4

I'm attempting to issue an snmpget request to a device but i'm unable to determine the security name. Running the Nmap snmp-info.nse is successful and no Security Name is required to successfully run the script. Is there any way of retrieving the Security Name from this NSE script? I've checked the contents and there is no Security Name parameter anywhere.

1 Answer 1

2

Looks to be in the code as USM NoAuthNoPriv, as seen here -- https://svn.nmap.org/nmap/scripts/snmp-info.nse

You could verify with the net-snmp tools using the -l noAuthNoPriv flag. See the EXAMPLES section here -- http://www.net-snmp.org/tutorial/tutorial-5/commands/snmpv3.html -- the first one showing a completely unauthenicated request.

Here is another example: snmpget -v3 -u WEAK -l noAuthNoPriv myciscorouter1 sysName.0

3
  • Thanks @atdre I did a wireshark cap of what the nmap nse does and it appears to use a 'blank' username, so -u would be blank. The only issue now is, snmpget and snmpwalk will not accept blank/empty usernames. Any ideas? May 9, 2016 at 0:45
  • Did you try noAuthUser as the username?
    – atdre
    May 9, 2016 at 16:05
  • 1
    github.com/hatlord/snmpwn
    – atdre
    Jun 16, 2016 at 22:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.