Hack Like a Pro: How to Exploit SNMP for Reconnaissance « Null Byte :: WonderHowTo

Welcome back, my rookie hackers!The more we know about a system or network, the better our chances of owning it and not leaving a trace for investigators to follow. One of the often overlooked sources for information is the Simple Network Management Protocol (SNMP). Many rookie hackers are not even aware of it, but it can prove to be a treasure trove of information, if you understand how it works and how to hack it.How SNMP Can Help You Access Network DevicesSNMP runs on UDP (connectionless and efficient) on port 161 and enables a network administrator to gather information on and manage network devices. Each networked device responds with information about its make, model, etc. when queried by the master.All this information is then stored in a database called the Master Information Base (MIB). If we can access the MIB and know how to read and interpret the info, we can then know each and every device on the network. If we can crack the password on SNMP, we may be able to control each networked device. This would allow us to change configurations, take devices offline, etc.The Different Versions of SNMPThere are at least three versions of SNMP. The first, SNMPv1 or just SNMP, was not secure. SNMPv2 was developed to be more secure, but was not backwardly compatible to v1. SNMPv3 is secure and backwardly compatible, but very often, not implemented.SNMPv1 has a default community string (similar to a password) for the admin of "private" and a default community string for everyone and everything else of "public". The admin password permits the admin to change configurations of devices remotely, while the public password only allows us to view the info in the MIB. Many times, system admins leave these passwords in the default configuration due to lack of knowledge or laziness. Before you try any hack on SNMP, make certain you try these default passwords first.Even if the system admin does change the default passwords, they often change them to a variation of public/private or something else very simple. Generally, these passwords are relatively easy to brute-force with a dictionary attack.Exploiting SNMP for ReconIn this hack, we will look at what info we can harvest from the SNMP MIB if the network is using SNMPv1 and we know the community string. In a future tutorial, I'll show you how to break the community string.Step 1: Open BackTrackAll of the tools we need for this hack are built intoBackTrack, so we have no need to download or install any new software.Step 2: Open SnmpenumIn this hack, we will use a tool called snmpenum. It gathers information from the MIB over SNMP for any IP address, if we know the community string.To start, go toBackTrack->Information Gathering->Network Analysis->SNMP, and finally,snmpenum.Image viawonderhowto.comStep 3: Run SnmpenumWhen you click on snmpenum, it will open a terminal that will look like this.Note that the syntax for running snmpenum is fairly straightforward. All you need is the IP address, the community string, and the config file. If we do a long listing on this directory:ls -lWe can see that there are three text files that are our configuration files for snmpenum. We have one for Windows, one for Linux, and one for Cisco.In this case, we will be running snmpenum against a Windows machine that still has its default SNMP community string (password) set to "public" that is on our internal IP address of 192.168.1.101. Note that snmpenum is a Perl script, so it ends with .pl. To run it, we must precede it with the "./".Simply enter this information as follows:./snmpenum.pl 192.168.1.101 public windows.txtStep 4: Make Sense of It AllWhen we run snmpenum, it gathers all the information in the MIB database on the target machine and displays it on the screen. The amount of information covers several screens, but it will return users, installed software (see below), hostname, OS, uptime, services, open TCP ports, open UDP ports, and more!Here we see the listening ports:Here we can see all the running services:Now that we have gathered all this information on the system, we can better develop a strategy for exploiting it. We simply need to then find the known vulnerabilities for that OS, those services, those ports, etc.In addition, with the uptime, we can gauge when the system was last patched. If the the uptime is say, three months, we know that the system is vulnerable to any new vulnerabilities discovered in the last three months as a patch would require a reboot of the system.Keep coming back, my rookie hackers, for more adventures in hackerland!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Crack Private & Public SNMP Passwords Using OnesixtyoneHack Like a Pro:The Hacker MethodologyHack Like a Pro:How to Use Maltego to Do Network ReconnaissanceHack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)How To:The Five Phases of HackingHack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Advanced Penetration Testing - Part 1 (Introduction)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 7 (Autopwn)Hack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHow To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreHack Like a Pro:How Windows Can Be a Hacking Platform, Pt. 1 (Exploit Pack)Hack Like a Pro:How to Conduct Passive Reconnaissance of a Potential TargetHack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHack Like a Pro:Reconnaissance with Recon-Ng, Part 1 (Getting Started)Hack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHack Like a Pro:How to Conduct OS Fingerprinting with Xprobe2Hack Like a Pro:How to Cover Your Tracks So You Aren't DetectedHack Like a Pro:How to Find Almost Every Known Vulnerability & Exploit Out ThereHow To:Run an VNC Server on Win7Hack Like a Pro:How to Extract Metadata from Websites Using FOCA for WindowsHow to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)Hack Like a Pro:How to Find  Exploits Using the Exploit Database in KaliHack Like a Pro:How to Take Control of Windows Server 2003 Remotely by Launching a Reverse ShellHow to Hack Like a Pro:Hacking Windows Vista by Exploiting SMB2 VulnerabilitiesHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHacking Reconnaissance:Finding Vulnerabilities in Your Target Using NmapCommunity Byte:HackThisSite Walkthrough, Part 3 - Legal Hacker TrainingGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsHow To:The Official Google+ Insider's Guide Index