I see this error from time to time as well. I note the comment about disabling accounting on the Anchor - is this documetned anywhere or is it a software bug? I want to be sure this is the correct thing to do before I make this change on my production system.   DJ ... View more

Hey guys. I just tested this and was able to output the key info for my guests (in a test lab). This allowed me to massage the guest information into a format whereby it could be imported into my new ISE. # WARNING - THIS IS A CRUDE METHOD WITH LITTLE ATTEMPT TO MAKE IT EFFICIENT # Retrieve list of all guest user accounts:   root@kali:~#  curl -k https://erstest:Password1@10.5.123.69:9060/ers/config/guestuser -H   root@kali:~# cat guestuserall.txt {   "SearchResult" : {     "total" : 20,     "resources" : [ {       "id" : "00a1b3c1-24b4-11e7-bbb1-0050568f4d09",       "name" : "2vj93o",       "link" : {         "rel" : "self",         "href" : "https://10.5.123.69:9060/ers/config/guestuser/00a1b3c1-24b4-11e7-bbb1-0050568f4d09",         "type" : "application/xml"       }     }, {       "id" : "00bbcb71-24b4-11e7-bbb1-0050568f4d09",       "name" : "45b3vr",       "link" : {         "rel" : "self",         "href" : "https://10.5.123.69:9060/ers/config/guestuser/00bbcb71-24b4-11e7-bbb1-0050568f4d09",         "type" : "application/xml"       }     }, {       "id" : "00ad9aa1-24b4-11e7-bbb1-0050568f4d09",       "name" : "7zp47c",     Sanitise this into a list of guest user ids:   root@kali:~# cat guestuserall.txt | grep  "id" | cut -d " " -f9 | sed 's|[",]||g' > guestuserids.txt   root@kali:~# more guestuserids.txt 00a1b3c1-24b4-11e7-bbb1-0050568f4d09 00bbcb71-24b4-11e7-bbb1-0050568f4d09 00ad9aa1-24b4-11e7-bbb1-0050568f4d09 00b5d801-24b4-11e7-bbb1-0050568f4d09 00bf26d1-24b4-11e7-bbb1-0050568f4d09 8a440772-1f48-11e7-bbb1-0050568f4d09 00b89721-24b4-11e7-bbb1-0050568f4d09 00c20d01-24b4-11e7-bbb1-0050568f4d09 00c4cc21-24b4-11e7-bbb1-0050568f4d09 00aab471-24b4-11e7-bbb1-0050568f4d09 00c78b41-24b4-11e7-bbb1-0050568f4d09 1c282f72-2487-11e7-bbb1-0050568f4d09 7608f600-1f46-11e7-bbb1-0050568f4d09 33817831-2486-11e7-bbb1-0050568f4d09 c82eb1b0-1f44-11e7-bbb1-0050568f4d09 00a4c101-24b4-11e7-bbb1-0050568f4d09 00ca4a61-24b4-11e7-bbb1-0050568f4d09 8c068872-24ad-11e7-bbb1-0050568f4d09 5f4baf70-2487-11e7-bbb1-0050568f4d09 d47a4fe1-2487-11e7-bbb1-0050568f4d09 root@kali:~#     For each guest user id, claw back full details of the guest (including password):   root@kali:~# for userids in $(cat guestuserids.txt); do curl -k https://erstest:Password1@10.5.123.69:9060/ers/config/guestuser/$userids -H Accept:application/json; done > guestusercredsraw.txt   root@kali:~# more guestusercredsraw.txt {   "GuestUser" : {     "id" : "00a1b3c1-24b4-11e7-bbb1-0050568f4d09",     "name" : "2vj93o",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "sponsorUserName" : "admin",     "sponsorUserId" : "7e2956b2-24ad-11e7-bbb1-0050568f4d09",     "guestInfo" : {       "userName" : "2vj93o",       "password" : "7625",       "creationTime" : "04/18/2017 20:55",       "enabled" : false,       "notificationLanguage" : "English"     },     "guestAccessInfo" : {       "validDays" : 1,       "fromDate" : "04/19/2017 13:55",       "toDate" : "04/19/2017 23:59",       "location" : "San Jose"     },     "customFields" : {     },     "link" : {       "rel" : "self",       "href" : "https://10.5.123.69:9060/ers/config/guestuser/00a1b3c1-24b4-11e7-bbb1-0050568f4d09",       "type" : "application/xml"     }   } }{   "GuestUser" : {     "id" : "00bbcb71-24b4-11e7-bbb1-0050568f4d09",     "name" : "45b3vr",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "sponsorUserName" : "     Optionally, sanitise this output to only show some major details about the guests:   root@kali:~# cat guestusercredsraw.txt | grep -E 'guestType|status|guestInfo|userName|password' > finalguestinfo.txt   root@kali:~# more finalguestinfo.txt     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "2vj93o",       "password" : "7625",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "45b3vr",       "password" : "1527",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "7zp47c",       "password" : "2889",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "893yfs",       "password" : "0220",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "9wge99",       "password" : "5922",     "guestType" : "Contractor (default)",     "status" : "EXPIRED",     "guestInfo" : {       "userName" : "djohnson",       "password" : "7124",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "e9gi23",       "password" : "2454",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "fs78v8",       "password" : "8752",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "g896oy",       "password" : "5829",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "h59ui7",       "password" : "5507",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "ia764t",       "password" : "4446",     "guestType" : "Daily (default)",     "status" : "PENDING_APPROVAL",     "guestInfo" : {       "userName" : "jamesbond",       "password" : "9426",     "guestType" : "Daily (default)",     "status" : "EXPIRED",     "guestInfo" : {       "userName" : "johndond",       "password" : "6798",     "guestType" : "Daily (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "johnson",       "password" : "9945",     "guestType" : "Daily (default)",     "status" : "EXPIRED",     "guestInfo" : {       "userName" : "johnson4d",       "password" : "1919",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "l5ms83",       "password" : "8638",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "oyw528",       "password" : "7022",     "guestType" : "Contractor (default)",     "status" : "AWAITING_INITIAL_LOGIN",     "guestInfo" : {       "userName" : "rdazzle",       "password" : "1227",     "guestType" : "Daily (default)",     "status" : "PENDING_APPROVAL",     "guestInfo" : {       "userName" : "user12345",       "password" : "1889",     "guestType" : "Daily (default)",     "status" : "PENDING_APPROVAL",     "guestInfo" : {       "userName" : "user9876",       "password" : "7654", root@kali:~#  ... View more

