Finding Cisco IOS XE CVE-2023-20198 With ConfigSources

On October 16, 2023, Cisco published a vulnerability that affects IOS XE machines running the built-in web server: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z

This is tracked as https://nvd.nist.gov/vuln/detail/CVE-2023-20198

By adding a simple Config Check to an existing Cisco IOS ConfigSource, LogicMonitor can help people quickly identify which resources have the web server enabled. Here is an example:

Name: Cisco-CSCwh87343-Check
Check type: "Use Groovy Script"

Groovy script:

/*<br/>The built-in string variable 'config' contains the entire contents of the configuration file. <br/>The following example will trigger an alert when the configuration file contains the string "blue". <br/>if (config.contains("blue")) {<br/>    return 1;<br/>} else {<br/>    return 0;<br/>}<br/>*/<br/><br/>if (config.contains("ip http")) {<br/>    return 1;<br/>} else {<br/>    return 0;<br/>}

Then trigger this type of alert: Warning
Description: "Search for presence of Cisco
CSCwh87343 vulnerability"

Caveats:

-This will apply to all devices where the ConfigSource is used, even though all devices may not be affected by the vulnerability

-This assumes usage of ConfigSources and specifically the Cisco_iOS ConfigSource

Thanks to Todd Ritter for finding this CVE and Creating the ConfigSource

Patrick Anderer

Posted 2 years ago·Last reply 2 years ago

1 comment

LM User

·2 years ago

I built a standalone property source for this. Checking if “ip http” server is in the config is not enough (what if “no ip http server” is present?). Also, it’s a good idea to highlight the ones that have public ip addresses. Also, there’s a mitigation for it that you can check for.

Here’s my PS code. I apply it to “system.sysinfo =~ "IOSXE" && ssh.user && ssh.pass && isCisco()”:

