interface တစ္ခုစီရဲ့ delay(latency) သိပ္ကြာလို့မရပါဘူး။ quality ကိုထိခိုက္နိုင္ပါတယ္။
# ပံုမွန္ အားျဖင့္ same carrier သံုးရင္ latency သိပ္မကြာတတ္ပါဘူး (except nodes are different and far from each others), different carrier ဆိုရင္ေတာ့ latency ကြာဖို့လမ္းပိုမ်ားပါမယ္။

cheers,
Soe Min

Serial0/0/0.1/1/1/1:0.1

sh int Serial0/0/0.1/1/1/1:0.1
Oops!, its just too long

Debug commands and PE Router

Debug commands ေတြဟာ ပံုမွန္ CER တစ္ခုအတြက္ troubleshooting လုပ္ရာမွာ အသံုးဝင္ေပမယ့္ က်ေနာ္တို့ PER ဘက္မွာ ေတာ္ရံုတန္ရံု မလုပ္ပါဘူး။ ေဒတာ အဝင္အထြက္သိပ္မ်ားတာေျကာင့္ PER Crash ျဖစ္တဲ့အထိျဖစ္နိုင္လို့ က်ေနာ္ တို့ ပံုမွန္ troubleshooting မွာ မသံုးပါဘူး။ တစ္ခါတစ္ေလ ISDN Backup လိုင္းေတြေလာက္မွာပဲ msg ေတြလိုအပ္လို့
debug isdn q921 နဲ့ debug isdn q931 ပဲမတတ္သာမွ သံုးေလ့ရွိပါတယ္။

BGP soft-reconfiguration

BGP soft-reconfiguration ဆိုတဲ့ config ရွိေနမွ clear ip bpg * soft ဆိုတဲ့ command သံုးလို့ရပါမယ္။

soft ဆိုတာမပါရင္ BGP session တစ္ခုလံုး reset ျဖစ္သြားပါမယ္။ တကယ့္ နက္ဝပ္ျကီးေတြမွာ အဲလိုလုပ္လိုက္ customer ဆီက claim ခ်က္ခ်င္းေရာက္လာမွာ ေသခ်ာပါတယ္။ :P

ဒါေျကာင့္ က်ေနာ္ တို့ကေတာ့ ရွိသမ်ွ circuit အားလံုး soft-reconfiguration inbound command ကိုထည့္ထားပါတယ္။

ဒီလို ျကိုျပီး configure လုပ္ထားရင္

router bgp 65001
 neighbor 10.1.1.2 remote-as 65002
 neighbor 10.1.1.2 soft-reconfiguration inbound

ဒီလိုလုပ္လို့ရပါတယ္။

clear ip bgp * soft

တခ်ို့လဲ soft မထဲ့မိပဲ လုပ္မိသူေတြရွိပါတယ္။ custom ကို ျပန္ေတာင္းပန္ရတာနဲ့ ပိုအလုပ္ရွုပ္သြားျကပါတယ္။

က်ေနာ္ကေတာ့ soft မရိုက္ခင္ enter နွိပ္မိမွာစိုးလို့ texteditor မွာ ေရးျပီးမွ copy paste လုပ္ပါတယ္။

မာ့ခ္

BGP timers

Default အေနနဲ့ကေတာ့ keepalive is 60s, and hold time is 180s
တခ်ို့Carrier ေတြနဲ့ Interconnection လုပ္တဲ့အခါမွာ က်ေနာ္တို့ကေတာ့ ေလ်ွာ့ျပီးလုပ္ေလ့ရွိပါတယ္။
ဥပမာ keepalive 5s, hold time 15s

Router A

router bgp 65001
 timers bgp 5 15
 neighbor 172.17.1.2 remote-as 65002

Router B

router bgp 65002
 timers bgp 5 15
 neighbor 172.17.1.1 remote-as 65001

20s ေအာက္ဆိုရင္ IOS က warning ေတာ့ေပးတယ္။ ဒါေပမယ့္ လိုအပ္ေတာ့လည္း ေျပာင္းရတာေပါ့။

Blocking Ping (cisco router)

cisco routerမွာ သူမ်ားေတြကိုယ့္ကို ping လို့မရေအာင္လုပ္ျခင္း။

ip access-list extended BLOCK_PING_IN
 permit icmp any any echo-reply
 deny   icmp any any
 
interface FastEthernet0/0
 ip access-group BLOCK_PING_IN in

ps# ကိုယ္ကသူမ်ားကို ping လို့ရပါတယ္။

မာ့ခ္

Frame-relay နဲ့ပတ္သက္တဲ့ ျပသဿသနာေျဖရွင္းနည္း(၁)

၁။ Frame-relay ကိုသံုးရတဲ့ ရည္ရြယ္ခ်က္ အမ်ိုးမ်ိုးရွိပါတယ္။ ဥပမာ

• - FR Access Line ကိုသံုးထားတဲ့အတြက္ေျကာင့္
• - Encapsulation ကိုပဲ Frame-Relay သံုးခ်င္တဲ့အတြက္ေျကာင့္။