Actually, I just tested this on v7.4 (5508 WLC and Virtual WLC) and they ONLY support SSH v2 (they do NOT support SSH v1). This was confirmed with a sniffer. I found this during my own studies to see if the Cisco WLCs were vulnerable to SSH downgrade attacks (to capture username/password). Thanks DJ ... View more

Hi guys. Robert, I wasn't aware of ITL signed config files that you said is standard on CUCM 8.x and higher - this, if properly implemented, would prevent the attack. In my document I talk about disabling user settings, so I was aware of that and it is covered in my doc. I agree this is NOT a zero day vulnerability. It does however exploit weak default settings (in some versions of CUCM), meaning that is a security risk. Agreed about blocking default settings (see above) but using sRTP (encrypted RTP right) would also prevent the playback - I wasn't aware sRTP was supported so that is a cool preventative measure :-)   Thanks guys, I will update the doc to include your comments. Darren ... View more

Really good article. I wrote a tutorial on how this feature could be exploited to record phone calls that could be later be played back. This tutorial was sent to Cisco PSIRT prior to be released publically: http://www.og150.com/tutorials.php Download "Podo Attack" to see the end to end compromise. Thanks Darren ... View more

You are partly right here George. Granted, Reaver 'only' cracks WPS PINs, but once it has done so you are 'given' the WPA/WPA2 PSK. In a round about way you are ultimately getting your goal, the WPA/WPA2 PSK. A Reaver attack tutorial/demonstration using the OG150 is now available to download for free! WPA2 PSK WAS CRACKED IN 4 SECONDS!! Download the PDF tutorial from http://www.og150.com/tutorials.php. Attack was demonstrated on a Linksys WAG54G2 router with v1.00.10 software. Thanks Darren ... View more

Resurrecting an old thread here.... Always use MD5 authentication for your VRRP deployment. A demonstration of VRRP being attacked/compromised can be downloaded from the location below. In addition, it shows how plain-text authentication can be simply viewed using a sniffer. As the biased author of the document, I believe its a good read :-) Download the demonstration from here: http://www.og150.com/tutorials.php Go to: "VRRP (Virtual Router Redundancy Protocol) Attack" ... View more

Yup, DAI is the way forward here. To learn a little more, check out the 8-page ARP Spoofing MITM attack demonstration which gleans Telnet username/passwords credentials - using the OG150 security dropbox. You can see the tutorial at: http://www.og150.com/tutorials.php Go to: "ARP Spoofing MITM Attack, Capturing Telnet Data" at this URL: Only then will you realise the danger that surrounds ARP spoofing... Thanks Darren ... View more

There is a very useful 10-page security analysis on WPA/WPA2 PSKs at the URL below. Not only does it demonstrate a WPA2 PSK being cracked using the OG150, it discusses the mechanics behind PSKs, the cracking process and more.... http://www.og150.com/tutorials.php Go to: Wireless Pre-Shared Key Cracking (WPA, WPA2) Darren ... View more

Hi David, thanks for the response :-) You are exactly right, change the default community strings is a good place to start in mitigating this attack. There is also an enhancement request now filed to have NO default community strings enabled in the WLC software. Thanks again, good to hear some feedback. DJ ... View more