Haxoris Wiki

Cleartext Management Protocols

How Cleartext Management Protocols works

Management and data protocols with no transport encryption carry credentials and session content as readable bytes on the internal network. The estate is predictable: Telnet on access switches, IP KVMs and older appliances, FTP and TFTP for firmware images and configuration backups, rsh and rlogin surviving on legacy Unix, HTTP login pages on printers, PDUs, UPS cards and out-of-band controllers where the redirect to HTTPS was never enforced, SNMPv1 and v2c community strings on everything with an interface counter, LDAP simple bind on port 389, syslog over UDP 514, and database wire protocols - TDS, MySQL and PostgreSQL - left negotiable so the client silently connects without TLS.

An attacker with a mirror port, a compromised host on the same segment or an on-path position reads administrator credentials, SNMP communities, configuration files with hashed local passwords, and the content of every query. That is a direct route from one foothold to a privileged account, which is exactly the scenario the OWASP category describes. It is easy to miss because nothing is broken: the protocol works, the device has been in the rack for eight years, the vulnerability scanner reports informational at most, and the secure alternative is often present but not enforced. Obtaining the listening position through name poisoning belongs to the LLMNR And NBT-NS Name Poisoning page, and the segment design that lets one host see all of it belongs to the Flat Networks And Missing Segmentation page.

Cleartext Management Protocols in practice

Sweep the segment for cleartext listeners

Establish what actually answers before capturing anything. Scope to the authorised lab management VLAN and keep it to service discovery.

# TCP: classic cleartext management and database ports
nmap -sS -Pn -n --open -p 21,23,79,80,389,512,513,514,1433,3306,5432,8080,8081 \
  -oA /tmp/isr05-cleartext 10.20.0.0/24

# UDP: TFTP, SNMP, syslog
nmap -sU -Pn -n --open -p 69,161,514 -oN /tmp/isr05-udp.txt 10.20.0.0/24

# banners and versions for whatever answered
awk '/Ports:.*open/ {print $2}' /tmp/isr05-cleartext.gnmap > /tmp/isr05-hosts.txt
nmap -sV -Pn --script banner -p 21,23,389,1433,3306,5432 \
  -oN /tmp/isr05-banners.txt -iL /tmp/isr05-hosts.txt

# read-only SNMP check with the community the device shipped with
snmpwalk -v2c -c public 10.20.0.15 1.3.6.1.2.1.1.1.0

A device with 23/tcp open and 22/tcp closed is a migration project, not a configuration change. Record that distinction now.

Prove credentials cross the wire

Discovery alone is a theoretical finding. Capture during a real change window, from a mirror port rather than by inserting yourself on-path.

# SPAN / mirror port feeding eth1 on the capture host, full packets, 15 minutes
sudo tcpdump -i eth1 -s 0 -G 900 -W 1 -w /tmp/isr05-mgmt.pcap \
  'tcp port 21 or tcp port 23 or tcp port 389 or tcp port 1433 or udp port 161 or udp port 514'

# ARP or LLMNR poisoning would create the same position, but it rewrites
# forwarding state on a live management VLAN and drops administrator sessions.
# The mirror port proves confidentiality loss without touching production paths.

Read the evidence out of the capture

This step produces the artefact that closes the finding. Store recovered secrets as placeholders in the report and rotate them afterwards.

$ tshark -r /tmp/isr05-mgmt.pcap -Y 'ftp.request.command in {"USER","PASS"}' \
    -T fields -e ip.src -e ip.dst -e ftp.request.arg
10.20.0.42   10.20.0.11   svc-backup
10.20.0.42   10.20.0.11   <PASSWORD_RECOVERED_IN_CLEAR>

$ tshark -r /tmp/isr05-mgmt.pcap -Y 'ldap.protocolOp == 0 && ldap.authentication == 0' \
    -T fields -e ip.src -e ldap.name
10.20.0.58   CN=svc-app,OU=Service,DC=lab,DC=internal      simple bind on 389

$ tshark -r /tmp/isr05-mgmt.pcap -Y telnet -T fields -e telnet.data | tr -d '\n'
Username: netadmin Password: <PASSWORD_RECOVERED_IN_CLEAR> switch01#

$ tshark -r /tmp/isr05-mgmt.pcap -Y 'snmp.community' -T fields -e ip.src -e snmp.community
10.20.0.7    private

Verdict: one recovered credential per protocol is sufficient. Anything
further is collection for its own sake and widens the blast radius of
the test data you now hold.

Check the services that have a secure mode but do not enforce it

The harder half of the finding is the protocol that supports TLS and is simply not required to use it, so the client quietly falls back.

# SQL Server: is encryption forced, or negotiable down to cleartext TDS?
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQLServer\SuperSocketNetLib' |
  Select-Object ForceEncryption, Certificate

# WinRM: does the service accept unencrypted traffic?
winrm get winrm/config/service | Select-String 'AllowUnencrypted'

# Appliance web panels: does port 80 redirect, or serve the login form itself?
'printer01.lab.internal','pdu-rack3.lab.internal','ilo-esx01.lab.internal' | ForEach-Object {
  $r = Invoke-WebRequest "http://$_/" -MaximumRedirection 0 -SkipHttpErrorCheck
  '{0} -> {1} {2}' -f $_, $r.StatusCode, $r.Headers.Location
}

A 200 with a login form on port 80 is a cleartext credential path even when 443 is also open.

How to fix and prevent Cleartext Management Protocols

  1. Remove the protocols that cannot be secured
    • Telnet, FTP, TFTP, rsh and rlogin, SNMPv1 and v2c have no confidential mode; move to SSH, SFTP or SCP, SNMPv3 with authPriv, and syslog over TLS.
    • Disable the daemon on the device rather than blocking it at the firewall, so a re-image or a factory reset does not quietly restore it.
  2. Enforce the secure mode where one already exists
    • ForceEncryption on SQL Server, require_secure_transport on MySQL, hostssl-only entries in pg_hba.conf, LDAPS or StartTLS with simple bind refused on 389, WinRM AllowUnencrypted set false.
    • Then verify from a client, because a server-side setting that no client honours changes nothing on the wire.
  3. Rotate every credential the capture exposed
    • A password, SNMP community or API token seen in a pcap is burned regardless of who captured it; rotate the account as well as fixing the protocol.
  4. Handle the appliances that only speak cleartext as exceptions
    • Place them in a management segment reached through a jump host, and record an accepted exception with an owner and a review date.
    • Partial control: traffic inside that segment is still readable by anything with a foothold in it.
  5. Keep the sweep running
    • Schedule the port sweep and diff it, so a switch racked with defaults or an appliance restored from backup is caught in days rather than at the next annual test.

Last updated

References