Pearson's OSCP Notebook

snmpwalk

Properties1
tagssnmpwalk, snmp, snmp-check, onesixtyone, enumeration, 161, udp, community-string

4 min read

snmpwalk — SNMP Enumeration

What is snmpwalk?

snmpwalk walks an SNMP MIB tree on a target (UDP 161) using a community string (like a password). Default strings public (read) and private (write) are common on labs and legacy gear.

OSCP use: UDP 161 open → brute community with onesixtyone → snmpwalk -c public → harvest processes, users, software versions, and sometimes passwords in process command lines.

📌 When to Use

SituationAction
Nmap shows 161/udp openSNMP enum
Router/switch/printer/Windows with SNMPWalk MIBs
public / private worksFull info dump
Write community foundPossible config change / RCE (rare on OSCP)

Companion tools: onesixtyone (community brute), snmp-check (pretty output), snmpget (single OID), Hydra snmp module.

📌 Installation

# Kali — snmp package (includes snmpwalk, snmpget)
sudo apt install snmp snmp-mibs-downloader -y
 
# Optional human-readable enum
sudo apt install snmpcheck -y   # snmp-check

📌 Community String Discovery

# Quick test defaults
snmpwalk -v2c -c public TARGET > snmp.txt
 
snmpwalk -v2c -c public TARGET
snmpwalk -v2c -c private TARGET
 
snmpwalk -v2c -c public TARGET NET-SNMP-EXTEND-MIB::nsExtendObjects
 
# Brute community strings
onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt TARGET
 
# Or SecLists short list
onesixtyone -c /usr/share/wordlists/secLists/Discovery/SNMP/common-snmp-community-strings.txt TARGET
 
# Hydra
hydra -P /usr/share/wordlists/seclists/Discovery/SNMP/common-snmp-community-strings.txt TARGET snmp

📌 Core Syntax

snmpwalk -v2c -c COMMUNITY TARGET [OID]
FlagMeaning
-v2cSNMP version 2c (most common on OSCP)
-v1SNMPv1 (older targets)
-v3SNMPv3 (user/auth — see Nmap scripts)
-c publicCommunity string
-OsShorter numeric OIDs (easier to read)
-OnNumeric OIDs only

📌 Full Walk & Key OIDs

# Dump everything (noisy — start here if public works)
snmpwalk -v2c -c public TARGET
 
# System info
snmpwalk -v2c -c public TARGET system
 
# Running processes (check cmdline for passwords!)
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2
 
# Installed software / SW run table
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.6.3.1.2
 
# Windows users (HOST-RESOURCES-MIB / Windows extensions)
snmpwalk -v2c -c public TARGET 1.3.6.1.4.1.77.1.2.25
 
# Open TCP ports on device
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.6.13.1.3
 
# NET-SNMP extend — custom scripts/commands exposed via SNMP (privesc / creds)
snmpwalk -v2c -c public TARGET NET-SNMP-EXTEND-MIB::nsExtendObjects
snmpwalk -v2c -c public 192.168.176.149 NET-SNMP-EXTEND-MIB::nsExtendObjects
 
# Network interfaces / IP routing
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.4.20.1.1
snmpwalk -v2c -c public TARGET ipRouteTable
 
# Single value with snmpget
snmpget -v2c -c public TARGET sysDescr.0
snmpget -v2c -c public TARGET sysName.0

📌 snmp-check (Readable Summary)

snmp-check TARGET -c public
snmp-check TARGET -c public --info --software --processes --interfaces

Good first pass before raw snmpwalk output.

📌 Nmap SNMP Scripts

# UDP scan required
nmap -p 161 -sU -sV TARGET
nmap -p 161 -sU --script snmp-info,snmp-sysdescr,snmp-brute TARGET
 
# SNMPv3
nmap -p 161 -sU --script snmp-info --script-args snmp.version=3 TARGET

📌 What to Look For

DataWhy it matters
Process listPasswords in args (mysql -u root -psecret, backup scripts)
Installed softwareVulnerable versions → searchsploit
User accountsUsernames for spray / SSH
Network routes / ARPInternal hosts to pivot to
NET-SNMP extend (nsExtendObjects)Custom scripts/commands admins wired into SNMP — paths, args, sometimes creds
Write communityConfig tampering (advanced)
sysDescr / sysNameOS/device fingerprint

📌 Parse Output with Text Tools

# Grep for interesting strings
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2 | grep -i "pass\|pwd\|user\|admin"
 
# Save full walk for offline grep
snmpwalk -v2c -c public TARGET > snmp_dump.txt
grep -i password snmp_dump.txt

See Pipelines & Chaining and grep.

📌 OSCP Workflow

1. nmap -p 161 -sU TARGET
2. onesixtyone -c community_strings.txt TARGET
3. snmp-check TARGET -c public
4. snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2   # processes
5. snmpwalk -v2c -c public TARGET NET-SNMP-EXTEND-MIB::nsExtendObjects   # extend scripts
6. grep output for creds / internal IPs

📌 Quick Copy/Paste

# Find community
onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt TARGET
 
# Enum
snmp-check TARGET -c public
snmpwalk -v2c -c public TARGET
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2
snmpwalk -v2c -c public TARGET NET-SNMP-EXTEND-MIB::nsExtendObjects
 
# Hunt creds in processes
snmpwalk -v2c -c public TARGET 1.3.6.1.2.1.25.4.2.1.2 | grep -i pass

Graph View

Backlinks