Full Disclosure mailing list archives
[Full-Disclosure] RE: Full-disclosure digest, Vol 1 #1314 - 27 msgs
From: "Daniel Sichel" <daniels () ponderosatel com>
Date: Mon, 8 Dec 2003 08:18:03 -0800
I've got a little problem with a cisco router.
It has obviously been compromised. How do i know, well the password has changed. So I want to retrieve the ACL from the RAM (not NVRAM) to see what else maybe got compromised. Does anyone know how this could be done?
This is probably way too late to be helpful, but set up a tftp server on a workstation, telnet to the router, and "copy run tftp". It will prompt you for the ip of the tftp server (most routers won't get name resolution, so have the ip address of the tftp server handy). Answer the rest of the prompts and voila, it should copy the current running (ram resident) config to a file on the tftp server. Dan Sichel, Network Engineer Ponderosa Telephone Company (559) 868-6367 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- [Full-Disclosure] RE: Full-disclosure digest, Vol 1 #1314 - 27 msgs Daniel Sichel (Dec 08)
- Re: [Full-Disclosure] RE: Full-disclosure digest, Vol 1 #1314 - 27 msgs Valdis . Kletnieks (Dec 08)
- points of analysis Akbar Ali (Dec 08)
- Re: [Full-Disclosure] RE: Full-disclosure digest, Vol 1 #1314 - 27 msgs Gregory A. Gilliss (Dec 08)
- Re: [Full-Disclosure] RE: Full-disclosure digest, Vol 1 #1314 - 27 msgs Valdis . Kletnieks (Dec 08)
- Re: [Full-Disclosure] RE: Full-disclosure digest, Vol 1 #1314 - 27 msgs Valdis . Kletnieks (Dec 08)