Skip to content

SNMP enumeration

1. Context & stakes

Enumerate via weak community strings.

SNMP v1 and v2c authenticate with a plaintext community string that is often left at public or private, and a read community exposes the entire device configuration, routing tables and interface data. Enumerating it is a one-packet reconnaissance win and sometimes a write-access compromise. SNMPv3 with per-user auth and privacy, and removing default communities, are the fixes.

2. Theory

SNMP manages devices via a MIB tree, authenticated in v1/v2c only by a plaintext community string (often 'public'/'private'). Guessing it lets an attacker walk the MIB (config, ARP/routing tables, interfaces) and sometimes write. SNMPv3 adds real auth+privacy; management ACLs restrict who may ask.

3. Attack (PoC)

netlab-snmp attack --i-own-this-network --iface veth-host
  1. Brute communities (public/private)
  2. Walk the MIB

4. Detection

netlab-snmp detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • SNMPv3 (auth+priv)
  • Management ACL

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading