SNMP (MIB Dump)
Sub-technique of T1602 Data from Configuration Repository ↗
Reading device information over SNMP: processes, users, interfaces and sometimes passwords.
How it shows up on Hack The Box
Always scan UDP 161. With the public community, walking the process table shows command-line arguments containing passwords.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- SMB and NFS enumeration: shares, null sessions and files full of passwords 4 min read Enumerate SMB and NFS with NetExec, smbclient, smbmap and enum4linux-ng, with or without credentials: null sessions, files with passwords and no_root_squash.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Nmap and service enumeration › Services
Try communities
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt 10.10.11.20
Walk the tree
snmpwalk -v2c -c public 10.10.11.20
Processes and arguments (passwords in command lines)
snmpwalk -v2c -c public 10.10.11.20 1.3.6.1.2.1.25.4.2.1.5No command matches.