# 20201202 cisco KDLinux

## 課堂資料

{% embed url="<https://ssorc.tw/7397/routersploit-%E6%8E%83-router-%E8%A8%AD%E5%82%99%E6%BC%8F%E6%B4%9E-%E5%BC%B1%E9%BB%9E/>" %}

{% embed url="<https://sites.google.com/a/james-tw.com/j-note/cisco/cisco-she-ding-yuan-duan-lian-xian-telnet-ssh>" %}

{% embed url="<https://david50.pixnet.net/blog/post/45217866-%5B%E7%AD%86%E8%A8%98%5Dcisco%E5%9F%BA%E6%9C%AC%E6%8C%87%E4%BB%A4-%E5%95%9F%E7%94%A8ssh>" %}

{% embed url="<https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt>" %}

{% embed url="<https://netsec.ws/?p=353>" %}

![](/files/-MNWTuPW9cd3jeVGQ4Ij)

> 建立一個 router 和 Linux，並將它們設置 IP

{% tabs %}
{% tab title="R1" %}

```
int e0/0
```

```
ip addr 192.168.1.1 255.255.255.0
```

```
no shut
```

![](/files/-MNWCo-iq_SJYC0b3BT1)

```
line vty 0 4
```

```
login
```

```
password cisco
```

```
transport input telnet
```

![](/files/-MNWHn49pw7CWKqvS6QS)
{% endtab %}

{% tab title="Linux" %}

```
ip addr add 192.168.1.2/24 brd + dev eth0
```

```
ping 192.168.1.1
```

![](/files/-MNWF_7Z_i-tXmJv2pDe)

```
telnet 192.168.1.1
```

![](/files/-MNWI3qptEz_KM9eQ-aP)
{% endtab %}
{% endtabs %}

![](/files/-MNWJ7Axay52TM2m3SGo)

{% tabs %}
{% tab title="Linux" %}

> eth0 自帶 IP，可以直接 Ping`8.8.8.8`和`www.google.com`

![](/files/-MNWKC_UHYarSYJc8Hl8)

> 時間設置

```
timedatectl set-timezone Asia/Taipei
```

> 更新

```
systemctl restart ntp.service
```

```
ntpd
```

```
apt update
```

```
apt install curl wget
```

![](/files/-MNWMt5nGRt7-f21LcIN)

```
useradd user
```

```
mkdir /home/user -p
```

```
chown user:user /home/user
```

```
su - user
```

```
bash
```

```
git clone https://github.com/reverse-shell/routersploit
```

```
cd routersploit/
```

```
python3 -m pip install -r requirements.txt
```

```
python3 rsf.py
```

![](/files/-MNWSxR17WxVdoFC1MF9)

```
use scanners/routers/router_scan
```

```
set target 12.1.1.1
```

```
run
```

```
exit
```

{% endtab %}
{% endtabs %}

![](/files/-MOyYA1XVQvx377Fl_M7)

## 課堂練習

![](/files/-MNWVsWWgvRx6L7SA07d)

{% tabs %}
{% tab title="R1" %}

```
int e0/0
```

```
ip add 12.1.1.1 255.255.255.0
```

```
no shut
```

```
router rip
```

```
ver 2
```

```
no auto-summary
```

```
network 12.1.1.0
```

```
exit
```

```
ip domain-name test.com
```

```
crypto key generate rsa
```

```
ip ssh ver 2
```

```
line vty 0 4
```

```
login local
```

```
transport input ssh
```

```
username root privilege 15 password 12345
```

```
end
```

```
show running-config | inc username
```

![](/files/-MOyfO_ZJ5DZzJGVSZXm)
{% endtab %}

{% tab title="R2" %}

```
int e0/0
```

```
ip add 12.1.1.2 255.255.255.0
```

```
no shut
```

```
int e0/1
```

```
ip add 192.168.1.1 255.255.255.0
```

```
no shut
```

```
router rip
```

```
ver 2
```

```
no auto-summary
```

```
network 12.1.1.0
```

```
network 192.168.1.0
```

![](/files/-MNW_ZJg9J_xa8sY-c1z)

```
end
```

```
ssh -l root 12.1.1.1
```

![](/files/-MNWatgWZCve40BCuwUg)
{% endtab %}

{% tab title="Linux" %}

```
ip addr add 192.168.1.2/24 brd + dev eth0
```

```
ip route add default via 192.168.1.1
```

```
ping 192.168.1.1
```

```
ping 12.1.1.1
```

![](/files/-MOxtYUSEZGA8svITBfQ)

```
cd Downloads
```

```
vim test.txt
```

```
123
1234
12345
123456
111
222
```

```
hydra -l root -p test.txt ssh://12.1.1.1 -t 4
```

![](/files/-MOyRMVaaO7e8-oWTabx)

```
```

{% endtab %}
{% endtabs %}

![](/files/-MOyjTZapsaoeCMlcDeN)

{% tabs %}
{% tab title="R2" %}

```
int e0/2
```

```
ip addr dhcp
```

```
no shut
```

```
do sh ip int brief
```

![](/files/-MOySt2rStcUCw__vc3G)

```
exit
```

```
enable password 12345
```

```
line vty 0 4
```

```
password 12345
```

```
login
```

```
transport input telnet
```

{% endtab %}

{% tab title="vm1" %}

```
ping 192.168.8.135
```

![](/files/-MOyUm-GdaOLqGIQOLkg)

```
yum install telnet
```

```
telnet 192.168.8.135
```

```
yum install python-pip
```

```
pip install pexpect
```

![](/files/-MOyWPy1Zc1VKpS-Mumz)

```
yum install python3 python3-pip
```

![](/files/-MOyYqiLErY_R_JdaQRx)

```
python3
```

```
import pexpect
```

```
child=pexpect.spawn('telnet 192.168.157.143')
```

```
child=expect('Password:')
```

```
child=sendline('12345')
```

```
child=expect('R2#')
```

```
child=sendline('sh ip int brief')
```

```
child=expect('R2#')
```

```
child.before
```

```
cd /tmp
```

```
ip ro sh
```

```
./test.py
```

{% endtab %}
{% endtabs %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://anida-huang.gitbook.io/computer-network/qi-mo/20201202.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
