BENIGNCERTAIN (Information Disclosure in Cisco IKEv1)

This repository contains a single Metasploit auxiliary scanner module targeting the Cisco IKEv1 Information Disclosure vulnerability (CVE-2016-6415), also known as BENIGNCERTAIN. The module is written in Ruby and is designed to be used within the Metasploit Framework. It sends a crafted ISAKMP (IKEv1) packet (by default, from a provided binary file) to UDP port 500 of a target device running Cisco IOS, IOS XE, or IOS XR. If the target is vulnerable, the device responds with leaked memory contents, which the module processes and displays. The module reports the vulnerability if a leak is detected. The only endpoints involved are the target's UDP port 500 and the local packet file used as the payload. The module is a proof-of-concept for information disclosure and does not provide post-exploitation capabilities.

This repository is a Dockerized Python-based exploit and monitoring tool targeting Cisco devices vulnerable to CVE-2016-6415 (BENIGNCERTAIN). The main exploit logic is in 'benigncertain/benign.py', which crafts and sends a malicious IKEv1 packet over UDP port 500 to the target, causing the device to leak memory. The 'poc.py' script orchestrates the attack, repeatedly invoking the exploit, extracting ASCII strings from the resulting memory dumps, and storing them in a local SQLite database ('details.db'). The process is automated via 'entry.sh', which continuously polls the target and updates the database, allowing for ongoing monitoring and aggregation of leaked data. The repository is structured for ease of use via Docker, with clear separation between the exploit code, orchestration script, and supporting files. The exploit is operational and can be used to harvest sensitive information (such as probable passwords) from affected Cisco devices over time.