📡

SNMP (Udp 161)

{% hint style="danger" %}

#services#adot8

source · oscp.adot8.com · services/snmp-less-than-udp-161-greater-than ↗

SNMP <udp 161>

{% hint style="danger" %} IF SNMP IS OPEN, COMB THROUGH IT THOROUGHLY {% endhint %}

code

01snmp-check 192.168.235.156 -c public -v 2c

SNMPwalk

<pre><code><strong>snmpwalk -c public -v1 10.10.11.136 . </strong>snmpwalk -c public -v2c 10.10.11.136 . snmpbulkwalk -c public -v2c 10.10.11.136 . </code></pre>

{% hint style="warning" %} snmpwalk -c public -v2c 192.168.235.156 NET-SNMP-EXTEND-MIB::nsExtendOutputFull

Credentials may be hiding in this MIB {% endhint %}

Sort based on uniqueness

code

01grep -oP '::.*?\.' snmpwalk | sort | uniq -c| sort -n

Running processes

code

01snmpwalk -c public -v1 192.168.229.151 1.3.6.1.2.1.25.4.2.1.2

Search for credentials or other applications running internally

{% hint style="info" %} hrSWRun and hrSWInstall can be of interest {% endhint %}

Brute force Community Strings

code

01public
02private
03manager

code

01onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings-onesixtyone.txt