What problem does it solve?
During authorized penetration tests, SNMP services on port 161/udp are frequently misconfigured with default community strings and writable OIDs, yet testers often miss these issues or fail to confirm them. This Skill provides a structured methodology to enumerate, exploit, and document SNMP weaknesses with verifiable proof.
Core Features & Use Cases
- Community String Discovery: Guess and validate v1/v2c community strings using onesixtyone, braa, hydra, and nmap NSE scripts, with confirmation logic based on server responses.
- MIB Data Harvesting: Walk the MIB tree with snmpwalk/snmpbulkwalk to extract running processes, user accounts, installed software, and credentials leaked in command-line arguments.
- SNMP-to-RCE Escalation: Abuse writable rwcommunity strings on net-snmp via nsExtendObjects to achieve command execution, including reverse shell payloads.
- Use Case: During an internal network assessment, you discover a printer exposing SNMP with the default 'public' string; you walk the MIB, find a service password in process arguments, then use a discovered rwcommunity string to trigger a reverse shell and document the full finding.
Quick Start
Use the pentesting-snmp skill to enumerate the SNMP service on target 10.10.11.136, guess its community strings, and check for writable OIDs that could lead to remote code execution.
