Downloaded 50 times
Uploaded bySensePost
SNMP : Simple Network Mediated (Cisco) Pwnage
The document discusses the vulnerabilities of the Simple Network Management Protocol (SNMP) in Cisco devices, highlighting its use for network monitoring and management. It outlines potential security risks, including information disclosure and exploitation through misconfigurations, particularly focusing on weak community strings. The document also introduces a tool called Frisk-0 for exploiting these vulnerabilities and offers recommendations for securing SNMP-enabled devices.
More Related Content
Similar to SNMP : Simple Network Mediated (Cisco) Pwnage
SNMP : Simple Network Mediated (Cisco) Pwnage
- 1. SNMP Simple Network Mediated(Cisco) Pwnage Georg-Christian Pranschke 9 October 2010
- 2. `whoami` george@sensepost.com “Cheorchie”
- 3. Agenda How it all began… SNMP ? SNMP from a Security Perspective SNMP on Cisco Appliances Exploiting SNMP Misconfigurations Frisk-0 Secure your SNMP enabled devices Questions
- 4. A Long TimeAgo…
- 5. How it allbegan…
- 6.
- 7. SNMP ? Simple Network Management Protocol Monitor and manage devices on the network Routers Switches Bridges Hubs IP phones and cameras Printers Computers
- 8. SNMP ? UDP: 161 / 162 Manager Agent Concepts MIB – Message Information Block OID – Object Identifier PDU – Protocol Data Unit Versions 1 and 2c vs 3
- 9. SNMP ? Community strings Think passwords Read/write
- 10. SNMP from aSecurity Perspective
- 11. SNMP from aSecurity Perspective Plain-text protocol UDP Spoofing Get/Set-responses contain community string Community Strings Defaults: public, private, admin, snmp, snmpd … Weak Communities: 3 characters !!! Reuse Community schemes User awareness
- 12. SNMP from aSecurity Perspective Information Disclosure Internal IP Addresses Routing Information Running Processes Running Services Installed Software Usernames Hardware Compromise
- 13.
- 14. Cisco Appliances S N M P TELNET SSH H T T P
- 15. Brute Forcing CiscoAppliances TELNET Often only password required Only three tries – then reconnect Enable password needs to be brute forced as well SSH Needs username and password (ssh -1) Only three tries per connection Enable password needs to be brute forced as well HTTP(S) Basic Authentication Fastest so far No enable password
- 16. Brute Forcing CiscoAppliances SNMP Almost as fast as we can send UDP packets ! Just community string needed ! Privileged access to the device !
- 17. SNMP on CiscoAppliances Remote Configuration through SNMP Setting OIDs Configuration up- and downloads via TFTP Running config vs Startup config
- 18. The Vigenere Cipher Variation of a Caesar Cipher Why such a weak cipher ? Obfuscation at best
- 19.
- 20. If the RWcommunity is known…
- 21.
- 22.
- 23. Frisk-0 ”Rogue Management Interface” Brute forces community strings Downloads Running and Startup configurations Extracts and decrypts all passwords and hashes Batch mode From targets file Network ranges Spoofing capabilities “Configlets” (enable TELNET / reset passwords) Fully automated and unattended
- 24.
- 25. The GREnd Finale GRE – Generic Routing Encapsulation
- 26. Secure your SNMPenabled devices
- 27. Secure Your SNMPEnabled Devices Do you really need SNMP ? Do you really need a RW community ? Set strong community strings 40+ characters ? Why not! Access-lists SNMP TFTP ! (spoofing) UDP
- 28.