import com.santaba.agent.groovyapi.expect.Expect<br/>import com.santaba.common.groovyapi.expect.expectj.ExpectJ<br/>import java.util.regex.Pattern<br/>import com.jcraft.jsch.JSch<br/><br/>deviceType = hostProps.get("system.categories")<br/><br/>if (deviceType.contains("Cisco")){<br/>    def device = null<br/>    try {<br/>        device = new CiscoIOSDevice(hostProps)<br/>    } catch (all) {<br/>        println("http.server.error=Fail to initiate device object: ${all.getMessage()}")<br/>        throw new RuntimeException("Failure to initiate the device.\nMessage: ${all.getMessage()}")<br/>        return 1<br/>    }<br/>    try {<br/>        runningConfig = device.LM_getCollectionOutput("running-config | include ip http se")<br/>    }<br/>    catch (all) {<br/>        println("http.server.error=Fail to fetch running config: ${all.getMessage()}")<br/>        throw new RuntimeException("Failure to fetch the running config.\nMessage: ${all.getMessage()}")<br/>        return 2<br/>    }<br/>    ipaddresses = hostProps.get("system.ips", "")<br/>    device.Cisco_LogoutDevice()<br/>    runningConfig.eachLine{<br/>        if (it.contains("ip http server")){<br/>            if (it.tokenize(" ")[0] == "no"){println("http.server=false")}<br/>            else {println("http.server=true")}<br/>        }<br/>        if (it.contains("ip http secure-server")){<br/>            if (it.tokenize(" ")[0] == "no"){println("http.server.secure=false")}<br/>            else {println("http.server.secure=true")}<br/>        }<br/>        if (it.contains("ip http active-session-modules none")){<br/>            if (it.tokenize(" ")[0] == "no"){println("http.server.active_session_modules=false")}<br/>            else {println("http.server.active_session_modules=true")}<br/>        }<br/>        if (it.contains("ip http secure-active-session-modules none")){<br/>            if (it.tokenize(" ")[0] == "no"){println("http.server.secure_active_session_modules=false")}<br/>            else {println("http.server.secure_active_session_modules=true")}<br/>        }<br/>    }<br/>    privateips = []<br/>    publicips = []<br/>    ipaddresses.tokenize(",").each{<br/>        try{<br/>            publicips.add((it =~ /\b(?!(10(\.\d{1,3}){3}|192\.168(\.\d{1,3}){2}|172\.(1[6-9]|2[0-9]|3[0-1])(\.\d{1,3}){2}))(\d{1,3}(\.\d{1,3}){3})\b/)[0][0])<br/>        } catch (x){<br/>            try {<br/>                privateips.add((it =~ /\b(([0-9]{1,3}\.){3}[0-9]{1,3}\b)/)[0][0])<br/>            } catch (y){}<br/>        }<br/>    }<br/>    println("http.server.private.ips=${privateips.join(',')}")<br/>    println("http.server.public.ips=${publicips.join(',')}")<br/>    return 0<br/>} else {<br/>    println("http.server.error=Not a supported device type")<br/>}<br/><br/>/**<br/> * Cisco IOS command execution<br/> */<br/>class CiscoIOSDevice {<br/>    private hostProps = null<br/>    private host = null<br/>    private user = [:]<br/>    private pass = [:]<br/>    private creds = [:]<br/>    private enable_pass = []// If the user has specified an enable password, this will get set further down.<br/>    private enable_level = null<br/>    private priv_exec_mode = false             // Notes what EXEC mode we are in.  Initially we assume USER EXEC.<br/>    private escalated_privs = false             // If we need to escalate our prives from $ to #, we should know.<br/>    private parser_view = false<br/><br/>    private enum Cisco_ENUMUserPrivilegeState {<br/>        USER, PRIV<br/>    }<br/>    private user_privilege_mode = Cisco_ENUMUserPrivilegeState.USER<br/><br/>    private Expect cli<br/><br/>    private prompt = ""<br/>    private mode = ">"<br/>    private full_prompt = ""<br/><br/>    // The following variables are set to show what type of IOS device we have, based off the sysinfo property.<br/>    private sysinfo = null<br/>    private isCisco_ASA = false<br/>    private isCisco_WAAS = false<br/>    private isCisco_c6800 = false<br/>    private isCisco_Cat_3750 = false<br/>    private isCisco_Cat = false<br/>    private isCisco_PIX = false<br/>    private isCisco_Standard = false<br/><br/>    private enum CiscoModel {<br/>        STANDARD, ASA, WAAS, CATALYST, CATALYST_3750, PIX, C6800<br/>    }<br/>    private CiscoModel cisco_model<br/><br/>    private raw_show_output = null<br/>    private show_entries = null<br/><br/>    private use_ssh = true              // We'll assume ssh unless otherwise specified.<br/>    private telnet_port = "23"<br/><br/>    private connected = false             // Describes the current device ssh connectivity state.<br/>    private script_timeout = 60                // seconds<br/>    private max_conn_attempts = 3                 // Attempt the ssh connection this many times after failure.