> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/snmp.md).

# SNMP

**SNMP** (Simple Network Management Protocol) is used for monitoring and managing network devices. If SNMP is misconfigured (e.g., default or weak community strings), it can leak sensitive system information such as users, processes, network configs, and running services.

***

### Default SNMP Ports

| Port | Protocol | Description               |
| ---- | -------- | ------------------------- |
| 161  | UDP      | SNMP agent (query)        |
| 162  | UDP      | SNMP trap (notifications) |

***

### Initial Discovery

Check for open SNMP port (161/UDP):

```bash
nmap -sU -p 161 <target-ip>
```

***

### Nmap Scripts for SNMP Enumeration

```bash
nmap -sU -p 161 --script=snmp-info,snmp-interfaces,snmp-netstat,snmp-processes <target-ip>
```

| Script            | Purpose                                      |
| ----------------- | -------------------------------------------- |
| `snmp-info`       | Retrieves system info (hostname, OS, uptime) |
| `snmp-interfaces` | Lists network interfaces                     |
| `snmp-netstat`    | Displays active TCP/UDP connections          |
| `snmp-processes`  | Lists running processes on the system        |

***

### SNMP Enumeration Tools

#### 1. **snmpwalk**

Walk through the SNMP MIB tree to extract data using the community string (usually `public` by default):

```bash
snmpwalk -v2c -c public <target-ip>
```

Specific OIDs:

```bash
snmpwalk -v2c -c public <target-ip> 1.3.6.1.2.1.1       # System Info
snmpwalk -v2c -c public <target-ip> 1.3.6.1.2.1.25.6.3  # Installed Software
```

***

#### 2. **snmpcheck**

```bash
snmpcheck -t <target-ip> -c public
```

Provides quick summaries of users, processes, shares, etc.

***

#### 3. **snmpget**

Great continuation! Let me help you complete the section for `**snmpget**`, then add further exploitation and post-enumeration techniques to round out your **SNMP Enumeration** methodology.

***

#### 3. **snmpget**

`snmpget` is used to retrieve a single OID value directly, useful when you know exactly what you're looking for.

```bash
snmpget -v2c -c public <target-ip> 1.3.6.1.2.1.1.1.0
```

This command fetches the system description string (like OS and device info).

***

### Common OIDs (Object Identifiers)

| OID                      | Description                     |
| ------------------------ | ------------------------------- |
| `1.3.6.1.2.1.1.1.0`      | System description (OS, device) |
| `1.3.6.1.2.1.1.5.0`      | Hostname                        |
| `1.3.6.1.2.1.25.4.2.1.2` | Running processes               |
| `1.3.6.1.2.1.25.6.3.1.2` | Installed software              |
| `1.3.6.1.2.1.25.1.6.0`   | Number of running processes     |
| `1.3.6.1.2.1.4.20.1.1`   | Network IP addresses            |
| `1.3.6.1.2.1.4.21.1.1`   | Routing table                   |

***

### SNMP Write Access (Exploitation)

If SNMP write access is allowed (`read-write` community string like `private`), you can **set values** on the remote host using `snmpset`:

```bash
snmpset -v2c -c private <target-ip> <OID> <type> <value>
```

Example:

```bash
snmpset -v2c -c private <target-ip> 1.3.6.1.4.1.2021.4.5.0 i 2048
```

{% hint style="danger" %}
Can be used to alter system configuration or reboot a device if OIDs support it.
{% endhint %}