Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-15 01:17:36 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #112 from clem9669/patch-5

Browse source 
Update Pentesting SNMP
This commit is contained in:
Carlos Polop 2021-05-25 23:51:28 +01:00 committed by GitHub
commit 97c49bdb7a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
pentesting/pentesting-snmp/README.md
View file

@ -89,6 +89,12 @@ To **guess the community string** you could perform a dictionary attack. Check [
## Enumerating SNMP
It is recommanded to install the following to see whats does mean **each OID gathered** from the device:
```bash
apt-get install snmp-mibs-downloader
download-mibs
```
If you know a valid community string, you can access the data using **SNMPWalk** or **SNMP-Check**:
```bash
@ -98,18 +104,13 @@ snmp-check [DIR_IP] -p [PORT] -c [COMM_STRING]
nmap --script "snmp* and not snmp-brute" <target>
```
To see whats does **means** each OID gathered from the device, it is recommended to **install**:
Thanks to extended queries (download-mibs), it is possible to enumerate even more about the system with the following command :
```bash
apt-get install snmp-mibs-downloader
download-mibs
snmpwalk -v X -c public <IP> NET-SNMP-EXTEND-MIB::nsExtendOutputFull
```
And **in** _**/etc/snmp/snmp.conf**_ **comment the line "mibs :"**
**It is recommended to install and configure this before launching any SNMP enumeration.**
**SNMP** has a lot of information about the host and things that you may find interesting are: **Network interfaces** \(IPv4 and **IPv6** address\) and **processes running** \(may contain passwords\)....
**SNMP** has a lot of information about the host and things that you may find interesting are: **Network interfaces** (IPv4 and **IPv6** address), Usernames, Uptime, Server/OS version, and **processes running** (may contain passwords)....
## From SNMP to RCE