> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/services/161-162-snmp.md).

# (161,162) SNMP

<details>

<summary>Intro about SNMP</summary>

* Protocol **used in TCP/IP networks to collect and manage information about networked devices**

#### SNMP managed networks have 3 components:

1. Managed Device\
   A managed device (‘node’) is a network device with the SNMP service enabled allowing unidirectional (read) or bidirectional (read/write) communication. Managed devices can be any networked device including servers, firewalls and routers.
2. Agent\
   The agent is the software running on the managed device which is responsible for handling the communication. The agent translates device-specific configuration parameters into an SNMP format for the Network Management System.
3. Network Management System (NMS)\
   The Network Management System is the software that is actually managing and monitoring networked devices. An SNMP managed network will always contain at least one NMS.

**SNMP Management Information Base (MIB):**

* MIB is a database that contains information about the network device.&#x20;
* When the Network Management System (NMS) sends a ‘get’ request for information about a managed device on the network, the agent service returns a structured table with data (MIB).&#x20;
* Eg: MIB value 1.3.6.1.2.1.1.1 --> sysDescr

**SNMP Community strings:**

* The SNMP community string is like a username or password that allows access to the managed device.&#x20;
* There are three different community strings that allow a user to set (1) read-only commands, (2) read and write commands and (3) traps.&#x20;
* Most SNMPv1 and SNMPv2 devices ship from the factory with a default read-only community string set to **‘public’** and the read-write string set to ‘private’.&#x20;
* In SNMPv3, the community string was replaced by username and password authentication.

</details>

<details>

<summary>Nmap</summary>

```bash
nmap 172.21.0.0 -Pn -sU -p 161 --script=snmp* 
```

* look at `snmp-win32-software` for vuln apps

</details>

<details>

<summary>SNMP Manual Enum</summary>

```bash
snmpwalk -v 2c -c public 192.168.215.149 NET-SNMP-EXTEND-MIB::nsExtendObjects
```

```bash
snmpwalk -v 2c -c public 192.168.215.149 NET-SNMP-EXTEND-MIB::nsExtendOutputFull
```

```bash
snmpwalk -v2c -c public $IP .1 > output
```

* Grep for STRING

</details>

<details>

<summary>SNMP Walk</summary>

```bash
snmpwalk -c public -v1 ipaddress 1
```

```bash
snmpwalk -c private -v1 ipaddress 1
```

```bash
snmpwalk -c manager -v1 ipaddress 1
```

</details>

<details>

<summary>SNMPv3 Enum</summary>

```bash
wget https://raw.githubusercontent.com/raesene/TestingScripts/master/snmpv3enum.rb; ./snmpv3enum.rb
```

</details>

<details>

<summary>Onesixtyone</summary>

* Is a simple SNMP scanner which sends SNMP requests for the sysDescr value asynchronously

```
onesixtyone -c /usr/share/doc/onesixtyone/dict.txt 172.21.0.X
```

</details>

<details>

<summary>SNMP MIB Trees</summary>

* 1.3.6.1.2.1.25.1.6.0 - System Processes
* 1.3.6.1.2.1.25.4.2.1.2 - Running Programs
* 1.3.6.1.2.1.25.4.2.1.4 - Processes Path
* 1.3.6.1.2.1.25.2.3.1.4 - Storage Units
* 1.3.6.1.2.1.25.6.3.1.2 - Software Name
* 1.3.6.1.4.1.77.1.2.25 - User Accounts
* 1.3.6.1.2.1.6.13.1.3 - TCP Local Ports

</details>