> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # 161 & 162 - SNMP (Simple Network Management Protocol) `Default Ports: 161/UDP (queries), 162/UDP (traps)` SNMP exists to let network devices report status and accept configuration remotely, routers, switches, printers, and plenty of embedded devices all speak it by default. The catch is its authentication model: versions 1 and 2c rely entirely on a "community string," a shared password sent in plaintext, and a huge number of devices still ship with it left on the default `public`. > **Read-Only Community** > > Usually named `public` by default. Lets you query device information, running processes, interfaces, and configuration, often without ever needing a password guess beyond the default. > **Read-Write Community** > > Usually named `private` by default. Lets you modify device configuration through SNMP `SET` operations, on some devices this is a direct path to code execution. > [!NOTE] > > SNMPv1 and v2c send everything, including the community string, in plaintext. SNMPv3 adds real authentication and encryption, if you find v3 in use, the tools and techniques below mostly won't apply the same way. > [!TIP] > > Always try `public` and `private` before brute-forcing anything. Default community strings are still the single most common finding on SNMP services in the wild. *** ## Nmap Enumeration SNMP runs over UDP, so scans need `-sU` explicitly, it won't show up in a normal TCP scan at all. ```bash theme={null} nmap -sU -p161 --script snmp-info TARGET ``` Running every SNMP script at once gives the broadest first look, worth saving straight to a file given how much output it can produce: ```bash theme={null} nmap -sU -p161 --script "snmp-*" TARGET -oN snmp-info.txt ``` Nmap can also brute-force community strings directly, a reasonable first attempt before reaching for a dedicated tool: ```bash theme={null} nmap -sU -p161 --script snmp-brute TARGET ``` *** ## Enumeration Tools Once you've got a working community string, several tools cover querying OIDs (the identifiers SNMP uses to reference specific pieces of data) with different strengths. **snmpwalk** Walks the entire OID tree the community string has access to, the standard first command once you have a working string. ```bash theme={null} snmpwalk -v1 -c public TARGET snmpwalk -v2c -c public TARGET ``` Narrowing to a specific OID branch cuts down the noise once you know what you're looking for: ```bash theme={null} snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2 # running processes ``` **snmp-check** Formats the same data `snmpwalk` returns into readable categories (system info, network interfaces, processes, installed software) rather than a raw OID dump, often the faster tool for a quick read. ```bash theme={null} snmp-check -c public TARGET ``` **onesixtyone** Built specifically for brute-forcing community strings quickly across one or many hosts, rather than querying data. ```bash theme={null} onesixtyone -c community-strings.list TARGET ``` **braa** Brute-forces individual OID values once you already have a valid community string, useful for pulling a specific branch of data fast without walking the entire tree. ```bash theme={null} braa public@TARGET:.1.* ``` > **Custom community string brute-force loop** > > When the dedicated tools aren't available or you want to see live output per attempt, a simple loop against a wordlist works just as well: > > ```bash theme={null} > for community in $(cat /usr/share/metasploit-framework/data/wordlists/snmp_default_pass.txt); do > echo "Trying community string: $community" > snmpwalk -v2c -c $community TARGET | head -10 > done > ``` *** ## Useful OIDs Rather than walking the entire tree every time, these specific branches are usually the ones worth checking first. | OID | Data | | - | - | | `1.3.6.1.2.1.1.1.0` | System description | | `1.3.6.1.2.1.1.5.0` | Hostname | | `1.3.6.1.2.1.25.1.6.0` | System processes | | `1.3.6.1.2.1.25.4.2.1.2` | Running processes (full list) | | `1.3.6.1.2.1.25.6.3.1.2` | Installed software | | `1.3.6.1.4.1.77.1.2.25` | Windows user accounts | | `1.3.6.1.2.1.6.13.1.3` | TCP listening ports | | `1.3.6.1.2.1.2.2.1.2` | Network interfaces | > [!TIP] > > The Windows user account OID is worth prioritizing on any Windows target running SNMP, it often returns a full local user list with no authentication needed beyond the community string itself. *** ## Write Access and Configuration Changes > [!WARNING] > > Confirming write access and especially pushing a configuration change are active, potentially disruptive actions. Confirm scope explicitly covers this before testing `SET` operations against a live device. If a device accepts the default `private` string (or any guessed write community), `snmpset` can modify its configuration directly. On some network appliances this extends to actions like changing routing behavior or, on older/embedded devices, even pushing firmware or configuration changes that lead to code execution. ```bash theme={null} snmpset -v2c -c private TARGET OID TYPE VALUE ``` Confirming write access without actually changing anything meaningful is the safer first step, setting a harmless value like the system's contact info and checking whether it persists: ```bash theme={null} snmpset -v2c -c private TARGET 1.3.6.1.2.1.1.4.0 s "test" ``` *** ## Quick Reference Tools > **[Hackviser: SNMP](https://hackviser.com/tactics/pentesting/services/snmp)** > > Quick-reference pentesting guide for the SNMP service. > **[HackTricks: SNMP](https://hacktricks.wiki/en/network-services-pentesting/pentesting-snmp/index.html)** > > Deeper breakdown of SNMP enumeration and exploitation techniques. > [!WARNING] > > Read-write community strings can let you reconfigure production network devices. Treat a confirmed write community as a critical finding and avoid making changes beyond what's needed to prove access. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.