A great example of network solidarity is the numerous services of looking-glass, which allow you to look behind the scenes of so many large and small networks around the world. It is so amazing in today's world, hidden behind hundreds of security systems, just to pick up and execute commands on routers that are among the most critical devices in the entire data transmission infrastructure.



You just need to enter the IP address or prefix in the field and get in reply the routing table or trace and the results of the ping utility. Therefore, when you understand that it is possible to enter not only addresses, but also some other characters formed into meaningful commands and to receive meaningful results, a stupor occurs. I want to run and shout at all corners: "But what is it that should be immediately banned, what kind of absurdity?" These are all the consequences of recent years, when security is above openness and convenience, and there are undoubtedly reasons for that.
')
It will be a question of the very popular implementation of looking-glass from version6.net and that something can be obtained from this service.

If you suddenly find it normal that the looking-glass interface allows you to enter something other than an IP address, then you probably belong to the “old school” or do not read the news. It seemed to me unusual, especially since other implementations of this service do not allow this.

• In ReTN (quite a popular implementation), all entered characters are treated as a domain name, if it is not an IP address.
• MSX-IX everything is divided into parts, you can enter, but only where it is provided and interpreted everything is quite rigid.
• Data IX allows some freedom, although it reports that the IP address is not specified: “An invalid argument is specified — it must be IP or IP / n” —but still birdc is executed, which reports an error and filters all obscenities.
• And Vkontakte is allowed only ping and traceroute and only with IP addresses.

Since it was unusual for me, I even began to warn the owners of services about it, but then I looked into the code and realized that it should be so - this is a feature, not a bug. On the site version6.net , which is now for some reason not available, the functionality is honestly written: " all BGP show commands , ping and traceroute" .

Open lg.cgi , which is hard to read and Perl does not help at all:

my %FORM = &cgi_decode($incoming); ... $FORM{addr} =~ s/\s.*// if (($FORM{query} eq "ping") || ($FORM{query} eq "trace")); $FORM{addr} =~ s/[^\s\d\.:\w\-_\/\$]//g; 

The command is transmitted in the $ addr variable, in which all characters except whitespace (including tabs, \ s option), letters, numbers, symbols "-", "_", "/", "$", ".", " Are deleted: ".

The ping condition is much stricter. As far as I can see, all input is wiped after the whitespace. Therefore, adding something extra to the ping and traceroute commands is much more difficult.

 my $command = sprintf($query_cmd, $FORM{addr}); ... if ($FORM{addr} !~ /^[\w\.\^\$\-\/ ]*$/) { if ($FORM{addr} =~ /^[\w\.\^\$\-\:\/ ]*$/) { ... } else { &print_error("Illegal characters in parameter string"); } } 

Then a command is formed for direct execution from the $ query_cmd template and a check is made that the input belongs to a slightly different group of characters: tabs are excluded, because spaces are clearly indicated, the "_" symbol remains included because it falls under the \ w option with numbers, the symbol appears ^ ". Additional verification is done on ":", which is possible only when working with IPv6.

That's all, the remaining checks are only on the empty line for some modes of operation. The command for execution has already been formed earlier and it goes to the device without changes:

 $FORM{addr} = "" if ($FORM{addr} =~ /^[ ]*$/); ... if ($query_cmd =~ /%s/) { &print_error("Parameter missing") if ($FORM{addr} eq ""); } else { &print_warning("No parameter needed") if ($FORM{addr} ne ""); } ... &run_command($FORM{router}, $router_list{$FORM{router}}, $command); 

What can we do? From useful lost quotes, symbols "|", "?" and all brackets. But there are a lot left, even very much. The command forming pattern looks like this (for Cisco):

 my %valid_query = ( "ios" => { "ipv4" => { "bgp" => "show ip bgp %s", "advertised-routes" => "show ip bgp neighbors %s advertised-routes", "summary" => "show ip bgp summary", "ping" => "ping %s", "trace" => "traceroute %s" }, ... 

The basic show ip bgp , ping, and traceroute commands. Obviously, show ip bgp summary and show ip bgp neighbors% s advertised-routes can be formed from show ip bgp% s .

show ip bgp

Our bread. It should be noted that on different sites, additional filtering is still done, or refinement for other systems other than the standard ones, therefore, it is not always possible to enter arbitrary characters. Rather, it is even possible, but further execution of commands leads to errors. However, if we have the basic devices provided in the original code, we can enter a wide range of commands. Site Cisco, we will stop on one vendor, offers many options . Some useful, for example.

show ip bgp regexp

We look at all the routes for a given AS-PATH. For example, to all Yandex networks from Stockholm, TTK (GET will send directly to the query results):

show ip bgp neighbors

Detailed information about established neighborhoods. The command is sometimes indirectly available in the highlighted output when executing other commands. For example, detailed information about one of the Beeline neighborhoods in Stavropol:


You can expand to advertised-routes to see which routes are advertised in the direction of a certain neighbor, often present directly in the interface.

show ip bgp summary

The command is not always available directly, so you can try to bypass. For example, for RTCOMM :

Ping and traceroute

And these commands can be expanded: increase the size of the packet, turn off fragmentation. But it is more difficult to do this, because the code for filtering is stricter. Examples, however, can be found - Starnet , by the way here is Juniper:


Looking-glass is a wonderful tool, even an excellent one that solves many problems and unites the ranks of networking professionals around the world, a very clear sign of a company's maturity. Having mentioned several different companies, in my own I have not yet decided to put such a service outside.

You can experiment for a long time, LG services are available a lot around the world and a sufficient number of them are built on the version offered by version6.net. But any tool must be predictable, some of the unfiltered commands are terribly resource intensive, some open a little more than can be allowed in the modern world. Take a look at your code and do it enough for you. Be attentive to each other, mutual assistance and openness allowed to build the Internet, we will not destroy it.