SNMP[161]
Basics
Overview
SNMP is used for monitoring and managing network devices.
Supports configuration tasks and remote settings changes.
Common SNMP-enabled devices: routers, switches, servers, IoT devices.
Current version: SNMPv3, which enhances security but increases complexity.
Communication Mechanism
Uses UDP port 161 for information exchange and control commands.
Allows clients to set values, change options, and settings on network devices.
Supports SNMP traps (UDP port 162), enabling devices to send alerts without a request.
Requires unique SNMP object addresses for successful data transmission.
Management Information Base (MIB)
Ensures SNMP access works across manufacturers and different client-server combinations.
MIB is a text file listing all queryable SNMP objects in a standardized tree hierarchy.
Each Object Identifier (OID) provides:
Unique address
Name
Data type
Access rights
Description
MIBs do not store data but explain where to find specific information.
Object Identifier (OID)
OID represents a node in a hierarchical namespace.
Dot notation sequence of numbers uniquely identifies each node.
Longer sequences indicate more specific information.
Some OID nodes serve only as references to other nodes.
MIBs can be looked up in Object Identifier Registry.
SNMP Versions
SNMPv1
First version, still used in small networks.
Supports:
Information retrieval from network devices.
Device configuration.
Traps (event notifications).
Security Issues:
No authentication mechanism (anyone can access data).
No encryption (data sent in plain text, vulnerable to interception).
SNMPv2 (SNMPv2c)
Community-based SNMP.
Additional functions compared to SNMPv1.
Security Issues:
Community string is transmitted in plain text.
No built-in encryption.
SNMPv3
Improved security with:
Authentication using username and password.
Encryption using a pre-shared key.
More complex configuration than SNMPv2c.
Community Strings
Act as passwords to control information access.
Security concerns:
SNMPv2 is still widely used due to complex SNMPv3 transition.
Community strings are sent in plain text and can be intercepted.
Lack of knowledge about how attackers exploit SNMP makes networks vulnerable.
Summary
SNMP is essential for network monitoring and management.
SNMPv1 and SNMPv2c have security vulnerabilities due to lack of encryption.
SNMPv3 offers security improvements but requires more complex configuration.
MIBs and OIDs structure SNMP data, ensuring interoperability across devices.
Community strings are a security risk if not properly secured.
Organizations must balance security and usability when choosing an SNMP version.
Default Configuration
The default configuration of the SNMP daemon defines the basic settings for the service, which include the IP addresses, ports, MIB, OIDs, authentication, and community strings.
SNMP Daemon Config
SNMP
z3tssu@htb[/htb]$ cat /etc/snmp/snmpd.conf | grep -v "#" | sed -r '/^\s*$/d'
sysLocation Sitting on the Dock of the Bay
sysContact Me <me@example.org>
sysServices 72
master agentx
agentaddress 127.0.0.1,[::1]
view systemonly included .1.3.6.1.2.1.1
view systemonly included .1.3.6.1.2.1.25.1
rocommunity public default -V systemonly
rocommunity6 public default -V systemonly
rouser authPrivUser authpriv -V systemonlyThe configuration of this service can also be changed in many ways. Therefore, we recommend setting up a VM to install and configure the SNMP server ourselves. All the settings that can be made for the SNMP daemon are defined and described in the manpage.
Dangerous Settings
Some dangerous settings that the administrator can make with SNMP are:
Settings
Description
rwuser noauth
Provides access to the full OID tree without authentication.
rwcommunity <community string> <IPv4 address>
Provides access to the full OID tree regardless of where the requests were sent from.
rwcommunity6 <community string> <IPv6 address>
Same access as with rwcommunity with the difference of using IPv6.
Cheatsheet
Command
Description
snmpwalk -v2c -c <community string> <FQDN/IP>
Querying OIDs using snmpwalk.
onesixtyone -c community-strings.list <FQDN/IP>
Bruteforcing community strings of the SNMP service.
braa <community string>@<FQDN/IP>:.1.*
Bruteforcing SNMP service OIDs.
Footprinting the Service
For footprinting SNMP, we can use tools like snmpwalk, onesixtyone, and braa.
Snmpwalkis used to query the OIDs with their information.Onesixtyonecan be used to brute-force the names of the community strings since they can be named arbitrarily by the administrator. Since these community strings can be bound to any source, identifying the existing community strings can take quite some time.
SNMPwalk
In the case of a misconfiguration, we would get approximately the same results from snmpwalk as just shown above. Once we know the community string and the SNMP service that does not require authentication (versions 1, 2c), we can query internal system information like in the previous example.
OneSixtyOne
OneSixtyOne
If we do not know the community string, we can use onesixtyone and SecLists wordlists to identify these community strings.
Often, when certain community strings are bound to specific IP addresses, they are named with the hostname of the host, and sometimes even symbols are added to these names to make them more challenging to identify. However, if we imagine an extensive network with over 100 different servers managed using SNMP, the labels, in that case, will have some pattern to them. Therefore, we can use different rules to guess them. We can use the tool crunch to create custom wordlists. Creating custom wordlists is not an essential part of this module, but more details can be found in the module Cracking Passwords With Hashcat.
Once we know a community string, we can use it with braa to brute-force the individual OIDs and enumerate the information behind them.
Braa
Once again, we would like to point out that the independent configuration of the SNMP service will bring us a great variety of different experiences that no tutorial can replace. Therefore, we highly recommend setting up a VM with SNMP, experimenting with it, and trying different configurations. SNMP can be a boon for an I.T. systems administrator as well as a curse for Security analysts and managers alike.
Last updated