So I'll introduce you to the last example of compromising SNP.
Let's try to grab the SNP configuration of the Cisco router using Metasploit framework.
Metasploit project is the most used penetration testing framework of, well, the whole world.
It can be used to test the vulnerability of computer systems or break into remote systems.
Its best known sub project is the open source Metasploit framework.
That's a tool for developing and executing exploit code against a remote target machine.
So here we have our network prepared by Gns3.
Again, we'll perform this demo on this network because look at that.
It's right here.
So go to Cali and open a terminal screen.
Type MSF console and press enter to start Metasploit framework's console application.
So now we have a shell like MSF environment.
We can run the MSF console commands in this environment.
Now because it's the subject of exploitation and post exploitation course that I did.
I won't go into deep detail about Metasploit right now, but I will talk about some certain applicable
points.
We'll use a module to collect the configuration of the router.
I don't remember the exact name of it, so why don't we search for Cisco and config keywords?
We find an auxiliary module.
Auxiliary modules are not to exploit a vulnerability, but to gather some information and to help the
pentester figure out the systems and the vulnerabilities.
So use the use keyword with the entire module name.
Command prompt is changed as the module name now.
Type show options to see the options we should set before running the module.
The community option is required and is public by default.
But let's set it as private.
Set output directory option to save the results in a file.
So I'll choose the desktop as the output directory.
Now set the remote host the IP address of the target router.
Our port is 161 by default, which is definitely okay with us and leave the other options with the default
values.
Now we're ready.
Type run to run the module.
Auxiliary module execution completed and the configuration file is saved to the output directory in
this example, of course to the desktop.
So here's the file.
Double click it to open it.
Welcome to the configuration of the router.
We don't have any credential on our router yet, so let's close the file now.
Go to the router console and create a user.
Then collect the config file again and just see how a user is saved in the config file.
So I'm in the Gns3 emulator and my host system, which is a mac, and I'll go to the console of the
router and just create a user.
Of course we need to enter the configure terminal mode first.
So type username.
Well, to understand the command, I'll put a question mark at the end of each word.
The user name is expected.
Let's give it an exceptional username.
How about Cisco?
Question mark.
Once again, these are the next options.
Okay, We want to specify a password for the user so we can use either password or secret as the keywords
to set a password.
I'll tell you their differences soon, but let's just use password as a keyword for now.
Yeah.
Let's just keep the password simple for now.
One, two, three, four, five.
Or wait, maybe that's just too popular.
In any event, just press enter.
Now to identify the privileges of the user type username Cisco.
Privilege 15 where 15 stands for the complete control over the router.
Okay, now let's go to Cali and run the auxiliary module again.
So it's all finished and the output file is created.
If there's a file with the same name, it's overwritten.
So just be aware of that.
Double click on the file and look at the configuration of the router again.
And look at that.
The entire configuration of the router and look at the rows more carefully.
Yep.
There it is.
The credential we created just a couple of minutes ago.
So as you see, the password is saved.
As clear text and as hackers, we learned the username and password remotely.
Now, does it have to be like this?
I mean, are the credentials of the users always stored as clear text in the Cisco config?
The answer is of course not.
So I'm going to show you the ways to keep the password data secure.
Better pay attention.