snmpcheck – Backtrack 5 – Information Gathering – Network Analysis – SNMP Analysis – snmpcheck

SNMP can be a hidden gem that seems to be overlooked sometimes during penetration testing. It is really cool the information you can obtain just using snmpwalk from the command line however the information can be lengthy and unless you are an SNMP OID library or feel like googling a bunch of different stuff it really helps to have tools such as snmpcheck available. Below we describe what snmpcheck, which is written in Perl, will accomplish for you and we also provide a couple of examples against Ubuntu and a Cisco router.

Information snmpcheck Will Provide:

The snmpcheck.pl Perl script located under “Information Gathering > Network Analysis > SNMP Analysis” in the Backtrack menu will provide you a great summary of information about a device broken down into neatly formatted sections including system information, devices information, storage information, processes, network information, network interfaces, routing information, listening TCP ports and connections, and mount points. It will provide all of that information in a matter of seconds using SNMP.

snmpcheck Help Menu:

As you can see from the help menu output above the most basic version of the command would just use the -t switch followed by the IP address of the target device. I really like the fact that there are defaults for all of the settings which are set to the most common configurations however you can still change things like SNMP version, SNMP port, or SNMP community string easily. Typically you will find devices that have RO or Read Only access enabled however using the -w switch you can check to see if RW or Read/Write access is enabled. It should be noted for those that are not super familiar with SNMP when a community string is configured on a device you typically specify if it is RO or RW. Also public is the default RO community string while private is the default RW community string in most cases so always be sure to attempt those community strings before others. If you do not know of any community string that can access the device you can first try to brute force the SNMP community string using ADMsnmp or onesixtyone both located in the same sub menu as snmpcheck.

Below is an example of a failed SNMP connection either because of an incorrect community string, SNMP not listening, etc.

snmpcheck Failed SNMP Connection Example:

When there is an issue snmpcheck will timeout. Now for some examples where there is success with snmpcheck.pl including verification of a RW (Read/Write) community string in the first example below.

Test Read/Write Community String Using snmpcheck On Backtrack:

Since snmpcheck is more of an information gathering tool the -w switch simply verifies that it has write access to the device and outputs a success message back to you. Do be careful though when you are testing with snmpcheck and the -w switch because of the target machine has logging configured it will throw a trap or warning message based on the fact that something has been updated. The below example is from the console of a Cisco router after it was scanned using snmpcheck with the -w switch.

Console Output Of Cisco 861 Router When Queried With snmpcheck -w:

The above output is just something to keep in mind if you are attempting to gather information in stealth mode you will not want to use the -w switch just in case the target machine is being heavily monitored for changes. The next two examples are of the basic snmpcheck command using the -t switch only and querying first a Cisco 861 router followed by a query to a Backtrack Linux server running snmpd.

snmpcheck Example Against Cisco 861:

snmpcheck Example Against Backtrack Linux Server:

In the last example above you would have to clean up the output unless you have implemented the fix I mention in this article because when running snmpcheck against Backtrack or Ubuntu servers the runpath is not available for all of the processes and snmpcheck will output a warning message following each process line. Also notice that on the Linux server in the second example there is a lot more information available. I really like the output of snmpcheck and believe it can provide a great little copy/paste in a report to a client to show them how much information they are making available if they do not lock down SNMP traffic to only the necessary hosts so thanks to Matteo Cantoni for making an awesome Perl script.