D1: Management Protocols

Question 1

What port does Telnet work on?

Answer 1

23

Question 2

What port does SSH work on?

Answer 2

22

Question 3

What port does SNMP work on?

Answer 3

161 and 162

Question 4

What port does TFTP work on?

Answer 4

69

Question 5

What port does NTP work on?

Answer 5

123

Question 6

What is Telnet?

Answer 6

Allows command-line access to servers and embedded devices

Question 7

What weakness does Telnet have?

Answer 7

Default credentials can provide shell access to the server.

Possible to intercept a user logging into the server running telnet.

Versions of telnet services may be exposed if they have not already been picked up by nmap scans

Question 8

What is SSH?

Answer 8

Creates encrypted communication channel to the server which allows you to pass commands to host.

Question 9

Weakness of SSH

Answer 9

Default credentials

Password authenticated enabled

Old versions of SSH

Weak SSH keys

Key Exchange with unsafe groups and elliptic curves

Question 10

What layer does Telnet work on?

Answer 10

Application

Question 11

What layer does SSH work on?

Answer 11

Application

Question 12

What layer does SSH work on?

Answer 12

Application

Question 13

What does SNMP do?

Answer 13

Service is run on managed switches, routers and servers for monitoring – called SNMP agents – can gather information about a piece of hardware, organize it into predefined entries and respond to queries using the SNMP protocol.

Question 14

What are the commands for the SNMP protocol?

Answer 14

GetRequest, GetNextRequest, GetBulkRequest, SetRequest, InformRequest, and Response

Question 15

What weaknesses does Version 1 SNMP have?

Answer 15

Community strings are used. Read-only and read-writ SNMP strings meaning info can be queried if community string is known.

Question 16

What weaknesses does Version 2 SNMP have?

Answer 16

Hard to set up and not widely used.

Question 17

What weaknesses does Version 2c SNMP have?

Answer 17

Revised version that includes enhanced protocol packet types, transport mappings and MIB structure elements. Security was rolled back to using community strings same as Version 1.

Question 18

What weaknesses does Version 3 SNMP have?

Answer 18

Supports the remote configuration of SNMP entities. Adds encryption and authentication, can be used together or separately, making it most secure version however exploits still available such as user enumeration.

Question 19

Other generic weaknesses for SNMP?

Answer 19

Default community strings set

User enumeration

Brute-force of community strings and user passwords

Useful information leakage

Question 20

What tools can be used for SNMP?

Answer 20

snmpwalk

snmpcheck