Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

SNMPv2c write-community → router config exfil → cred sprays

Find a router with 'private' RW community. Trigger SNMP-to-TFTP config download to attacker host. The config has RADIUS shared secret, AAA server IP, ISAKMP PSKs, and SSH user-pubkeys — spray harvested creds.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: corporate network has legacy router with SNMPv2c enabled and a default write community. Attacker on the management VLAN or has internal foothold.

§ Steps

  1. 01
    Continue chain into Active DirectoryDiscovery
    AD-BLOODHOUND— BloodHound / SharpHound Enumeration
  2. 02
    Spray harvested credentials against ADCredential Access
    T1110.003— Password Spraying
  3. 03
    Receive plaintext router configCredential Access
    T1552— Unsecured Credentials
  4. 04
    Decrypt RADIUS shared secret / decode AAACredential Access
    T1556— Modify Authentication Process
  5. 05
    snmpwalk for 'private' / 'public' / commonPrivilege Escalation
    NET-SNMP-RW-COMMUNITY— SNMPv2c Write Community
  6. 06
    OID write triggers TFTP config sendCollection
    NET-SNMP-CONFIG-DL— SNMP TFTP Config Download

§ References

§ Frequently asked

What is the "SNMPv2c write-community → router config exfil → cred sprays" attack path?
Find a router with 'private' RW community. Trigger SNMP-to-TFTP config download to attacker host. The config has RADIUS shared secret, AAA server IP, ISAKMP PSKs, and SSH user-pubkeys — spray harvested creds. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Continue chain into Active Directory (AD-BLOODHOUND) — a discovery primitive. Assumed environment: corporate network has legacy router with SNMPv2c enabled and a default write community.
What is the final impact of this kill-chain?
The final step lands on OID write triggers TFTP config send (NET-SNMP-CONFIG-DL), which falls under Collection. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers