Extract configuration and process information through SNMP

Needs: An accepted read community or SNMPv3 identity/security level; transport and view permissions

Find a read community, then walk

# Baseline: find a read community, then walk
onesixtyone -c COMMUNITY_FILE TARGET
snmpwalk -v2c -c COMMUNITY TARGET 1.3.6.1.2.1

# Variant — efficient v2c bulk walk
snmpbulkwalk -v2c -c COMMUNITY TARGET 1.3.6.1.2.1

# Variant — high-value Windows OIDs
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.4.1.77.1.2.25
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.2.1.25.4.2.1.2
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.2.1.25.6.3.1.2
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.2.1.6.13.1.3

# Variant — SNMPv3 authenticated and private walk
snmpwalk -v3 -l authPriv -u USER -a SHA -A AUTH_PASSWORD -x AES -X PRIV_PASSWORD TARGET 1.3.6.1.2.1

# Variant — focused UDP verification
sudo nmap -sU -sV -p 161 --script snmp-info TARGET

Decisive output: returned OID/value pairs prove that the selected version/community can read those objects. Hostnames, interfaces, routes, users, processes and locally listening ports become new hypotheses to validate through the appropriate service or post-access path.

Use -v1 instead when version 1 is indicated. Start with the standard system tree before a huge full walk.

Bulk requests reduce round trips but require SNMPv2c or later. If the agent rejects them, fall back to snmpwalk with the verified version.

The security level, authentication algorithm, privacy algorithm and credentials must match the configured SNMPv3 user. authNoPriv authenticates without encryption; noAuthNoPriv supplies neither and should be used only when that exact configuration is observed.

Verify → Preserve the OID, accepted security context and returned value; empty branches can reflect view restrictions.

If it fails → Silence can mean UDP filtering, wrong community/version or denied view; change only the condition supported by evidence. More detail ↓

If → then

No response, a new subnet, or uncertainty about the interface and route → Validate the source path and discover hosts
Needs: Correct VPN/interface and explicit scope; discovery probes must be compatible with the path
A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol
A product/version clue, advisory or component-specific public PoC → Match a public exploit to the actual component and configuration
Needs: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Extract configuration and process information through SNMP

USE WHEN: UDP/161 evidence or an exposed management plane
STARTING ACCESS: A confirmed reachable application; anonymous context or one identified credential
RESULT: Host, interface, software or process/configuration clues from permitted OID branches

Recognize the clue

Take UDP/161 evidence and a justified management credential/community, then request a small known OID branch before a broad walk.

snmpwalk -v2c -c COMMUNITY TARGET 1.3.6.1.2.1.1

SYNTHETIC EXAMPLE OUTPUT

SNMPv2-MIB::sysDescr.0 = STRING: OS_AND_BUILD
SNMPv2-MIB::sysName.0 = STRING: HOSTNAME

Means: A real OID response confirms the accepted read context and supplies software/name clues.

Confirm: Determine which useful views/branches are actually readable; process data and write rights are separate.

After validation: A relevant interface/process branch returns useful data: follow the named subnet/application/credential.
Ruled out in this context: An explicit authorization failure rules out that security context/view.
Still inconclusive: UDP silence can be routing, version, community or view policy; a timeout cannot choose between them.

Troubleshooting: Silence can mean UDP filtering, wrong community/version or denied view; change only the condition supported by evidence.

Recognize: SNMP queries commonly use UDP/161. Versions 1 and 2c authenticate with a community string sent without modern transport protection; version 3 can provide user-based authentication and privacy. Goal: turn a valid read context into host, interface, route, process, software, user and listener clues.

Baseline: find a read community, then walk

Use -v1 instead when version 1 is indicated. Start with the standard system tree before a huge full walk.

Decisive output: returned OID/value pairs prove that the selected version/community can read those objects. Hostnames, interfaces, routes, users, processes and locally listening ports become new hypotheses to validate through the appropriate service or post-access path.

Variant — efficient v2c bulk walk

Bulk requests reduce round trips but require SNMPv2c or later. If the agent rejects them, fall back to snmpwalk with the verified version.

Variant — high-value Windows OIDs

These target user names, running process names, installed software and TCP listener ports. Availability depends on the agent and exposed MIB view.

Variant — SNMPv3 authenticated and private walk

The security level, authentication algorithm, privacy algorithm and credentials must match the configured SNMPv3 user. authNoPriv authenticates without encryption; noAuthNoPriv supplies neither and should be used only when that exact configuration is observed.

Variant — focused UDP verification

snmp-info extracts basic SNMPv3 engine information without proving a usable v1/v2c community.

Failure cues: UDP silence can remain open|filtered; it does not prove that the community is wrong. Timeout: No Response can be version mismatch, wrong community, filtering, loss or an unavailable OID view. No Such Object means the queried OID is absent/not exposed, not that the whole service failed. Do not use a discovered write community to change configuration during enumeration.

Next action: translate output into exact host/service/user hypotheses, scan newly disclosed in-scope addresses/listeners from the proper source position, and keep configuration-changing SNMP actions outside this stage.

Why it works

An SNMP community acts as an access selector; views can expose only some trees. A successful system OID does not grant write access or all process data.

Worked example · hypothetical

Observation: a system OID responds. Test: inspect the relevant interface/process branch. Illustrative output: an internal subnet and application command line. Interpretation: return the subnet to scoped discovery and classify any exposed credential.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