Embedded Systems Security High quality versions of the three Cisco IOS shellcode demonstration Bind Shell · Requires four hard-coded addresses of functions within IOS · Creates a new VTY · Sets a password on the VTY · Privilege escalates to level 15 Video: Bind Shell http://www.irmplc.com/content/videos/bindshell/bindshell.html Reverse Shell · Requires five hard-coded addresses of functions within IOS · Creates a new VTY · Privilege escalates to level 15 · Opens a new TCP connection · Binds the VTY to the TCP connection Video: Reverse Shell http://www.irmplc.com/content/videos/reverseshell_final/reverseshell_final.html Two byte rootshell or Tiny Shell · Requires up to one (sometimes none) hard-coded addresses within IOS · Removes the requirement to authenticate to a currently active VTY · Privilege escalates to level 15 Video: "Two byte rootshell" or Tiny Shell http://www.irmplc.com/content/videos/tinyshell_final/tinyshell_final.html More Info: http://www.irmplc.com/index.php/153-Embedded-Systems-Security