Skip to main content

​
Discovery

nmap -sU -p 161 TARGET
nmap -sU -p 161 --script=snmp-info TARGET

​
Community String Brute-Force

​
onesixtyone

onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt TARGET
onesixtyone -c community.txt 10.10.10.0/24

​
Nmap

nmap -sU -p 161 --script=snmp-brute TARGET

​
Hydra

hydra -P community.txt TARGET snmp
Common strings: public, private, manager, community.

​
snmpwalk

​
v1

snmpwalk -v1 -c public TARGET

​
v2c

snmpwalk -v2c -c public TARGET

​
v3

snmpwalk -v3 -u username -l authPriv -a SHA -A 'authpass' -x AES -X 'privpass' TARGET

​
Useful OIDs

# System info
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.1

# Hostname
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.1.5

# Running processes
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2

# Installed software
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.6.3.1.2

# Open TCP ports
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.6.13.1.3

# Network interfaces
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.2.2.1.2

# Users (Windows)
snmpwalk -v2c -c public TARGET 1.3.6.1.4.1.77.1.2.25
OIDData
1.3.6.1.2.1.1System info
1.3.6.1.2.1.25.4.2.1.2Running processes
1.3.6.1.2.1.25.6.3.1.2Installed software
1.3.6.1.2.1.6.13.1.3Open TCP ports
1.3.6.1.4.1.77.1.2.25Windows users

​
snmpbulkwalk (Faster)

snmpbulkwalk -v2c -c public TARGET
snmpbulkwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2

​
snmp-check

snmp-check TARGET
snmp-check -c public TARGET
Enumerates: system info, users, processes, services, storage, network.

​
Extended Queries

​
Dump Everything

snmpwalk -v2c -c public TARGET . | tee snmp_full.txt

​
Search for Strings

snmpwalk -v2c -c public TARGET . | grep -i "password\|user\|login\|community"

​
Quick Reference

TaskCommand
Brute communityonesixtyone -c list.txt TARGET
Walk v2csnmpwalk -v2c -c public TARGET
Processessnmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2
Userssnmpwalk -v2c -c public TARGET 1.3.6.1.4.1.77.1.2.25
Full dumpsnmpwalk -v2c -c public TARGET .