REM
###################################################################################
##########
REM #
#
REM # Title : Auto-Check Cisco IOS XE Backdoor based on CVE-2023-20198 and CVE-
2023-20273 #
REM # Author : Aleff
#
REM # Version : 1.0
#
REM # Category : incident-response
#
REM # Target : Cisco IOS XE
#
REM #
#
REM
###################################################################################
##########
REM Set the script name, the default name is auto-check.sh but you can change it
here since is used the DuckyScript variable #SCRIPT-NAME.
DEFINE #SCRIPT-NAME auto-check.sh
REM Here you must set your sudo password that permit to give the executable
permissions to the file
DEFINE #SUDO-PSWD example
REM Here you chould define the script path, if you don't change it is selected the
default path, so the home path. If, for istance, you have a specific path where you
put some stuff like this you can edit thi DuckyScript variable with the correct
path
DEFINE #PATH-TO-SCRIPT ./
EXTENSION DETECT_READY
REM VERSION 1.1
REM AUTHOR: Korben
REM_BLOCK DOCUMENTATION
USAGE:
Extension runs inline (here)
Place at beginning of payload (besides ATTACKMODE) to act as dynamic
boot delay
TARGETS:
Any system that reflects CAPSLOCK will detect minimum required delay
Any system that does not reflect CAPSLOCK will hit the max delay of
3000ms
END_REM
REM CONFIGURATION:
DEFINE #RESPONSE_DELAY 25
DEFINE #ITERATION_LIMIT 120
VAR $C = 0
WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT))
CAPSLOCK
DELAY #RESPONSE_DELAY
$C = ($C + 1)
END_WHILE
CAPSLOCK
END_EXTENSION
CTRL-ALT t
DELAY 1000
STRINGLN
echo 'while true; do
response=$(curl -k -H "Authorization:
0ff4fbf0ecffa77ce8d3852a29263e263838e9bb" -X POST
https://systemip/webui/logoutconfirm.html?logon_hash=1)
if [[ $response =~ ^[0-9a-zA-Z]+$ ]]; then
if [ $? -eq 0]; then
# Attack detected, here you decide what to do in this
moment
# 1. Send an email to sec-team
# 2. Do some other ops
# ...
# 3. What do you want to do?
# Can you reboot the system or you need to do something else
before?
# Do you want to close it?
# ...
# The only one way to close the backdoor is reboot the
system, so don t change it (?)...
# |-> See the Conseguence section in README
reboot
else
# You are safe :-)
fi
fi
sleep 300 # wait time
done' > #PATH-TO-SCRIPT#SCRIPT-NAME
END_STRINGLN
REM To avoid some bad DELAY I decided to use only one command row
REM Old script
REM STRINGLN sudo chmod +x #SCRIPT-NAME
REM DELAY 500
REM STRINGLN #SUDO-PSWD
REM DELAY 3000
REM STRINGLN sh #PATH-TO-SCRIPT#SCRIPT-NAME $
REM STRINGLN exit
REM Optimized script
STRINGLN sudo chmod +x #SCRIPT-NAME; sh #PATH-TO-SCRIPT#SCRIPT-NAME $; exit
DELAY 500
STRINGLN #SUDO-PSWD
