SNMP Enumeration
SNMP is based on UDP,
a simple, stateless protocol,
and is therefore susceptible to IP spoofing and replay attacks.
Additionally, the commonly used SNMP protocols 1, 2, and 2c
offer no traffic encryption,
meaning that SNMP information and credentials
can be easily intercepted over a local network.
Traditional SNMP protocols also have weak authentication schemes
and are commonly left configured with default public
and private community strings.
Because all of the above applies to a protocol that is, by definition,
meant to “Manage the Network,”
SNMP is another one of our favorite enumeration protocols.
Now that we have gained a basic understanding of SNMP,
we can explore one of its main features,
the SNMP MIB Tree.
The SNMP Management Information Base
is a database containing information usually related to network management.
The database is organized like a tree,
with branches that represent different organizations or network functions.
The leaves of the tree correspond to specific variable values
that can then be accessed and probed by an external user.
For example, the following MIB values
correspond to specific Microsoft Windows SNMP parameters
and contain much more than network-based information:
To scan for open SNMP ports,
we can run nmap,
using the -sU option to perform UDP scanning,
and the --open option to limit the output and display only open ports.
Alternatively, we can use a tool such as onesixtyone,
which will attempt a brute force attack against a list of IP addresses.
First, we must build text files
containing community strings and the IP addresses we wish to scan.
Once we find SNMP services,
we can start querying them for specific MIB data that might be interesting.
We can probe and query SNMP values using a tool such as snmpwalk,
provided we know the SNMP read-only community string.
Using some of the MIB values provided in the Table we examined earlier,
we can attempt to enumerate their corresponding values.
Let’s try the following example against a known machine in the labs,
which has a Windows SNMP port exposed with the community string “public”.
This command enumerates the entire MIB tree
using the -c option to specify the community string,
and -v to specify the SNMP version number
as well as the -t 10 option
to increase the timeout period to 10 seconds:
Revealed another way,
we can use the output we received to obtain target email addresses.
This information can be used to craft a social engineering attack
against the newly-discovered contacts.
To further practice what we’ve learned,
let’s explore a few SNMP enumeration techniques against a Windows target.
We’ll use the snmpwalk command,
which can parse a specific branch of the MIB Tree called OID.
The following example enumerates the Windows users on the dc01 machine.
Our command queried a specific MIB sub-tree
that is mapped to all the local user account names.
As another example, we can enumerate all the currently running processes:
The command returned an array of strings,
each one containing the name of the running process.
This information could be valuable as it might reveal vulnerable applications,
or even indicate which kind of anti-virus is running on the target.
Similarly, we can query all the software that is installed on the machine:
When combined with the running process list we obtained earlier,
this information can become extremely valuable
for cross-checking the exact software version
a process is running on the target host.
Another SNMP enumeration technique is to list all the current TCP listening ports:
The integer value from the output
represents the current listening TCP ports on the target.
This information can be extremely useful
as it can disclose ports that are listening only locally
and thus reveal a new service that had been previously unknown.