5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

CREST Practitioner Security Analyst CPSA

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Soft Skills, Legal Framework & Assessment Management

1.1 The Penetration Testing Engagement Lifecycle & Scoping 1.2 Legal Framework: Computer Misuse Act & Compliance 1.3 Understanding, Explaining & Managing Technical Risk 1.4 Record Keeping, Interim Escalation & Reporting Standards

2 Chapter 2: Core Networking: IP Protocols & Network Architectures

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture 2.2 TCP and UDP Transport Protocols & Handshake Mechanics 2.3 ICMP Protocol, Network Diagnostics & Error Messages 2.4 Network Topologies, Switched Media & VLAN Segmentation 2.5 Network Media, Ethernet Standards & Physical Topologies

3 Chapter 3: Cryptography & Secure Communication Protocols

3.1 Symmetric & Asymmetric Cryptographic Algorithms 3.2 Cryptographic Hash Functions, MACs & Digital Signatures 3.3 Secure Protocols: SSL/TLS, IPsec & SSH

4 Chapter 4: Background Information Gathering & OSINT Reconnaissance

4.1 WHOIS Records, Domain Registrars & Autonomous Systems 4.2 DNS Infrastructure, Record Types & Zone Transfers 4.3 Search Engine Reconnaissance, Google Dorking & Information Leakage 4.4 Newsgroups, Mailing Lists & Public Archive Reconnaissance

5 Chapter 5: Networking Equipment & Infrastructure Protocols

5.1 Router & Switch Management: SNMP, SSH & Authentication 5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy 5.3 Core Network Services: DHCP, NTP & TFTP 5.4 Wireless Security (802.11) & VoIP Assessment 5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

6 Chapter 6: Network Mapping, Nmap Techniques & Target Identification

6.1 Host Discovery Techniques & Ping Sweep Methodologies 6.2 Port Scanning Mechanics: TCP, UDP & Stealth Scans 6.3 OS Fingerprinting, Service Detection & Timing Templates 6.4 Firewall and IDS/IPS Evasion Techniques 6.5 Passive OS & Service Fingerprinting 6.6 Network Access Control Analysis & Firewall Rule Base Review

7 Chapter 7: Vulnerability Identification & Tool Output Analysis

7.1 Vulnerability Scanning Principles & Methodology 7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation 7.3 Banner Grabbing, Service Verification & Manual Triage 7.4 Host Audit Techniques: Processes, Sockets, Patch Levels & Interesting Files

8 Chapter 8: Microsoft Windows Security Assessment & Active Directory

8.1 Active Directory Architecture & Domain Reconnaissance 8.2 Windows User & Group Enumeration via SMB & RPC 8.3 Windows Authentication: NTLM, Kerberos & Password Security 8.4 Windows Patch Management, Local Security & Common Services 8.5 Windows File System, Share & Registry Permissions 8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

9 Chapter 9: Unix & Linux Security Assessment & Legacy Services

9.1 Linux/Unix Security Architecture, Permissions & Filesystem 9.2 Unix User Enumeration & Service Discovery 9.3 Network File System (NFS) & RPC Services Assessment 9.4 Legacy Unix Services: R-Services, X11, FTP & Modern SSH 9.5 Unix Remote Information Services: rusers, rwho, finger & systat 9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

10 Chapter 10: Web Architectures, Technologies & Testing Methodologies

10.1 Web Server Architecture & the HTTP/HTTPS Protocol 10.2 Web Application Components, Frameworks & State Management 10.3 Web Reconnaissance, Content Discovery & Threat Modelling 10.4 Testing Authentication, Authorization & Session Management 10.5 Web Service Protocols: SOAP, REST & XML Messaging 10.6 Web APIs, Server Extensions & Client-Side Sub-Components

11 Chapter 11: Web Testing Techniques & OWASP Top Vulnerabilities

11.1 Input Validation Vulnerabilities & Parameter Manipulation 11.2 Cross-Site Scripting (XSS): Types, Impact & Defenses 11.3 Cross-Site Request Forgery (CSRF) & Client-Side Attacks 11.4 Command Injection, File Upload Vulnerabilities & API Flaws 11.5 Information Disclosure: Error Messages & Mark-up Leakage 11.6 Injection Beyond SQL: LDAP, XPath, Code & Template Injection 11.7 Source Code Review & Encoded/Cryptographic Value Analysis

12 Chapter 12: Database Security Assessment & SQL Injection

12.1 Database Architectures, Default Ports & Authentication 12.2 SQL Injection (SQLi) Foundations & In-Band Techniques 12.3 Blind SQL Injection & Database Enumeration 12.4 Database Attack Vectors, Stored Procedures & Hardening

5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

Key Takeaways Explain This Topic AI

A Cisco terminal server maps async line N to TCP port 2000+N for telnet access, 3000+rotary for rotary groups, 4000+N for raw TCP and 6000+N for telnet without carriage-return translation.

