49 - Pentesting TACACS+

Basic Information

The Terminal Access Controller Access Control System (TACACS) protocol is used to centrally validate users trying to access routers or Network Access Servers (NAS). Its upgraded version, TACACS+, separates the services into authentication, authorization, and accounting (AAA).

PORT   STATE  SERVICE
49/tcp open   tacacs
300/tcp open  tacacs-tls

Default ports: 49/TCP (legacy TACACS+) and 300/TCP (TACACS+ over TLS).

A useful offensive detail is that legacy TACACS+ does not provide full transport encryption. The header stays in cleartext (version, type, seq_no, flags, session_id, length) and the body is only MD5-based obfuscation with the shared secret.^[1] Therefore, if you can capture traffic, you can still carve sessions, identify auth/accounting flows, and prepare offline cracking attacks against the shared secret.

Newer deployments may implement TACACS+ over TLS. If you see TCP/300 and an immediate TLS handshake, the classic capture-and-crack / packet-flipping attacks from this page usually only apply to the legacy TCP/49 service. RFC 9887 also requires TLS 1.3+ and disables the legacy TACACS+ body obfuscation inside the protected channel.^[3]

Quick Enumeration

nmap -sV -Pn -p 49,300 <IP>

If you already have a packet capture, useful filters are:

tcp.port == 49 || tcp.port == 300

If the target uses legacy TACACS+, note the packet type, sequence number, and session ID from the cleartext header before attempting traffic manipulation or secret recovery. If the device uses single-connection, one long-lived TCP flow may contain multiple AAA exchanges, so a single capture can be much more valuable than it first appears.

Capture Material for Shared-Secret Recovery

The shared secret is not transmitted in a TACACS+ packet. A captured legacy exchange provides cleartext header fields and an obfuscated body that can be used to test shared-secret candidates offline when enough of the body plaintext is predictable. Cracking is not logged as repeated server authentication attempts, although the traffic interception itself may be detectable. Recovering the secret permits deobfuscation and, depending on device configuration, may support impersonation or manipulation; it does not automatically grant an interactive device login.^[1]

Performing a MitM Attack

An ARP spoofing attack can be utilized to perform a Man-in-the-Middle (MitM) attack. For routed environments, a TCP proxy/NAT setup can also be used to force TACACS+ traffic through the attacker.

Brute-forcing the Key

Loki is a historical tool for TACACS+ attacks, while a more practical modern workflow converts a captured exchange into a Hashcat input and cracks it offline.^[4]

Using TacoTaco:^[2]

python3 tac2cat.py -t 1 -m "Password: " \
  -p <hex_stream_from_wireshark> > tacacs.hash
hashcat -m 16100 tacacs.hash <wordlist>

The main gotcha is that tac2cat.py expects the TACACS+ packet bytes (for example, the second authentication packet exported from Wireshark as hex) plus the prompt/banner string shown by the device.

If the secret is recovered, use it to deobfuscate the captured legacy TACACS+ bodies and assess whether the same secret enables unauthorized NAS/server interactions.

Decrypting Traffic

Once the key is successfully cracked, the next step is to decrypt the TACACS-encrypted traffic. Wireshark can handle legacy TACACS+ traffic if the shared secret is provided. By analyzing the decrypted traffic, information such as the banner used, the username, and sometimes authorization/accounting AV pairs can be obtained.

Active Manipulation of Legacy TACACS+

Legacy TACACS+ is also interesting from an inline manipulation perspective: because it lacks strong integrity protection, a MitM can sometimes flip bits, replay packets, or alter authorization/accounting fields without knowing the shared secret.^[1]

The TacoTaco project includes tacoflip.py, built for MitM authentication/authorization bypass testing against legacy Cisco-style TACACS+ deployments:^[2]

python3 tacoflip.py -t <TACACS_SERVER_IP>

This is not a “remote unauthenticated RCE” primitive; it is a traffic-position attack that becomes viable when you can sit between the NAS and the TACACS+ server and the deployment is still using plain TACACS+ over TCP/49.

Configuration Hunting

If you already obtained device configurations through another path (for example via backups, TFTP, or Cisco SNMP config-copy abuse), search them before spending time on live traffic attacks. TACACS+ client definitions often expose the target server addresses and sometimes directly expose the shared secret or its recoverable representation.

rg -n "tacacs|aaa group server|tacacs-server| key " *.cfg

On Cisco gear, look for legacy lines such as tacacs-server host <ip> key <secret> and newer tacacs server <name> blocks. Recovering the secret from configuration files is usually cleaner than trying to brute-force it from a short capture.

By gaining access to the control panel of network equipment using the obtained credentials, the attacker can exert control over the network. It’s important to note that these actions are strictly for educational purposes and should not be used without proper authorization.