312-50V10 · Question #91
The network administrator at Spears Technology, Inc has configured the default gateway Cisco router's access-list as below: You are hired to conduct security testing on their network. You…
The correct answer is B. Run a network sniffer and capture the returned traffic with the configuration file from the router D. Send a customized SNMP set request with a spoofed source IP address in the range - 192.168.1.0. An attacker who has brute-forced an SNMP community string can bypass an IP-based ACL by spoofing a permitted source address, then capture the TFTP-transmitted configuration using a packet sniffer.
Question
The network administrator at Spears Technology, Inc has configured the default gateway Cisco router's access-list as below:
You are hired to conduct security testing on their network. You successfully brute-force the SNMP community string using a SNMP crack tool. The access-list configured at the router prevents you from establishing a successful connection. You want to retrieve the Cisco configuration from the router. How would you proceed?
Options
- AUse the Cisco's TFTP default password to connect and download the configuration file
- BRun a network sniffer and capture the returned traffic with the configuration file from the router
- CRun Generic Routing Encapsulation (GRE) tunneling protocol from your computer to the router
- DSend a customized SNMP set request with a spoofed source IP address in the range - 192.168.1.0
How the community answered
(38 responses)- A26% (10)
- B58% (22)
- C16% (6)
Why each option
An attacker who has brute-forced an SNMP community string can bypass an IP-based ACL by spoofing a permitted source address, then capture the TFTP-transmitted configuration using a packet sniffer.
Cisco routers do not have a default TFTP password - TFTP is an unauthenticated protocol and does not use passwords to protect file access.
When the router is instructed via SNMP to send its configuration over TFTP, that traffic traverses the network in cleartext UDP packets. A sniffer positioned on the network path can capture those packets and reconstruct the full Cisco configuration file.
GRE tunneling encapsulates packets for point-to-point transport but does not bypass ACL source-IP filtering or provide a mechanism to extract the router configuration.
SNMP ACLs filter traffic based on source IP address, so spoofing a source IP within the permitted range (192.168.1.0/24) allows the attacker to bypass the ACL and leverage the cracked community string. Once access is established, an SNMP set request can instruct the router to upload its configuration file to a TFTP target.
Concept tested: SNMP ACL bypass via IP spoofing and packet capture
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-16/snmp-xe-16-book/nm-snmp-cfg-snmp-support.html
Topics
Community Discussion
No community discussion yet for this question.