- SNPM or a Simple Network Management Protocol
is another one of those protocols that's been around
for a really long time,
and you can extract a lot of information from it.
It's primarily used on networking devices.
So for example, Cisco routers and switches,
provided it's configured and you can access it,
you can extract a lot of information,
and of course you're gonna need to know a password two,
however.
Let's run through the points here.
So SNMP is used for management and monitoring of devices
on the network.
It doesn't have to be a router or a switch.
It could be a server running an SNMP agent
that you can talk to.
You can poll it.
It's also configuration that can occur.
You can actually write to these various objects
within an SNMP enabled system.
So sometimes you need to be aware of a manager.
An SNMP manager is a system that's going to poll
SNMP enabled devices to gather information.
We haven't touched on traps yet.
So SNMP operates as poll and trap.
So you can poll to request information
and an SNMP system can proactively trap
or send notifications to the manager.
So the manager's job is to poll proactively,
and receive reactive traps.
For example, let me give you an example.
You got a Cisco router and it's got an ethernet interface
as the WAN.
That interface goes down.
You can configure that system to trap
to the SNMP manager that the interface is down,
and then the manager's job is to alert the administrators,
"Hey, WAN interface went down.
We should probably take a look at that."
Agents exist on all of the devices in the network
where SNMP is enabled, or some sort of agent is installed.
Again, going back to the Cisco example,
all Cisco devices have an SNMP agent on them,
you just have to configure it to turn it on.
And as I mentioned, it is common to see SNMP
running on devices on the network.
Because you need to monitor your network,
you need to know what it looks like.
Are you hitting any thresholds?
Things like that.
There are two passwords in SNMP.
Those two passwords are not public and private.
What I mean is there's a read-only password
and a read-write password.
That read only password,
and they're not called passwords, by the way,
they're called community strings.
The read-only community string
and a read-write community string.
As you can imagine, the read-write community string
should be considered more sensitive
because you can actually change the configuration
of the device.
And what you'll see is that
you'll often see public and private used
in SNMP configurations.
It's a misconfigured SNMP agent
if they're using public and private
for their community strings.
All the examples you'll see in text, public and private.
Because of that, people go and type public and private.
So, can you enumerate information from that SNMP agent?
There's three versions for SNMP.
First one, version one, it's all plain text,
32-bit counters that can be overflowed quite easily,
4 billion is not that big a number in this day and age.
V2c came out afterwards,
it added 64-bit counters,
and we didn't get to encryption of data
as well as authentication until version three.
And you'll often see v1 and v2c
are the versions that are out there being used.
Now, I talked about 32-bit counters.
4 billion is, it's a big number, of course,
but in terms of network interfaces that are passing,
you know, terabits a day, 32 bits is not gonna cover it.
So that's why they added 64-bit counters in v2c,
but they did not add encryption and authentication
until SNMP version three.
SNMP version three has been around for a long time still,
just not as long as v1 and v2c.
The prevalent protocol out there is v2c
because of the 64-bit counter
and the ease of configuration of it.
V3 gets a little complicated
cause you gotta manage passwords and whatnot.
So most networks out there today are still doing version 2c.
SNMP, it's a tree like structure.
It's a database of information.
There are objects within this management information base,
or MIB, that identify leaves of the tree, if you will.
So the notation for these object identifiers here is ASN.1
or Abstract Syntax Notation One.
And these are all device dependent.
What you'll need to do is decode it,
and that's where something like OID view or OidView
comes into play,
Go into oidview.com.
You can go in there and figure out what these numbers mean
that you see when looking at the object identifiers.
Because whenever you do an SNMP walk,
which we're gonna talk about here in just a second,
you're gonna see these OIDs.
You need to translate that information.
And here's an example of an SNMP walk.
So we have here a Cisco 1841.
It's a pretty old router these days, running SNMP.
That configuration on that router
is SNMP dash server community public read-only 10.
So this is a read only community string.
That's the actual community string right there.
The word public, that is the quote on quote password
to get information.
The RO 10, read-only,
means it's a read-only community string,
and the 10 is an access list
that is applied to the SNMP agent.
On this system, we're running Ubuntu,
comes with SNMP walk pre-installed.
We can run SNMP walk dash v2c,
cause we wanna use version 2C.
Community string.
That's the minus C command line switch of public.
We give it a host,
and then I just pipe it the ahead so we can see
the first 10 lines.
And even in the first 10 lines
we can get some useful information.
Right here, string R1841, that is the host name,
the actual configured host name of this router.
So as you're discovering systems out there, what's alive,
if you see a .1 or a .254,
there's a good chance that's a router.
If it's a router, that means it's a network device.
Does it have SNMP configured?
Try to walk it.
See what kind of information you can get,
and then maybe start brute forcing community strings.
You know, admin, God, Cisco 123, public, private.
Try these various community strings
that might commonly be used by lazy administrators.
No offense, public and private deployers.
Another command I ran right here is piping that same command
to word count minus L to see the number of lines.
We have 4,873 lines returned from an SNMP walk.
It takes a little while to do it,
but the amount of information you can get.
If you're able to get just the first chunk,
you can get the rest of it.
There's all kinds of information in there.
IP addresses, utilization on interfaces.
If you see that one ethernet interface
has the majority of the traffic,
that's where you wanna look.
What's going into and out of that interface.
You're not gonna be able to see that from SNMP.
However, it gives you a place to focus.
Is there a system on that subnet
that that interface is plugged into, that you can access
and then see what traffic is going across the network?
Another tool: OpUtils, from ManageEngine,
will allow you to poll or walk an SNMP agent.
This is a screenshot of that tool in action.
SolarWinds also has their network discovery
and diagram capability is built on,
not just SNMP but ICMP and other tools,
but, and other protocols.
But it does include SNMP monitoring,
including trap reception.
With this topology information you can get from SNMP,
then you can build a diagram.
Let me give you an example of what I mean by that.
If you have five routers,
and they're all plugged in in like a pentagon,
just as an example.
You poll router A, and it's got two ethernet interfaces.
You poll router B, it's got two ethernet interfaces.
Where you see the IP address and subnet overlap,
they're plugged into the same broadcast domain.
It's the same switched network
that those two interfaces are plugged into, most likely.
It's possible to have overlapping IPs
plugged into different parts of the network.
but most of the time,
these two interfaces are gonna be
connected to each other logically,
meaning they have the same broadcast domain between them.
Some more tools for SNMP enumeration to be aware of:
SNMP walk, we took a look at a screenshot of that.
Net-SNMP, Getif, Spiceworks, SNMP Scanner,
and SNMP informant.