full-disclosure - RE: Full-Disclosure digest, Vol 1 #1314

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <190DFDD2F99A65469B4B15D3658C0D2B71ED7C@PTC6.ponderosatel.com>
From: daniels at ponderosatel.com (Daniel Sichel)
Subject: RE: Full-Disclosure digest, Vol 1 #1314 - 27 msgs

I've got a little problem with a cisco router.
>   It has obviously been compromised. How do i know, well the password
>   has changed. So I want to retrieve the ACL from the RAM (not NVRAM)
>   to see what else maybe got compromised.
>   Does anyone know how this could be done?

This is probably way too late to be helpful, but set up a tftp server on
a workstation, telnet to the router, and "copy run tftp". It will prompt
you for the ip of the tftp server (most routers won't get name
resolution, so have the ip address of the tftp server handy). Answer the
rest of the prompts and voila, it should copy the current running (ram
resident) config to a file on the tftp server.

Dan Sichel, Network Engineer
Ponderosa Telephone Company
(559) 868-6367