hacktricks/network-services-pentesting/4786-cisco-smart-install.md

# 4786 - Cisco Smart Install

<details>

<summary><strong>htARTE (HackTricks AWS Red Team Expert)</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>!</strong></a><strong>DaH jImej</strong></summary>

* **Do you work in a cybersecurity company?** **Do you want to see your company advertised in HackTricks?** **or do you want to have access to the latest version of the PEASS or download HackTricks in PDF?** **Check the SUBSCRIPTION PLANS!** **(https://github.com/sponsors/carlospolop)**
* **Discover The PEASS Family, our collection of exclusive NFTs** **(https://opensea.io/collection/the-peass-family)**
* **Get the official PEASS & HackTricks swag** **(https://peass.creator-spring.com)**
* **Join the 💬 Discord group or the telegram group or follow me on Twitter @carlospolopm** **(https://discord.gg/hRep4RUj7f)**
* **Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo** **(https://github.com/carlospolop/hacktricks)**

</details>

## Basic Information

**Cisco Smart Install** **Cisco hardware** **Cisco Smart Install is active on Cisco hardware and uses the transport layer protocol, TCP, with port number 4786.**

**Default port:** 4786
```
PORT      STATE  SERVICE
4786/tcp  open   smart-install
```
## **Smart Install Exploitation Tool**

**2018 vItlhutlh, 'ej vItlhutlh vulnerability, CVE-2018–0171, 'oH found vaj this protocol. The threat level is 9.8 on the CVSS scale.**

**A specially crafted packet sent to the TCP/4786 port, where Cisco Smart Install is active, triggers a buffer overflow, allowing an attacker to:**

* forcibly reboot the device
* call RCE
* steal configurations of network equipment.

**The** [**SIET**](https://github.com/frostbits-security/SIET) **(Smart Install Exploitation Tool)** was developed to exploit this vulnerability, it allows you to abuse Cisco Smart Install. In this article I will show you how you can read a legitimate network hardware configuration file. Configure exfiltration can be valuable for a pentester because it will learn about the unique features of the network. And this will make life easier and allow finding new vectors for an attack.

**The target device will be a “live” Cisco Catalyst 2960 switch. Virtual images do not have Cisco Smart Install, so you can only practice on the real hardware.**

The address of the target switch is **10.10.100.10 and CSI is active.** Load SIET and start the attack. **The -g argument** means exfiltration of the configuration from the device, **the -i argument** allows you to set the IP address of the vulnerable target.
```
~/opt/tools/SIET$ sudo python2 siet.py -g -i 10.10.100.10
```
<figure><img src="../.gitbook/assets/image (302).png" alt=""><figcaption></figcaption></figure>

The switch configuration **10.10.100.10** will be in the **tftp/** folder

<figure><img src="../.gitbook/assets/image (73).png" alt=""><figcaption></figcaption></figure>

<details>

<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.

</details>