- က်ေနာ္ လြန္ခဲ့တဲ့ ၂ပတ္ေလာက္ကျကံုခဲ့တဲ့ တစ္ခုကေတာ့ Serial Interface ကို သံုးျပီး Encapsulation ကို Frame-Relay လုပ္တာပါ။
- ၇၆၈ kbps ထက္နဲျပီးေတာ့ Voice ကို QoS ထားခ်င္တဲ့ လိုင္းေတြမွာသံုးပါတယ္။

အဲဒီမွာ ျပသဿသနာတစ္ခုစပါတယ္။ Port က up-down ပဲျဖစ္ေနျခင္းပါ။
က်ေနာ္က PER (Provider Edge Router) ေတြပိုင္းပဲ ကိုင္ေပမယ့္ တစ္ခါတစ္ေလေတာ့ CER (Customer Edge Router) ကိုဝင္ျကည့္ပါတယ္။

အဲ… အဲဒီမွာဘာေတြ့လဲဆိုေတာ့ interface configuration ေအာက္မွာ frame-relay intf-type dte ျဖစ္ေနတာပါပဲ။
တကယ္က dte သံုးဖို့ဆိုရင္ တကယ္ FR Access Line သံုးထားမွ သံုးသင့္ပါတယ္။
NTU နဲ့ဆက္ထားတဲ့ Serial Interface ဆိုရင္ dce သံုးသင့္ပါတယ္။

ေနာက္ေတာ့ CER ကို Config လုပ္တဲ့သူကိုေမးျကည့္ပါတယ္။ dce ထည့္တာ မရလို့ dte ေျပာင္းထားတာပါတဲ့။ အဲ ဟုတ္ေတာ့ဟုတ္ေနတာပါပဲ။ :-)

က်ေနာ္ကိုယ္တိုင္စမ္းျကည့္ပါတယ္။ ဟုတ္တယ္ မရပါဘူး။ :O

ဒါနဲ့ နဲနဲျကည့္ျကည့္ေတာ့မွ Global Configuration Mode မွာ frame-relay switching ဆိုတဲ့ command မရွိေနပါဘူး။ ဒါေျကာင့္မရတာပါ။ အဲတာထည့္ျပီးေနာက္မွာ frame-relay intf-type dce ဆိုတာလဲ ထည့္လို့ရသြားပါတယ္။

အားလံုးအလုပ္လုပ္သြားပါတယ္။ up-up ဆိုရင္ နွစ္ဦးနွစ္ဖက္ ဝမ္းသာျကတာပါဘဲ။ :-)

မွတ္ခ်က္။ က်ေနာ္ အေတြ့အျကံုျဖစ္ပါသည္။
တကယ္ သီအိုရီပိုင္း ဟုတ္မဟုတ္ က်ေနာ္ အဲေလာက္ မနွံစပ္ေသးပါဘူး။ :)

မာ့ခ္

Cisco Password Decryption

Here is Cisco Password Decryption
just copied from this site

http://www.busindre.com/exploits-para-encriptacion-tipo-7-de-cisco-escritos-en-c-perl-y-javascript/

I like javascript, so I use this.

function isDigit(theDigit)
{
var digitArray = new Array('0','1','2','3','4','5','6','7','8','9')

for (j = 0; j if (theDigit == digitArray[j])
return true
}
return false
}

// Generate a config file ready for loading
function crackPassword(form)
{
var crypttext=form.crypttext.value.toUpperCase()
var plaintext=''
var xlat="dsfd;kfoA,.iyewrkldJKDHSUBsgvca69834ncxv9873254k;fg87"
var seed, i, val=0

if(crypttext.length & 1)
return

seed = (crypttext.charCodeAt(0) - 0x30) * 10 + crypttext.charCodeAt(1) - 0x30

if (seed> 15 || !isDigit(crypttext.charAt(0)) || !isDigit(crypttext.charAt(1)))
return

for (i = 2 ; i <= crypttext.length; i++) {
if(i !=2 && !(i & 1)) {
plaintext+=String.fromCharCode(val ^ xlat.charCodeAt(seed++))
seed%=xlat.length
val = 0;
}

val *= 16

if(isDigit(crypttext.charAt(i))) {
val += crypttext.charCodeAt(i) - 0x30
continue
}

if(crypttext.charCodeAt(i)>= 0x41 && crypttext.charCodeAt(i) <= 0x46) {
val += crypttext.charCodeAt(i) - 0x41 + 0x0a
continue
}

if(crypttext.length != i)
return
}

form.plaintext.value=plaintext
}

Year 2036 / 2038 Problem

Some people started to worried about Year 2038 problem on Linux / Unix Servers

http://www.hackosis.com/index.php/2007/12/21/linux-is-not-y2k38-compliant/

Yeah, I think, for desktop system, should be no problem, coz we can switch to 64 bit machine. I even using that now. But for servers, and embedded machines, that might cause so many problems.

FYI:
http://en.wikipedia.org/wiki/Year_2038_problem

and i also tried that on Cisco Router. I hoped its wont, but i am afraid it is.
It wont allow me to set after 2036. :(

Router#clock set 1:1:1 1 feb ?
  <1993-2035>  Year

Router#clock set 1:1:1 1 feb 2036
                                ^
% Invalid input detected at '^' marker.

Router#

Passed CCNA

Whewwww! I Passed CCNA at 5th Nov 2007.