<br/>    private conn_attempt_pause = 5                 // Seconds to pause between ssh connection attempts.<br/><br/>    private error_message = null<br/>    // Get's populated with the last critical error.  Used by the init method when throwing an exception<br/><br/><br/>    CiscoIOSDevice(hostProps) {<br/>        if (!init(hostProps)) {<br/>            if (error_message) {<br/>                throw new RuntimeException("Initialization process failed!  Reason: \"${error_message}\".\n\n")<br/>            }<br/>            else {<br/>                throw new RuntimeException("Initialization process failed!\n\n")<br/>            }<br/>        }<br/>    }<br/><br/>    /**<br/>     * Called by the Class Constructor, this is the main 'loop' that calls the necessary methods to make a successful connection<br/>     * to the device.  It is also responsible for multi-attempt logic.<br/>     * @param hostProps The hostProps object retrieved from the CollectorDB, and used to extract necessary device properties<br/>     * @return TRUE if successful.  FALSE otherwise.<br/>     */<br/>    private boolean init(hostProps) {<br/>        this.hostProps = hostProps<br/>        get_lm_props()<br/>        Cisco_DetermineIOSDeviceType()<br/><br/>        def conn_attempt_num = 1<br/>        connected = false<br/><br/>        while (!connected && conn_attempt_num < (max_conn_attempts + 1)) {<br/>            // Attempt to connect to the device.  If we fail, and the failure occurs after connectivity is established,<br/>            // we want to disconnect from the device.  This is typically means we received a "Permission denied" error.<br/>            if (!Cisco_ConnectToDevice()) {<br/>                if (connected) {<br/>                    Cisco_LogoutDevice()<br/>                }<br/>                error_message = "Could not establish ssh session with host"<br/>            }<br/><br/>            // Check if we are within a parser view.<br/>            if (connected) {<br/>                Cisco_ShowParserView()<br/>            }<br/><br/>            //if ( connected && !escalate_device_privs() ) {<br/>            if (connected && !Cisco_EscalateDevicePrivileges()) {<br/>                if (connected) {<br/>                    Cisco_LogoutDevice()<br/>                }<br/>                error_message = "Could not properly escalate privileges on the device.  Ensure that 'ssh.enable.pass' property has been set for the device if necessary"<br/>            }<br/><br/>            if (connected && !Cisco_SetTerminal()) {<br/>                if (connected) {<br/>                    Cisco_LogoutDevice()<br/>                }<br/>            }<br/><br/>            if (!connected) {<br/>                conn_attempt_num++<br/>                sleep(conn_attempt_pause * 1000)<br/>            }<br/>        }<br/><br/>        return connected && escalated_privs<br/>    }<br/><br/>    private get_lm_props() {<br/>        // Grab all the hostProp entries<br/>        def propKeys = this.hostProps.keySet()<br/><br/>        // Iterate over the hostProp entries, determining what values we have set<br/>        propKeys.each { key -><br/>            switch (key.toLowerCase()) {<br/>                case ~/^config\.forceview$/:<br/>                    if(this.hostProps.get(key).toLowerCase() == "true") {<br/>                        this.parser_view = true;<br/>                    }<br/>                    break<br/>                case ~/^system\.hostname$/:<br/>                    this.host = this.hostProps.get(key)<br/>                    break<br/>                case ~/ssh\.user$/:<br/>                    this.creds.put this.hostProps.get(key).toString(), this.hostProps.get("ssh.pass")<br/>                    if (!this.enable_pass.contains(this.hostProps.get("ssh.pass"))) {<br/>                        this.enable_pass.add(this.hostProps.get("ssh.pass"))<br/>                    }<br/>                    break<br/>                case ~/config\.user$/:<br/>                    this.creds.put this.hostProps.get(key).toString(), this.hostProps.get("config.pass")<br/>                    if (!this.enable_pass.contains((this.hostProps.get("config.pass")))) {<br/>                        this.enable_pass.add(this.hostProps.get("config.pass"))<br/>                    }<br/>                    break<br/>                case ~/ssh\.enable\.pass$/:<br/>                    if (!this.enable_pass.contains((this.hostProps.get("ssh.enable.pass")))) {<br/>                        this.enable_pass = ["${this.hostProps.get("ssh.enable.pass")}", *this.enable_pass]<br/>                    }<br/>                    break<br/>                case ~/config\.enable\.pass$/:<br/>                    if (!this.enable_pass.contains((this.hostProps.get("config.enable.pass")))) {<br/>                        this.enable_pass = ["${this.hostProps.get("config.enable.pass")}", *enable_pass]<br/>                    }<br/>                    break<br/>                case ~/^system\.sysinfo$/:<br/>                    this.sysinfo = this.hostProps.get(key)<br/>                    break<br/>                case ~/^(config|ssh)\.enable\.level$/:<br/>                    this.enable_level = this.hostProps.get(key)<br/>                    break<br/>                case ~/^configsource\.use\.telnet$/:<br/>                    if (this.hostProps.get(key) == "1" || this.hostProps.get(key) == "true" || this.hostProps.get(key) == "yes") {<br/>                        this.use_ssh = false<br/>                    }<br/>                    break<br/>                case ~/^configsource\.telnet\.port/:<br/>                    this.telnet_port = this.hostProps.get(key)<br/>                    break<br/>                case ~/^configsource\.script\.timeout/:<br/>                    this.script_timeout = (this.hostProps.get(key).toInteger() > 0 && this.hostProps.get(key).toInteger() <= 300) ? this.hostProps.get(key).toInteger() : 60<br/>                    break<br/>            }<br/>        }<br/><br/>        /*<br/>         * In this section of code, we test the values of host, user, and pass -- ensuring<br/>         * they did indeed get set.  If not, the script will certainly fail, so catch it<br/>         * now and provide a useful error message.<br/>         */<br/>        if (!this.host) {<br/>            System.err << "(debug::fatal) Could not retrieve the system.hostname value.  Exiting."<br/>            return false<br/>        }<br/><br/>        if (this.creds.isEmpty()) {<br/>            System.err << "(debug::fatal) Could not retrieve the ssh.user/ssh.pass device property.  This is required for authentication.  Exiting."<br/><br/>            return false<br/>        }<br/><br/>        return true<br/>    }<br/><br/>    /**<br/>     * Takes the SYSINFO value from hostProps and attempts to determine what sort of underlying IOS platform we are working with.<br/>     * Some devices behave differently and thus require different logic.<br/>     * @return<br/>     */<br/>    private Cisco_DetermineIOSDeviceType() {<br/>        switch (this.sysinfo.trim()) {<br/>            case { it.startsWith("Cisco Adaptive Security Appliance") }:<br/>                this.isCisco_ASA = true<br/>                this.cisco_model = CiscoModel.ASA<br/>                break<br/>            case { it.startsWith("Cisco Wide Area Application Services") }:<br/>                this.isCisco_WAAS = true<br/>                this.cisco_model = CiscoModel.WAAS<br/>                break<br/>            case { it.startsWith("Cisco IOS Software, c68") }:<br/>                this.isCisco_c6800 = true<br/>                this.cisco_model = CiscoModel.C6800<br/>                break<br/>            case { it.contains("C3750") }:<br/>                this.isCisco_Cat_3750 = true<br/>                this.cisco_model = CiscoModel.CATALYST_3750<br/>                break<br/>            case ~/^(?:Cisco )?IOS Software(?:\s\[.*\])?,?\s*Catalyst.*, .*Version\s+(.*)/:<br/>                this.isCisco_Cat = true<br/>                this.isCisco_Standard = true<br/>                break<br/>            case { it.startsWith("Cisco IOS") }:<br/>                this.isCisco_Standard = true<br/>                break<br/>            case { it.contains("Cisco PIX") }:<br/>                this.isCisco_PIX = true<br/>                break<br/>            default:<br/>                this.isCisco_Standard = true<br/>                break<br/>        }<br/>    }<br/><br/>    /**<br/>     * This method is responsible for establishing the connection to a device.<br/>     * @return TRUE if successful.  FALSE otherwise<br/>     */<br/>    private boolean Cisco_ConnectToDevice() {<br/>        def err_state = true<br/>        if (this.use_ssh) {<br/>            // open an ssh connection and wait for the prompt<br/>            this.creds.each { lm_username, lm_password -><br/>                try {<br/>                    if (err_state) {<br/>                        this.cli = Expect.open(this.host, lm_username, lm_password, this.script_timeout)<br/>                        err_state = false<br/>                    }<br/>                }<br/>                catch (Exception all) {<br/>                    return false<br/>                }<br/>            }<br/><br/>            if (this.cli == null) {<br/>                return false<br/>            }<br/>        }<br/>        else {<br/>            this.creds.each { lm_username, lm_password -><br/>                // telnet session<br/>                try {<br/>                    if (err_state) {<br/>                        this.cli = Expect.open(this.host, this.telnet_port.toInteger(), this.script_timeout)<br/>                        err_state = false<br/>                        this.cli.expect("Username:")<br/>                        this.cli.send(lm_username + "\n")<br/>                        this.cli.expect("Password:")<br/>                        this.cli.send(lm_password + "\n")<br/>                    }<br/>                }<br/>                catch (Exception all) {<br/>                    return false<br/>                }<br/>            }<br/>        }<br/><br/>        // Let's ensure that the cli object was created OR that we have performed the previous methods without exiting an error state.<br/>        // This ensures that the script doesn't continue on if connectivity was not established, returning control back to the retry loop.<br/>        if (this.cli == null || err_state) {<br/>            return false<br/>        }<br/><br/>        // Connection successfully established<br/>        connected = true<br/><br/>        /* INITIAL MATCH ----------------------------------------------------------------------------------------------------------------------------<br/>            In order to accommodate ascii art banners and such, we need essentially look for the last line sent to us after connection.<br/>            Everything before that tends to be noise.<br/>         */<br/><br/>        def raw_prompt_line = ""<br/><br/>        try {<br/>            // The following expect method should match on most any cisco ios device prompt.  Later we can take this value and parse it for the prompt<br/>            this.cli.expect('[a-zA-Z0-9\\-\\_\\.\\/]+[>#][\\s+]?\$')<br/>            this.cli.send("\n")<br/>            this.cli.expect('[a-zA-Z0-9\\-\\_\\.\\/]+[>#][\\s+]?\$')<br/><br/>            // TODO: move this over to precompiled regex matchers<br/>            raw_prompt_line = ("${this.cli.matched()}" =~ /([a-zA-Z0-9\-_\.\/]+[>#])[\s+]?$/)[0][1]<br/><br/>        }<br/>        catch (Exception all) {<br/>            return false<br/>        }<br/><br/>        /* -- PROMPT DETECTION ---------------------------------------------------------------------------------------------------------------------<br/>            We have progressed this far, we should be able to deconstruct the prompt line into 'prompt' and 'mode'<br/>        */<br/><br/>        try {<br/>            this.prompt = raw_prompt_line[0..-2]<br/>            this.mode = raw_prompt_line[-1]<br/>            this.full_prompt = this.prompt + this.mode<br/>        }<br/>        catch (Exception all) {<br/>            return false<br/>        }<br/><br/>        // Check to see what the previous expect command matched.  This will us which user mode we have been dropped into.<br/>        if (this.mode == "#") {<br/>            this.priv_exec_mode = true<br/>        }<br/><br/>        return true<br/><br/>    }<br/><br/>    /**<br/>     * This method will attempt to escalate our user privileges to PRIV<br/>     * @return boolean          Will return TRUE if successful; FALSE otherwise.<br/>     */<br/>    private boolean Cisco_EscalateDevicePrivileges() {<br/>        if (this.user_privilege_mode == Cisco_ENUMUserPrivilegeState.PRIV) {<br/>            this.escalated_privs = true; return true<br/>        }<br/>        if (this.priv_exec_mode) {<br/>            escalated_privs = true; return true<br/>        }<br/><br/>        def exit_loop = false<br/>        def password_position = 0<br/><br/>        while (!exit_loop) {<br/>            def response<br/>            if (password_position == 0) {<br/>                this.cli.send("enable\n")<br/>            }<br/><br/>            try {<br/>                this.cli.expect("[Pp]assword:", "${prompt}\\s*#", full_prompt)<br/>                response = this.cli.matched()<br/>            }<br/>            catch (Exception e) { }<br/><br/>            if (response =~ /${this.prompt}\s*#/) {<br/>                this.mode = "#"<br/>                this.full_prompt = Pattern.quote(response)<br/>                this.priv_exec_mode = true<br/>                this.user_privilege_mode = Cisco_ENUMUserPrivilegeState.PRIV<br/>                this.escalated_privs = true<br/>                exit_loop = true<br/>            }<br/>            else {<br/>                this.cli.send(enable_pass[password_position] + "\n")<br/>            }<br/><br/>            if (password_position == enable_pass.size()) {<br/>                exit_loop = true<br/>            }<br/>            else {<br/>                password_position++<br/>            }<br/>        }<br/><br/>        return (this.user_privilege_mode == Cisco_ENUMUserPrivilegeState.PRIV)<br/>    }<br/><br/>    private Cisco_SetTerminal() {<br/>        try {<br/>            if (this.isCisco_WAAS || this.isCisco_Standard || this.isCisco_c6800 || this.isCisco_Cat_3750) {<br/>                this.cli.send("terminal length 0\n")<br/>                this.cli.expect(this.full_prompt)<br/>                this.cli.send("terminal width 0\n")<br/>                this.cli.expect("${this.full_prompt}\\s*\$")<br/>            }<br/>            else {<br/>                this.cli.send("terminal pager 0\n")<br/>                this.cli.expect("${this.full_prompt}\\s*\$")<br/>            }<br/>        }<br/>        catch (Exception all) {<br/>            return false<br/>        }<br/><br/>        return true<br/>    }<br/><br/>    private Cisco_ShowParserView() {<br/>        try {<br/>            this.cli.send("show parser view\n")<br/>            this.cli.expect(this.full_prompt, "No view is active")<br/>            this.cli.before()<br/>        }<br/>        catch (Exception all) {<br/>            return false<br/>        }<br/><br/>        if (this.cli.before().toString().contains("Current view is")) {<br/>            this.parser_view = true<br/>        }<br/>    }<br/><br/>    def Cisco_GetShowCommands() {<br/>        this.cli.send("show ?")<br/><br/>        try {<br/>            if (this.isCisco_ASA || this.isCisco_PIX) {<br/>                this.cli.expect("${this.full_prompt} show")<br/>            }<br/>            else if (this.isCisco_WAAS || this.isCisco_c6800) {<br/>                this.cli.expect(this.full_prompt)<br/>            }<br/>            else {<br/>                this.cli.expect("${this.full_prompt}show")<br/>            }<br/>        }<br/>        catch (Exception all) {<br/>            return false<br/>        }<br/><br/>        try {<br/>            this.raw_show_output = this.cli.before()<br/>        }<br/>        catch (Exception all) {<br/>            return false<br/>        }<br/><br/>        return this.raw_show_output<br/>    }<br/><br/>    def Cisco_ParseShowCommands() {<br/>        this.raw_show_output.eachLine() { line -><br/>            if (!show_entries) {<br/>                show_entries = [:]<br/>            }<br/><br/>            switch (line.trim()) {<br/>                case { it.isEmpty() }:<br/>                    break<br/>                case { it.startsWith("show ?") }:<br/>                    break<br/>                case { it.startsWith(this.full_prompt) }:<br/>                    break<br/>                default:<br/>                    try {<br/>                        def cmd = line.trim().tokenize()[0]<br/>                        def desc = line.trim().tokenize()[1..-1].join(" ")<br/>                        this.show_entries << ["${cmd}": "${desc.trim()}"]<br/>                    }<br/>                    catch (all) {<br/>                        // some sort of odd output.  ignore.<br/>                        break<br/>                    }<br/>            }<br/>        }<br/>    }<br/><br/>    def LM_getActiveDiscoveryOutput(desired_show_commands) {<br/>        // Need to ensure that we are actually connected to the device before proceeding<br/>        if (!connected) {<br/>            return false<br/>        }<br/><br/>        def output = ""<br/><br/>        if (!this.raw_show_output) {<br/>            this.Cisco_GetShowCommands()<br/>        }<br/>        if (!this.show_entries) {<br/>            this.Cisco_ParseShowCommands()<br/>        }<br/><br/>        this.show_entries.each { key, value -><br/>            if (desired_show_commands.contains(key.toString())) {<br/>                output += "${key}##${key}##${value}\n"<br/>            }<br/>        }<br/><br/>        return output<br/>    }<br/><br/>    def LM_getCollectionOutput(show_operator) {<br/>        // Need to ensure that we are actually connected to the device before proceeding<br/>        if (!connected) {<br/>            return false<br/>        }<br/><br/>        def output = ""<br/>        def response = null<br/><br/>        // In the event that we are within a parser view, we need to add 'view full' to a 'running-config' request.