Exploring SNMP servers

Find SNMP Servers With NMAP

Here we will scan a class C ip range for possible SNMP servers on the local network.

sam@asus:~% nmap -sU -p 161 148.32.42.0/24
Starting Nmap 7.01 ( https://nmap.org ) at 2019-09-23 11:42 MDT

Nmap scan report for 148.32.42.1
Host is up (0.00046s latency).
PORT    STATE SERVICE
161/udp closed  snmp

Nmap scan report for 148.32.42.2
Host is up (0.00030s latency).
PORT    STATE SERVICE
161/udp closed  snmp

Nmap scan report for 148.32.42.3
Host is up (0.00026s latency).
PORT    STATE SERVICE
161/udp closed  snmp

Nmap scan report for 148.32.42.4
Host is up (0.00025s latency).
PORT    STATE SERVICE
161/udp closed  snmp
...
Nmap done: 256 IP addresses (1 hosts up) scanned in 16.75 seconds
sam@asus:~%

After we got a list of servers, our next task is to try and guess possible community strings for the remote SNMP hosts and check for read/write access on the configuration.

Brute force SNMP Community Strings with onesixtyone

Here we can brute force the SNMP service looking for different community strings we can use to connect with and possibly carry out read/write operations on the remote host configuration. The program we will use is called 'onesixtyone' and can be downloaded from github.

sam@asus:~/onesixtyone% ./onesixtyone -c dict.txt snmp.acme.com
Scanning 1 hosts, 51 communities
148.32.42.5 [public] Linux asus 4.9.4-galliumos-braswell #1 SMP PREEMPT galliumos2 Thu Feb 23 01:58:04 UTC 2017 x86_64
sam@asus:~/onesixtyone% 

We found one community string, the default 'public' community string.

Dumping SNMP Data with SNMPWalk

After we have found some valid community strings our next task is to query the SNMP server with our valid community strings and try to dump the information associated with the current community string. Here we will use the 'SNMPWalk' tool to carry out the SNMP queries.

sam@asus:~% snmpwalk -c public -v1 snmp.acme.com | less
iso.3.6.1.2.1.1.1.0 = STRING: "Linux asus 4.9.4-galliumos-braswell #1 SMP PREEMPT galliumos2 Thu Feb 23 01:58:04 UTC 2017 x86_64"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (17062223) 1 day, 23:23:42.23
iso.3.6.1.2.1.1.4.0 = STRING: "Me "
iso.3.6.1.2.1.1.5.0 = STRING: "asus"
iso.3.6.1.2.1.1.6.0 = STRING: "Sitting on the Dock of the Bay"
iso.3.6.1.2.1.1.7.0 = INTEGER: 72
iso.3.6.1.2.1.1.8.0 = Timeticks: (20) 0:00:00.20
iso.3.6.1.2.1.1.9.1.2.1 = OID: iso.3.6.1.6.3.11.3.1.1
iso.3.6.1.2.1.1.9.1.2.2 = OID: iso.3.6.1.6.3.15.2.1.1
iso.3.6.1.2.1.1.9.1.2.3 = OID: iso.3.6.1.6.3.10.3.1.1
iso.3.6.1.2.1.1.9.1.2.4 = OID: iso.3.6.1.6.3.1
iso.3.6.1.2.1.1.9.1.2.5 = OID: iso.3.6.1.6.3.16.2.2.1
iso.3.6.1.2.1.1.9.1.2.6 = OID: iso.3.6.1.2.1.49
iso.3.6.1.2.1.1.9.1.2.7 = OID: iso.3.6.1.2.1.4
iso.3.6.1.2.1.1.9.1.2.8 = OID: iso.3.6.1.2.1.50
iso.3.6.1.2.1.1.9.1.2.9 = OID: iso.3.6.1.6.3.13.3.1.3
iso.3.6.1.2.1.1.9.1.2.10 = OID: iso.3.6.1.2.1.92
iso.3.6.1.2.1.1.9.1.3.1 = STRING: "The MIB for Message Processing and Dispatching."
iso.3.6.1.2.1.1.9.1.3.2 = STRING: "The management information definitions for the SNMP User-based Security Model."
iso.3.6.1.2.1.1.9.1.3.3 = STRING: "The SNMP Management Architecture MIB."
iso.3.6.1.2.1.1.9.1.3.4 = STRING: "The MIB module for SNMPv2 entities"
iso.3.6.1.2.1.1.9.1.3.5 = STRING: "View-based Access Control Model for SNMP."
iso.3.6.1.2.1.1.9.1.3.6 = STRING: "The MIB module for managing TCP implementations"
iso.3.6.1.2.1.1.9.1.3.7 = STRING: "The MIB module for managing IP and ICMP implementations"
iso.3.6.1.2.1.1.9.1.3.8 = STRING: "The MIB module for managing UDP implementations"
iso.3.6.1.2.1.1.9.1.3.9 = STRING: "The MIB modules for managing SNMP Notification, plus filtering."
iso.3.6.1.2.1.1.9.1.3.10 = STRING: "The MIB module for logging SNMP Notifications."
...
sam@asus:~%

Some SNMP information dumps can be megabytes in size, so its better to redirect the output to a file and grep the resulting file for interesting information strings in the output.