hacktricks/network-services-pentesting/4786-cisco-smart-install.md

# 4786 - Cisco Smart Install

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>

{% embed url="https://websec.nl/" %}

## Basic Information

**Cisco Smart Install** ni Cisco iliyoundwa ili kuharakisha usanidi wa awali na kupakia picha ya mfumo wa uendeshaji kwa vifaa vipya vya Cisco. **Kwa default, Cisco Smart Install inafanya kazi kwenye vifaa vya Cisco na inatumia protokali ya safu ya usafirishaji, TCP, yenye nambari ya bandari 4786.**

**Bandari ya default:** 4786
```
PORT      STATE  SERVICE
4786/tcp  open   smart-install
```
## **Smart Install Exploitation Tool**

**Mnamo mwaka wa 2018, udhaifu muhimu, CVE-2018–0171, ulipatikana katika protokali hii. Kiwango cha tishio ni 9.8 kwenye kiwango cha CVSS.**

**Pakiti iliyoundwa kwa njia maalum iliyotumwa kwenye bandari ya TCP/4786, ambapo Cisco Smart Install inafanya kazi, inasababisha overflow ya buffer, ikimruhusu mshambuliaji:**

* kulazimisha kurestart kifaa
* kuita RCE
* kuiba mipangilio ya vifaa vya mtandao.

**The** [**SIET**](https://github.com/frostbits-security/SIET) **(Smart Install Exploitation Tool)** ilitengenezwa ili kutumia udhaifu huu, inakuwezesha kutumia Cisco Smart Install. Katika makala hii nitakuonyesha jinsi unavyoweza kusoma faili halali ya mipangilio ya vifaa vya mtandao. Mipangilio ya exfiltration inaweza kuwa ya thamani kwa pentester kwa sababu itajifunza kuhusu sifa za kipekee za mtandao. Na hii itarahisisha maisha na kuruhusu kupata njia mpya za shambulio.

**Kifaa cha lengo kitakuwa swichi ya “live” ya Cisco Catalyst 2960. Picha za virtual hazina Cisco Smart Install, hivyo unaweza tu kufanya mazoezi kwenye vifaa halisi.**

Anwani ya swichi ya lengo ni **10.10.100.10 na CSI inafanya kazi.** Pakia SIET na anza shambulio. **The -g argument** inamaanisha exfiltration ya mipangilio kutoka kwa kifaa, **the -i argument** inakuwezesha kuweka anwani ya IP ya lengo lenye udhaifu.
```
~/opt/tools/SIET$ sudo python2 siet.py -g -i 10.10.100.10
```
<figure><img src="../.gitbook/assets/image (773).png" alt=""><figcaption></figcaption></figure>

Usanidi wa swichi **10.10.100.10** utakuwa katika folda **tftp/**

<figure><img src="../.gitbook/assets/image (1116).png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>

{% embed url="https://websec.nl/" %}

{% hint style="success" %}
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.

</details>
{% endhint %}