Reverse Telnet sessions inherit the line's own authentication: a line with no password and 'transport input all' grants an unauthenticated console session to every attached device.

The AUX port accepts an inbound modem connection and, if left enabled, provides a dial-in path that bypasses the entire network perimeter.

IPMI-based lights-out controllers (iLO, iDRAC, IMM) listen on UDP port 623 and are affected by Cipher Zero authentication bypass and the RAKP hash-retrieval flaw.

Management-plane hardening means restricting transport input to SSH, applying an ACL to the VTY lines, disabling unused lines with 'no exec', and enforcing exec-timeout.

Last updated: September 2026

5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

Every network device has three logical planes: the data plane that forwards user traffic, the control plane that runs the routing and switching protocols, and the management plane that administrators use to configure the box. CPSA syllabus item D1 asks about weaknesses in the protocols used for remote management of devices and names Cisco Reverse Telnet explicitly alongside Telnet, SSH, SNMP, TFTP and NTP.

The management plane is attractive precisely because it is often treated as a back office concern. It is built early, documented poorly, and exempted from the hardening that the production path receives.

1. In-Band vs Out-of-Band Management

• In-Band Management Out-of-Band (OOB) Management
• Path Shares the production data network A physically or logically separate path

Examples SSH to a switch's VTY line over the corporate LAN Console server, dedicated management VLAN/network, dial-in modem, IPMI/iLO NIC

Failure behaviour Lost when the network fails — exactly when you need it Survives a data-plane outage

Security posture Inherits the production network's controls Frequently less controlled, on the assumption that it is unreachable

The last row is the assessor's opportunity. An organisation builds an OOB network so that it can recover from an outage, then reasons that because the OOB network is "separate" it does not need authentication hardening. If any path exists from the corporate network into that management segment — a dual-homed jump host, a misconfigured firewall rule, a forgotten trunk — the entire estate's consoles are exposed.

2. Console and AUX Ports

Cisco IOS devices expose several line types, listed by show line :

con 0 — the console port. An RJ-45 or USB serial port requiring physical presence. Critically, console access normally permits password recovery by interrupting the boot sequence and altering the configuration register ( confreg 0x2142 ) to bypass the startup configuration. Physical access to a console port is therefore equivalent to administrative control of the device, which is why comms-room locks are a network finding, not just a facilities one.

aux 0 — the auxiliary port. A second serial port intended for an inbound modem . If left enabled with a modem attached, it provides a dial-in route straight to the device's EXEC prompt, entirely bypassing the firewall, the VPN and every network control. This is the classic "war dialling" target and remains a genuine finding in utilities, retail and manufacturing estates.

tty / line N — asynchronous lines. On a router equipped with an async module (for example an NM-16A or NM-32A), each line drives a serial cable to another device's console port. This is the terminal server role.

vty 0 4 (or 0 15 ) — virtual terminal lines. The inbound Telnet/SSH sessions.

3. Reverse Telnet and the Terminal Server

Reverse Telnet inverts the usual direction. Normally you telnet from a router to somewhere else. In reverse telnet you telnet to the router, on a special TCP port, and the router connects you through to one of its async lines — and therefore to the console port of whatever is cabled to that line.

A terminal server (console server) with sixteen async lines cabled to sixteen device consoles lets an administrator reach every console in a rack from their desk. It also means that compromising that one terminal server yields console-level access to sixteen devices.

The Port Arithmetic

This is examinable and worth memorising. The router derives the listening TCP port from a base plus the line number : +--------------+---------------------------+----------------------------------------+

• | TCP Base | Target | Behaviour |
• +--------------+---------------------------+----------------------------------------+
• | 2000 + line | Individual async line | Telnet protocol; CR translated to CRLF |
• | 3000 + rotary| Rotary group (hunt group) | Connects to the next free line in group|
• | 4000 + line | Individual async line | Raw TCP; no Telnet option negotiation |
• | 6000 + line | Individual async line | As 2000, but no carriage-return xlation|
• +--------------+---------------------------+----------------------------------------+

So to reach the console of the device cabled to line 7 on terminal server 10.10.50.9 : telnet 10.10.50.9 2007 # telnet-style session to async line 7

• telnet 10.10.50.9 4007 # raw TCP to the same line (e.g. for a printer)
• telnet 10.10.50.9 6007 # telnet, no CR->CRLF translation
• telnet 10.10.50.9 3001 # next free line in rotary group 1
• Typical supporting configuration on the terminal server: ip host SW-CORE-01 2007 10.10.50.9

!

• line 1 16
• no exec
• transport input telnet
• exec-timeout 0 0
• rotary 1
• Why This Is a Finding

Reverse Telnet sessions are authenticated by the line's own configuration , not by the device's main login. Three defaults conspire against the client:

transport input telnet (or all ) — the console pass-through runs in cleartext , so credentials typed at the downstream device's console prompt cross the network unencrypted.

No line password and no login directive — a line configured with no exec for pass-through use frequently has no authentication at all, because administrators reason that the downstream device will prompt for its own credentials. That reasoning fails whenever the downstream device is sitting at a Router> prompt from a previous session.

exec-timeout 0 0 — sessions never time out, so an abandoned administrative session on a downstream console stays live and is inherited by whoever connects next. Clearing the line ( clear line 7 ) resets it; not clearing it leaves a privileged session open indefinitely.

Scanning for this is straightforward: an Nmap scan of a suspected terminal server showing a contiguous run of open ports in the 2000–2032 or 4000–4032 range is a strong indicator. nmap -Pn -sS -p 2001-2032,3001-3016,4001-4032,6001-6032 10.10.50.9

• 4. Hardening the Cisco Management Plane
• The findings above map directly to a short set of recommendations you can put in a report: line vty 0 4
• transport input ssh ! never telnet
• access-class MGMT-ACL in ! restrict source addresses
• login local ! or AAA
• exec-timeout 5 0 ! idle sessions die

!

• line aux 0
• no exec ! disable the EXEC on the AUX port
• transport input none

!

• line con 0
• login local
• exec-timeout 5 0

!

• service password-encryption ! obscures type 7 only - see 5.1
• no ip http server ! disable cleartext web management
• ip ssh version 2
• aaa new-model ! centralise auth (TACACS+ / RADIUS)

Note the ordering of value: access-class on the VTY lines is the single highest-value control, because it prevents the management plane from even being reachable from user subnets. service password-encryption is the lowest, because Cisco type 7 encoding is reversible.

5. Modern Lights-Out Management

Serial console servers have largely been replaced by baseboard management controllers (BMCs) — HPE iLO , Dell iDRAC , Lenovo/IBM IMM , Supermicro IPMI , and the vendor-neutral Redfish API. A BMC is an independent computer inside the server with its own CPU, firmware, NIC and power domain. It stays running when the host is powered off, and it can mount virtual media, power-cycle the host and capture the console.

The security properties are alarming and frequently examined in practice:

IPMI listens on UDP port 623 ( asf-rmcp ). An Nmap UDP scan or the ipmi-version NSE script identifies it immediately.

Cipher Zero — IPMI 2.0 defines cipher suite 0, which means "no authentication and no integrity". Where it is enabled, any client can execute administrative IPMI commands, including creating an administrator account, without credentials.

RAKP hash retrieval — the IPMI 2.0 RAKP authentication exchange returns a salted HMAC of the requested user's password to an unauthenticated client , which can then be cracked offline. This is a design flaw in the specification, not a vendor bug, so the mitigation is network isolation rather than patching.

Default credentials — ADMIN / ADMIN , root / calvin (iDRAC) and factory-printed iLO passwords survive in the field for years.

Shared-NIC mode — many BMCs can share the host's production NIC. A BMC intended to be OOB then appears on the production VLAN, undoing the entire isolation design.

Because a BMC compromise yields power control, virtual media and console access, treat it as equivalent to physical access to the server. The correct recommendation is an isolated management VLAN with no route from user subnets, unique credentials, disabled cipher zero, and current BMC firmware.

6. Assessment Checklist for the Management Plane

• Check Command or probe What a failure looks like
• Cleartext management enabled nmap -p 23,80,161,623 <device> Telnet, HTTP or SNMP open to user subnets

Terminal server exposure nmap -p 2001-2032,4001-4032 Contiguous open ports; banner shows a downstream device prompt

• AUX port / dial-in Review show line , ask for modem inventory aux 0 with an EXEC enabled and a modem attached
• VTY source restriction Config review for access-class No ACL on VTY lines
• BMC exposure nmap -sU -p 623 --script ipmi-version <range> BMCs answering from a user VLAN
• BMC authentication ipmi-cipher-zero / ipmi-brute NSE scripts Cipher zero accepted, or default credentials
• Session hygiene show users , show line exec-timeout 0 0 , stale connected lines