4

I'm attempting to issue an snmpget request to a device but i'm unable to determine the security name. Running the Nmap snmp-info.nse is successful and no Security Name is required to successfully run the script. Is there any way of retrieving the Security Name from this NSE script? I've checked the contents and there is no Security Name parameter anywhere.

2

Looks to be in the code as USM NoAuthNoPriv, as seen here -- https://svn.nmap.org/nmap/scripts/snmp-info.nse

You could verify with the net-snmp tools using the -l noAuthNoPriv flag. See the EXAMPLES section here -- http://www.net-snmp.org/tutorial/tutorial-5/commands/snmpv3.html -- the first one showing a completely unauthenicated request.

Here is another example: snmpget -v3 -u WEAK -l noAuthNoPriv myciscorouter1 sysName.0

3
  • Thanks @atdre I did a wireshark cap of what the nmap nse does and it appears to use a 'blank' username, so -u would be blank. The only issue now is, snmpget and snmpwalk will not accept blank/empty usernames. Any ideas? – 16b7195abb140a3929bbc322d1c6f1 May 9 '16 at 0:45
  • Did you try noAuthUser as the username? – atdre May 9 '16 at 16:05
  • 1
    github.com/hatlord/snmpwn – atdre Jun 16 '16 at 22:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.