> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/snmp-discovery/snmpwalk.md). # snmpwalk Retrieve a subtree of management values using SNMP GETNEXT requests ## Enumeration ### Full enumeration ```bash snmpwalk -c public -v1 -t 10 $TARGET_IP ``` ### Windows User Enumeration The following example enumerates the Windows users on a machine: ```bash snmpwalk -c public -v1 $TARGET_IP 1.3.6.1.4.1.77.1.2.25 ```
Example run ```bash kali@kali:~$ snmpwalk -c public -v1 192.168.50.151 1.3.6.1.4.1.77.1.2.25 iso.3.6.1.4.1.77.1.2.25.1.1.5.71.117.101.115.116 = STRING: "Guest" iso.3.6.1.4.1.77.1.2.25.1.1.6.107.114.98.116.103.116 = STRING: "krbtgt" iso.3.6.1.4.1.77.1.2.25.1.1.7.115.116.117.100.101.110.116 = STRING: "student" iso.3.6.1.4.1.77.1.2.25.1.1.13.65.100.109.105.110.105.115.116.114.97.116.111.114 = STRING: "Administrator" ```
### Windows Process Enumeration we can enumerate all the currently-running processes: ```bash snmpwalk -c public -v1 $TARGET_IP 1.3.6.1.2.1.25.4.2.1.2 ```
Example run ```bash kali@kali:~$ snmpwalk -c public -v1 192.168.50.151 1.3.6.1.2.1.25.4.2.1.2 iso.3.6.1.2.1.25.4.2.1.2.1 = STRING: "System Idle Process" iso.3.6.1.2.1.25.4.2.1.2.4 = STRING: "System" iso.3.6.1.2.1.25.4.2.1.2.88 = STRING: "Registry" iso.3.6.1.2.1.25.4.2.1.2.260 = STRING: "smss.exe" iso.3.6.1.2.1.25.4.2.1.2.316 = STRING: "svchost.exe" iso.3.6.1.2.1.25.4.2.1.2.372 = STRING: "csrss.exe" iso.3.6.1.2.1.25.4.2.1.2.472 = STRING: "svchost.exe" iso.3.6.1.2.1.25.4.2.1.2.476 = STRING: "wininit.exe" iso.3.6.1.2.1.25.4.2.1.2.484 = STRING: "csrss.exe" iso.3.6.1.2.1.25.4.2.1.2.540 = STRING: "winlogon.exe" iso.3.6.1.2.1.25.4.2.1.2.616 = STRING: "services.exe" iso.3.6.1.2.1.25.4.2.1.2.632 = STRING: "lsass.exe" iso.3.6.1.2.1.25.4.2.1.2.680 = STRING: "svchost.exe" ... ```
## MIB values The following MIB values correspond to specific Microsoft Windows SNMP parameters and contain much more than network-based information:
MIB-valueDescription
1.3.6.1.2.1.25.1.6.0System Processes
1.3.6.1.2.1.25.4.2.1.2Running Programs
1.3.6.1.2.1.25.4.2.1.4Processes Path
1.3.6.1.2.1.25.2.3.1.4Storage Units
1.3.6.1.2.1.25.6.3.1.2Software Name
1.3.6.1.4.1.77.1.2.25User Accounts
1.3.6.1.2.1.6.13.1.3TCP Local Ports
## Usage information
snmpwalk -h ```bash ┌──(kali㉿kali)-[~] └─$ snmpwalk -h USAGE: snmpwalk [OPTIONS] AGENT [OID] Version: 5.9.4.pre2 Web: http://www.net-snmp.org/ Email: net-snmp-coders@lists.sourceforge.net OPTIONS: -h, --help display this help message -H display configuration file directives understood -v 1|2c|3 specifies SNMP version to use -V, --version display package version number SNMP Version 1 or 2c specific -c COMMUNITY set the community string SNMP Version 3 specific -a PROTOCOL set authentication protocol (MD5|SHA|SHA-224|SHA-256|SHA-384|SHA-512) -A PASSPHRASE set authentication protocol pass phrase -e ENGINE-ID set security engine ID (e.g. 800000020109840301) -E ENGINE-ID set context engine ID (e.g. 800000020109840301) -l LEVEL set security level (noAuthNoPriv|authNoPriv|authPriv) -n CONTEXT set context name (e.g. bridge1) -u USER-NAME set security name (e.g. bert) -x PROTOCOL set privacy protocol (DES|AES|AES-192|AES-256) -X PASSPHRASE set privacy protocol pass phrase -Z BOOTS,TIME set destination engine boots/time General communication options -r RETRIES set the number of retries -t TIMEOUT set the request timeout (in seconds) Debugging -d dump input/output packets in hexadecimal -D[TOKEN[,...]] turn on debugging output for the specified TOKENs (ALL gives extremely verbose debugging output) General options -m MIB[:...] load given list of MIBs (ALL loads everything) -M DIR[:...] look in given list of directories for MIBs (default: $HOME/.snmp/mibs:/usr/share/snmp/mibs:/usr/share/snmp/mibs/iana:/usr/share/snmp/mibs/ietf) -P MIBOPTS Toggle various defaults controlling MIB parsing: u: allow the use of underlines in MIB symbols c: disallow the use of "--" to terminate comments d: save the DESCRIPTIONs of the MIB objects e: disable errors when MIB symbols conflict w: enable warnings when MIB symbols conflict W: enable detailed warnings when MIB symbols conflict R: replace MIB symbols from latest module -O OUTOPTS Toggle various defaults controlling output display: 0: print leading 0 for single-digit hex characters a: print all strings in ascii format b: do not break OID indexes down e: print enums numerically E: escape quotes in string indices f: print full OIDs on output n: print OIDs numerically p PRECISION: display floating point values with specified PRECISION (printf format string) q: quick print for easier parsing Q: quick print with equal-signs s: print only last symbolic element of OID S: print MIB module-id plus last element t: print timeticks unparsed as numeric integers T: print human-readable text along with hex strings u: print OIDs using UCD-style prefix suppression U: don't print units v: print values only (not OID = value) x: print all strings in hex format X: extended index format -I INOPTS Toggle various defaults controlling input parsing: b: do best/regex matching to find a MIB node h: don't apply DISPLAY-HINTs r: do not check values for range/type legality R: do random access to OID labels u: top-level OIDs must have '.' prefix (UCD-style) s SUFFIX: Append all textual OIDs with SUFFIX before parsing S PREFIX: Prepend all textual OIDs with PREFIX before parsing -L LOGOPTS Toggle various defaults controlling logging: e: log to standard error o: log to standard output n: don't log at all f file: log to the specified file s facility: log to syslog (via the specified facility) (variants) [EON] pri: log to standard error, output or /dev/null for level 'pri' and above [EON] p1-p2: log to standard error, output or /dev/null for levels 'p1' to 'p2' [FS] pri token: log to file/syslog for level 'pri' and above [FS] p1-p2 token: log to file/syslog for levels 'p1' to 'p2' -C APPOPTS Set various application specific behaviours: p: print the number of variables found i: include given OID in the search range I: don't include the given OID, even if no results are returned c: do not check returned OIDs are increasing t: Display wall-clock time to complete the walk T: Display wall-clock time to complete each request E {OID}: End the walk at the specified OID ```
## Resources Net-SNMP - Homepage: Pentesting SNMP - HackTricks: snmpwalk - Kali Tools: