Introduction to SNMP#

Simple Network Management Protocol (SNMP) is a protocol designed for monitoring and managing network devices, including:

• Routers
• Switches
• Servers
• IoT devices
• Various network-enabled devices

Key Capabilities:

• Remote monitoring
• Configuration management
• Event notification
• Uses UDP ports 161 (queries) and 162 (traps)

SNMP Versions and Security#

1. Management Information Base (MIB)#

• Hierarchical database of managed objects
• Standardized format across vendors
• Written in ASN.1 format
• Defines structure of available information

2. Object Identifiers (OIDs)#

• Unique identifiers for each managed object
• Dot notation (e.g., .1.3.6.1.2.1.1.1.0)
• Longer path = more specific information
• Organized in a global tree structure

SNMP Configuration Analysis#

Sample snmpd.conf#

cat /etc/snmp/snmpd.conf | grep -v "#" | sed -r '/^\s*$/d'

Common Directives:

• rocommunity: Read-only community string
• rwcommunity: Read-write community string
• sysLocation: Device location info
• sysContact: Administrator contact

Dangerous Configurations#

SNMP Enumeration Techniques#

1. SNMP Walk#

snmpwalk -v2c -c public <target_IP>

Information Typically Revealed:

• System details (OS, version)
• Network interfaces
• Running processes
• Installed software
• User accounts

2. Community String Brute-forcing#

onesixtyone -c /path/to/wordlist.txt <target_IP>

Common Wordlists:

• SecLists/Discovery/SNMP/
• Custom lists based on organization naming

3. Bulk OID Enumeration with Braa#

braa public@<target_IP>:.1.3.6.*

Advantages:

• Fast parallel queries
• Useful for identifying interesting OIDs

1. Information Disclosure#

• Network topology mapping
• System configuration details
• User account enumeration

2. Configuration Modification#

• Changing network settings
• Modifying system parameters
• Creating backdoor accounts (if RW access)

3. Privilege Escalation#

• Extracting credentials
• Accessing sensitive configuration files
• Modifying system binaries

For Administrators:#

1. Upgrade to SNMPv3 for authentication and encryption
2. Use complex community strings (avoid public/private)
3. Implement ACLs to restrict access
4. Disable SNMP if not required
5. Regularly audit snmpd.conf configurations

For Penetration Testers:#

1. Verify permissions before modifying values
2. Document findings thoroughly
3. Check for sensitive data in MIBs
4. Look for RW access opportunities
5. Correlate findings with other services

Enumerating System Information#

snmpwalk -v2c -c public 10.129.14.128 system

Identifying Installed Packages#

snmpwalk -v2c -c public 10.129.14.128 .1.3.6.1.2.1.25.6.3.1.2

Checking for Write Access#

snmpset -v2c -c private 10.129.14.128 <OID> <value>

Tools for SNMP Testing#