CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
Path: blob/master/documentation/modules/auxiliary/scanner/snmp/cisco_upload_file.md
Views: 1904
Vulnerable Application
Cisco IOS devices can be configured to retrieve, via tftp, a file via SNMP. This is a well documented feature of IOS and many other networking devices, and is part of an administrator functionality. This functionality can also be used to change their running configuration. This is documented here. A read-write community string is required, as well as a tftp server (metasploit includes one). The default functionality of the module will upload the file and it will be saved to flash:. The Override_Config action will override the running configuration of the device and the file will not be saved.
Verification Steps
Upload_File (Default Action)
Enable SNMP with a read/write community string on IOS:
snmp-server community private rwStart msfconsole
Do:
use auxiliary/scanner/snmp/cisco_upload_fileDo:
set COMMUNITY [read-write snmp]Do:
set lhost [your IP address]Do:
set rhosts [ip]Do:
set source [file]Do:
run
Override_Config
Enable SNMP with a read/write community string on IOS:
snmp-server community private rwStart msfconsole
Do:
use auxiliary/scanner/snmp/cisco_upload_fileDo:
set COMMUNITY [read-write snmp]Do:
set lhost [your IP address]Do:
set rhosts [ip]Do:
set source [file]Do:
set action [Override_Config]Do:
runYou can Verify that the running config has been overridden by using the auxiliary/scanner/snmp/cisco_config_tftp module to download the current running config from the device.
Options
COMMUNITY
The SNMP community string to use which must be read-write. Default is public.
SOURCE
The location of the source file to be uploaded to the Cisco device.