| Cisco IOS Forensic |
Incident
If you think, your Cisco Device is hacked or missued, its nessasary, to collect all relevant informations and datas.
But before starting to do "anything". it's inportend, that you slow down your heart rate, maybe drink a coffee, count slowy to 10 and now make a short list, what you want to do!
Next Step is, to prepare your enviroment, to collect data and informations.!
Importent:
make sure, that all command you enter and any output of the commands ist logged in a file!!
(turn on Logging on your terminal/console programm)
write down in an Log file , what you are doing. (with time, etc..) see other Forensic Hints on the internet
Connect:
find out, how you can connect to the Device, first try to connect to the "Console" Port, thi is the best way, next is
SSH or Telnet.
If there is no way to connect to the Device, you can scan the Device, and find out, what is still going . (is the Router still routing, make traceroute to some targets). and then is the time come, to restart the Device.Make a Logfile from the boot sequence.
If your Login with your Accounts/Password doesn't work, make a password reset/recovery, but Never overwrite the configs !!
And now , if you have Level 15 Access, its time to execute some show commands
Users and Configurations
show clock detail
show version
show startup-config
show running-config
show reload
show kron schedule
show users {all / all / summary }
show who
Local logs, process , memmory
show log
show debug
show stacks
show tech-support password
show processes {cpu/memory/history}
show buffers
show memory
show environment /all
Network and Rouing Infos
show ip route
show ip ospf {summary / neighbors / ...}
show ip bgp summary
show cdp neighbors
show ip arp
show interfaces
show ip interfaces
show tcp brief all
show ip sockets
show control-plane host open-ports
show connection detail
show ip inspect session detail
show control-plane host open-ports
show ip nat transaltions verbose
show ip cache flow :
show ip cef
show snmp {user/group/sessions/chassis/view}
show vlans
IPV6
show ipv6 route
show ipv6 ospf {summary / neighbors / ...}
show ipv6 interface
show ipv6 cef
show ipv6 inspect sessions detail
and if you have VRF's
show ip vrf VRFNAME route
show ip vrf ....
File System
show flash:
show file descriptors
show file information "filename"
show file systems
dir /recursive all-filesystems
Hardware
show interfaces {status/summary}
show mac-adress-table
show hardware
show inventory
ACL's
show access-lists
ACE and other Boards
If you have additional Board, like ACE, you must change to every contex and collect all datas.
Final Jobs
Copy all files from Flash to a secure place (incl. IOS)
And now, you must collect all informations from the external Logserver. TACACS Server,...
Now, you can make a analysis of the colleced data.But remember, never work with the orginal files!
Tips and hints
watch out for following informations:
- GRE Tunnels
- TCL Scripts
- Route Maps
- additinals users
- terminal length 0 -> for faster Display on the console
|
|