So, I've come across a couple of devices that are using default writable community names for SNMP such as 'private' (on windows machines) and 'Secret c0de' (on Brocade switches).
I'm aware of the implications in terms of using SNMP for recon, and i'm aware of the attacks against Cisco devices to both reset the device passwords and to dump the configuration of the switch. With that in mind, it appears that back in the day it was possible to dump hashes from Windows machines by running something along the lines of
C:\NTRESKIT>snmputil walk public .22.214.171.124.126.96.36.199.2.25
Unfortunately, that no longer works for more modern versions of Windows (I'm actually testing a relatively up-to-date server 2003 box and it's not working) and I'm curious if there's any other methods to dump passwords (Local/Domain hashes or anything else) via SNMP available (either for Windows or for other switches like the aforementioned Brocade switches).
Is there anything else a writeable SNMP community string might be useful for as an attacker that I'm forgetting?