CVE-2023-20198
CVE-2023-20198 Checkscript based on: https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/ Including the updated where there is an Authorization header to check for the known implant.
!! Upgraded to look for upgraded implant
The script checks length of returned response with code 200, and checks if length is shorter then 32 characters. Each IP returning shorter length than 32 chars should be checked to se if device is compromised. This script only gives you an indicator, not proof that the device is compromised.
The script also checks if the implant has been upgraded, as dicovered by Fox-IT: https://github.com/fox-it/cisco-ios-xe-implant-detection
Run:
python cve-2023-20198.py
and enter you desired subnet to scan. For example:
python CVE-2023-20198
Enter the subnet (CIDR notation): 10.0.0.0/22
IP: 10.0.0.94 - Error: no reply
IP: 10.0.0.94 - Error: no reply
IP: 10.0.0.96 - Status: 200
IP: 10.0.0.96 - Response is a potentially suspicious:
IPs with status code 200, suspicious length, should be checked:
['10.0.0.96']
IPs with status code 200, but no IOC:
[]