Monday 20 February 2012 20:02
Here are DNS queries issued by a Windows XP machine:
And here is a command history of a Cisco router:
What do these results have in common?
Both were produced by analyzing RAM dumps with a new forensic toolkit I’m developing, the Network Appliance Forensic Toolkit, or NAFT.
More to be published soon.
But if you want a beta version now, provide me a Cisco core dump in exchange 😉
Posted by Didier Stevens
Categories: My Software, Networking
Tags:
Mobile Site | Full Site
Get a free blog at WordPress.com Theme: WordPress Mobile Edition by Alex King.
I have Cisco ASA 5055. In what way I can create core dump for you or does the system need to crash?
By Henri Salo on Tuesday 21 February 2012 at 5:48
Impressive 🙂
By c3ret on Tuesday 21 February 2012 at 9:38
@Henri I can have access to a 5505 too. On IOS, you use ‘write core’ or ‘test crash’. Have to check out what to use on ASA.
By Didier Stevens on Wednesday 22 February 2012 at 8:30
@Henri Go to config mode and issue command ‘coredump enable’. If you don’t have enough flash memory to write the code dump to, you’ll get an error message.
Then issue ‘crashinfo force’.
By Didier Stevens on Wednesday 22 February 2012 at 11:06
Hi Didier,
The “NiStTeSt” stuff is interesting. It almost certainly varies with IOS version, but if you’ve got command logging turned on on a router with an otherwise “blank” config, you’ll see this when the router reloads:
*Apr 13 09:30:49.383: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:access-list 199 permit icmp host 10.10.10.10 host 20.20.20.20
*Apr 13 09:30:49.387: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:crypto map NiStTeSt1 10 ipsec-manual
*Apr 13 09:30:49.387: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:match address 199
*Apr 13 09:30:49.387: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:set peer 20.20.20.20
*Apr 13 09:30:49.387: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:exit
*Apr 13 09:30:49.403: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:no access-list 199
*Apr 13 09:30:49.407: %PARSER-5-CFGLOG_LOGGEDCMD: User:console logged command:no crypto map NiStTeSt1
It’s odd that the config should be modified (albeit benignly, eventually) in this way during reload. I opened a TAC case at the time, but was met with the blank stares you sometimes encounter there.
It also makes me wonder if whatever bit of IOS it is that is doing this could somehow be subverted to issue arbitrary commands every time the router reloads….
alec
By Alec Waters on Wednesday 22 February 2012 at 11:44
[…] can find a first release of my Network Appliance Forensic Toolkit here. This first release contains a tool for generic network appliances, but also works on memory […]
By NAFT Release « Didier Stevens on Monday 12 March 2012 at 19:42