hacktricks/network-services-pentesting/49-pentesting-tacacs+.md

91 lines
6.8 KiB
Markdown
Raw Normal View History

2022-09-30 10:27:15 +00:00
# 49 - Pentesting TACACS+
<details>
2023-04-25 18:35:28 +00:00
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
2022-09-30 10:27:15 +00:00
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
2023-04-25 18:35:28 +00:00
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
2022-12-11 19:30:44 +00:00
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
2022-09-30 10:27:15 +00:00
</details>
## Basic Information
**Terminal Access Controller Access Control System (TACACS)** is a security protocol that provides centralized validation of users who are attempting to gain **access to a router or NAS**. TACACS+, a more recent version of the original TACACS protocol, provides separate authentication, authorization, and accounting (AAA) services.
```
PORT STATE SERVICE
49/tcp open tacacs
```
**Default port:** 49
## Intercept Authentication Key
If an attacker manages to get in the middle between the client and the TACACS server, **he can intercept the authentication key** in encrypted form and then do a local bruteforce against it. So you both bruteforce the key and you dont show up in the logs. And if you manage to bruteforce the key, **youll be able to access the network equipment and decrypt the traffic** in **Wireshark**.
### MitM
In order to perform a MitM attack you could use an [**ARP spoofing attack**](../generic-methodologies-and-resources/pentesting-network/#arp-spoofing).
### Brute-force Key
Now you need to run [Loki](https://c0decafe.de/svn/codename\_loki/trunk/). This is a special tool designed to analyze the security of L2/L3 protocols. Its capabilities are just as good as those of the popular **Yersinia** and it is a serious competitor to it. Loki can also bruteforce TACACS keys. If the key is successfully **bruteforced** (**usually in MD5 encrypted format)**, **we can access the equipment and decrypt the TACACS-encrypted traffic.**
```
sudo loki_gtk.py
```
2022-12-29 12:18:46 +00:00
<figure><img src="../.gitbook/assets/image (31) (2).png" alt=""><figcaption></figcaption></figure>
2022-09-30 10:27:15 +00:00
You also need to specify the path to the dictionary in order to bruteforce the encrypted key. Be sure to uncheck the **Use Bruteforce** option, otherwise Loki will bruteforce the password without using the dictionary.
2022-12-11 19:30:44 +00:00
<figure><img src="../.gitbook/assets/image (11) (2).png" alt=""><figcaption></figcaption></figure>
2022-09-30 10:27:15 +00:00
Now we have to wait for an administrator to log into the device through the TACACS server. It is assumed that the network administrator has already logged in, and we, **standing in the middle via ARP spoofing**, intercept the traffic. And in doing so, the legitimate hosts dont realize that someone else has interfered with their connection.
2022-12-11 19:30:44 +00:00
<figure><img src="../.gitbook/assets/image (8) (2).png" alt=""><figcaption></figcaption></figure>
2022-09-30 10:27:15 +00:00
Now click the **CRACK** button and wait for **Loki** to break the password.
2022-12-24 19:34:46 +00:00
<figure><img src="../.gitbook/assets/image (17) (2).png" alt=""><figcaption></figcaption></figure>
2022-09-30 10:27:15 +00:00
### Decrypt Traffic
Great, we managed to unlock the key, now we need to decrypt the TACACS traffic. As I said, Wireshark can handle encrypted TACACS traffic if the key is present.
2022-12-24 19:34:46 +00:00
<figure><img src="../.gitbook/assets/image (28) (1).png" alt=""><figcaption></figcaption></figure>
2022-09-30 10:27:15 +00:00
We see which banner was used.
2022-12-29 12:18:46 +00:00
<figure><img src="../.gitbook/assets/image (24) (1) (2).png" alt=""><figcaption></figcaption></figure>
2022-09-30 10:27:15 +00:00
We find the username of the user `admin`
2023-02-27 09:14:27 +00:00
<figure><img src="../.gitbook/assets/image (7) (1) (1).png" alt=""><figcaption></figcaption></figure>
2022-09-30 10:27:15 +00:00
As a result, **we have the `admin:secret1234` credentials,** which can be used to access the hardware itself. **I think Ill check their validity.**
2022-12-24 19:34:46 +00:00
<figure><img src="../.gitbook/assets/image (19) (2).png" alt=""><figcaption></figcaption></figure>
2022-09-30 10:27:15 +00:00
This is how you can attack TACACS+ and **gain access** to the control panel of network equipment.
## References
* The interception key section was copied from [https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9](https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9)
<details>
2023-04-25 18:35:28 +00:00
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
2022-09-30 10:27:15 +00:00
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
2023-04-25 18:35:28 +00:00
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
2022-12-11 19:30:44 +00:00
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
2022-09-30 10:27:15 +00:00
</details>