<br/>        if (parser_view && show_operator == "running-config") {<br/>            show_operator += " view full"<br/>        }<br/><br/>        def conn_attempt_num = 1<br/><br/>        while ((conn_attempt_num < (this.max_conn_attempts + 1)) && response == null) {<br/>            conn_attempt_num++<br/><br/>            // Send the requested show command to the device<br/>            if (this.isCisco_c6800 || this.isCisco_Cat_3750 || this.isCisco_PIX || this.isCisco_ASA || this.isCisco_Cat) {<br/>                if (this.escalated_privs) {<br/>                    this.cli.send("show ${show_operator}\nexit\nexit\n")<br/>                }<br/>                else {<br/>                    this.cli.send("show ${show_operator}\nexit\n")<br/>                }<br/>            }<br/>            else {<br/>                this.cli.send("show ${show_operator}\n")<br/>            }<br/><br/>            // Attempt to match<br/>            try {<br/>                if (isCisco_c6800 || isCisco_Cat_3750 || this.isCisco_PIX || this.isCisco_ASA) {<br/>                    this.cli.expectClose()<br/><br/>                    response = this.cli.stdout()<br/>                }<br/>                else {<br/>                    // Match prompt on a line by itself with or without surrounding whitespace.<br/>                    // Obviate case where config returns with embedded prompt and terminates<br/>                    // the config prematurely.<br/>                    this.cli.expect(/^\s*${this.full_prompt}\s*$/)<br/><br/>                    response = this.cli.before()<br/>                }<br/>            }<br/>            catch (Exception all) { }<br/>        }<br/><br/>        response = response.trim()<br/><br/>        try {<br/>            def found_current_config_entry = true<br/><br/>            if (this.isCisco_c6800 || this.isCisco_Cat_3750 || this.isCisco_PIX || this.isCisco_ASA) {<br/>                found_current_config_entry = false<br/>            }<br/><br/>            response.eachLine() { line -><br/>                switch (line) {<br/>                    case ~/^(.show|show) ${show_operator}/:<br/>                        if (!found_current_config_entry) {<br/>                            found_current_config_entry = true<br/>                        }<br/>                        break<br/>                    case ~/^: Saved/:<br/>                        if (!found_current_config_entry) {<br/>                            found_current_config_entry = true<br/>                        }<br/>                        output += "${line}\n"<br/>                        break<br/>                    case ~/^${full_prompt}\s?show ${show_operator}.*/:<br/>                        if (!found_current_config_entry) {<br/>                            found_current_config_entry = true<br/>                        }<br/>                        break<br/>                    case ~/^Building configuration.*/:<br/>                        break<br/>                    case ~/.+\d+ (day|days|hour|hours|year|years|week|weeks|minute|minutes).*/:<br/>                        break<br/>                    case ~/(^[Ss]witch\s|^)[Uu]ptime.*/:<br/>                        break<br/>                    case ~/^${full_prompt}.*/:<br/>                        break<br/>                    case ~/^(Current configuration|Using \d+ out of \d+ bytes).*/:<br/>                        found_current_config_entry = true<br/>                        break<br/>                    case ~/^ntp clock-period.*/:<br/>                        break<br/>                    case ~/^Logoff/:<br/>                        break<br/>                    case ~/^Load for five secs.*/:<br/>                        break<br/>                    case ~/^Time source is.*/:<br/>                        break<br/>                    case ~/^\w+\s+\w+\s+\d+\s\d+:\d+:\d+\.\d+\s+\w+/:<br/>                        break<br/>                    default:<br/>                        if (found_current_config_entry) {<br/>                            output += "${line}\n"<br/>                        }<br/>                        break<br/>                }<br/>            }<br/>        }<br/>        catch (Exception all) { }<br/><br/>        return output<br/>    }<br/><br/>    def Cisco_LogoutDevice() {<br/>        // If we were never connected, just return true.  Most likely poor logic that allowed us to call this method even though we never established a connection.<br/>        if (!connected) {<br/>            return true<br/>        }<br/><br/>        if (this.isCisco_c6800 || this.isCisco_Cat_3750 || this.isCisco_PIX || this.isCisco_ASA || this.isCisco_Cat) {<br/>            return true<br/>        } // The c6800 and Catalyst 3750 series routines will have already exited the device.<br/><br/>        // logout from the device<br/>        if (this.escalated_privs) {<br/>            this.cli.send("\nexit\nexit\n")<br/>            this.cli.expect("\$")<br/>        }<br/>        else {<br/>            this.cli.send("\nexit\n");<br/>            this.cli.expect("#", "${this.full_prompt}exit")<br/>        }<br/><br/>        connected = false<br/><br/>        // close the ssh connection handle then print the config<br/>        try {<br/>            this.cli.expectClose()<br/>        }<br/>        catch (Exception all) {<br/>            return false<br/>        }<br/>    }<br/>}