312-50V11 · Question #91
The network administrator at Spears Technology, Inc has configured the default gateway Cisco router's access-list as below: You are hired to conduct security testing on their network. You…
The correct answer is B. Run a network sniffer and capture the returned traffic with the configuration file from the router D. Send a customized SNMP set request with a spoofed source IP address in the range - 192.168.1.0. This question covers bypassing a Cisco router ACL to retrieve its configuration after brute-forcing the SNMP community string. Two viable techniques are passive traffic capture and SNMP requests with a spoofed permitted source IP.
Question
The network administrator at Spears Technology, Inc has configured the default gateway Cisco router's access-list as below:
You are hired to conduct security testing on their network. You successfully brute-force the SNMP community string using a SNMP crack tool. The access-list configured at the router prevents you from establishing a successful connection. You want to retrieve the Cisco configuration from the router. How would you proceed?
Options
- AUse the Cisco's TFTP default password to connect and download the configuration file
- BRun a network sniffer and capture the returned traffic with the configuration file from the router
- CRun Generic Routing Encapsulation (GRE) tunneling protocol from your computer to the router
- DSend a customized SNMP set request with a spoofed source IP address in the range - 192.168.1.0
How the community answered
(42 responses)- A12% (5)
- B55% (23)
- C33% (14)
Why each option
This question covers bypassing a Cisco router ACL to retrieve its configuration after brute-forcing the SNMP community string. Two viable techniques are passive traffic capture and SNMP requests with a spoofed permitted source IP.
Cisco routers have no built-in or default TFTP password for configuration retrieval - TFTP access is governed by ACLs and the router's running configuration, not a static default credential.
Even when the ACL blocks the attacker's direct connections, SNMP UDP response packets carrying configuration data still traverse the network. By placing a network sniffer on the local segment, the attacker passively captures these response packets and reconstructs the Cisco configuration without ever needing a permitted inbound connection.
Establishing a GRE tunnel requires the router to accept and process a control-plane connection from the attacker, which is precisely what the ACL is blocking - GRE does not circumvent Layer 3 access-list enforcement on the device itself.
The router ACL permits SNMP traffic only from the 192.168.1.0 subnet. By crafting an SNMP set request with a spoofed source IP from within that allowed range, the attacker's packet matches the ACL permit rule, causing the router to process it as if it originated from a trusted host and respond with configuration data.
Concept tested: SNMP exploitation and ACL bypass via IP spoofing
Source: https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/13736-snmp-community.html
Topics
Community Discussion
No community discussion yet for this question.