SNMP enumeration

SNMP (Simple Network Management Protocol) is used to monitor and manage network devices. It listens on UDP/161, and that is its trap: since many quick scans only look at TCP, an open SNMP goes unnoticed. When TCP ports lead nowhere, scanning UDP is mandatory.

Discover the port and the community

In SNMPv1/v2c the "access control" is a simple shared password, the community string. By default it is usually public (read) and private (read/write). First confirm the port and, if public does not work, try a list of communities in bulk:

sudo nmap -sU -p161 --open <ip>                  # is UDP 161 open?
onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt <ip>

Dump the MIB

The MIB tree (organized in OIDs) can reveal processes, installed software, interfaces, users, routes, and even configuration strings with service names or credentials the administrator entered without thinking they would be readable:

snmpwalk -v2c -c public <ip>                             # full dump
snmpbulkwalk -v2c -c public <ip> .1                      # much faster (GETBULK)
snmp-check <ip> -c public                                # readable output (users, processes, network)
braa public@<ip>:.1.3.6.*                                # fast brute force of OIDs
# high-value OIDs:
snmpwalk -v2c -c public <ip> 1.3.6.1.2.1.25.4.2.1.2      # running processes (hrSWRunName)
snmpwalk -v2c -c public <ip> 1.3.6.1.2.1.25.6.3.1.2      # installed software
snmpwalk -v2c -c public <ip> 1.3.6.1.4.1.77.1.2.25       # users (LanMgr, Windows)
snmpwalk -v2c -c public <ip> 1.3.6.1.2.1.25.4.2.1.5      # command line of each process (credentials!)

The process command line (hrSWRunParameters) is especially juicy: it often contains passwords passed as arguments.

SNMPv3

SNMPv3 does add authentication and encryption, but it can still enumerate users without credentials, which feeds a later password-spraying:

snmpwalk -v3 -l noAuthNoPriv -u <user> <ip>              # probe for a valid user

Requirements

UDP connectivity to 161 and, in v1/v2c, knowing or guessing the read community. It is pure enumeration: SNMP is rarely the final target but the piece that guides the attack (on UnderPass it revealed the internal daloRADIUS service and the domain, redirecting all enumeration to the real entry point).

How to detect it. The probe is connectionless UDP, so the signature is one of volume and pattern: a single source doing a snmpwalk/snmpbulkwalk generates hundreds of sequential GET-NEXT over the same agent in seconds, very different from a known monitoring system's periodic query. Attempts with several community strings (onesixtyone) appear as a burst of requests with different values from an IP that is not the NMS. A network IDS inspecting UDP/161 and an allowlist of management stations give away any unexpected source.

Defence. Change default communities, restrict SNMP to management hosts (ACL on the agent and firewall), do not expose it to the Internet, and migrate to SNMPv3 with authentication and encryption. It feeds password-spraying and credential reuse when what leaks is users or passwords.