7

So, I've come across a couple of devices that are using default writable community names for SNMP such as 'private' (on windows machines) and 'Secret c0de' (on Brocade switches).

I'm aware of the implications in terms of using SNMP for recon, and i'm aware of the attacks against Cisco devices to both reset the device passwords and to dump the configuration of the switch. With that in mind, it appears that back in the day it was possible to dump hashes from Windows machines by running something along the lines of

C:\NTRESKIT>snmputil walk public .1.3.6.1.4.1.77.1.2.25

Unfortunately, that no longer works for more modern versions of Windows (I'm actually testing a relatively up-to-date server 2003 box and it's not working) and I'm curious if there's any other methods to dump passwords (Local/Domain hashes or anything else) via SNMP available (either for Windows or for other switches like the aforementioned Brocade switches).

Is there anything else a writeable SNMP community string might be useful for as an attacker that I'm forgetting?

5

1.3.6.1.4.1.77.1.2.25 is only one OID (Object ID, or some people call it 'MIB value') you can use to extract some information from an enumerable SNMP service. OIDView keeps a comprehensive list of more than 7000 MIB values from more than 500 vendors.

My personal favorites for Microsoft Windows are

  • 1.3.6.1.2.1.25.4.2.1.2 gives you a list of all running processes on the machine. Very handy to figure out the possibility of, say, future escalation vulnerability if a specific application is running.

  • 1.3.6.1.2.1.25.6.3.1.2 gives you a list of installed software and Windows hotfixes & updates. Very useful to probe for missing patches in, say, IE. Now you can send a link to a specific exploit to the user of that machine via email.

  • 1.3.6.1.2.1.25.6.3.1.5 gives you a list of when those patches were installed. Very nice to know how often the system is maintained. Gives you ideas on how to proceed with your post-exploitation.

  • 1.3.6.1.4.1.311.1.13 gives you entries in the vent log. Very good to trace crashes in certain applications.

and the list goes on and on, and not just for Microsoft Windows, but also for hundreds of other products.

| improve this answer | |
  • That's all good, but they're all read-only accessible as well. I get that stuff from most of the SNMP recon tools anyway. I'm more interested in writable resources and password-specific OID's... – NULLZ May 27 '14 at 0:22
2
+25

I remember requiring a read/write community string to order a cisco router to dump its config over tftp to "filename" on host ip1.ip2.ip3.ip4 by sending a PDU with the equivalent of SNMP SET n1.n2.....nn[ip1.ip2.ip3.ip4]="filename".

There was a lot you could gather from those configs. I used this to scan routers twice a day and check in config changes into source control, so we could keep a tab on the outsourcing party who maintained the devices.

I seem to recall that cisco used to obfuscate passwords with a rather insecure method in those config files. Another way of abusing rw community strings would be to order the router to load a config, or to reboot. All of which could be used in a Denial of Service attack.

This was close to twenty years ago. This was before SSH became common practice, and I wouldn't leave hosts around with community string based snmp access today.

| improve this answer | |
  • 2
    Oh level 7 passwords were the bomb diggity. – h4ckNinja Apr 10 '16 at 22:12
  • It's been a long time since I worked intimately with cisco kit, but that rings a bell. Good against over the shoulder snooping but not much else. – Henk Langeveld Apr 10 '16 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.