Windows Server Enumeration (SNMP Enumeration))
What is Enumeration?
Enumeration phase is the result of the scanning phase. The main goal of enumeration is to get a fair idea of target.
In this phase, a hacker connects to the computer in the target network and searches for maximum information about the user's account details to attack the network and grasp the information from the computer system. This enumerates the target host or lists different resources that are available on the host or network.
SNMP (Simple Network Management Protocol)
SNMP is an application layer protocol which uses UDP protocol to maintain and manage routers, hubs, and switches and other network devices on an IP network.
SNMP enumeration is used to enumerate user accounts, passwords, groups, system names, and devices on a target system.
SNMP important points:
- Used to manage network devices using UDP protocol
- Uses UDP port 161 (for SNMP managers)
- Uses UDP port 162 (for SNMP agents)
- It is a disabled service by default — we need to enable it
Purpose of SNMP
SNMP is primarily used to:
- Monitor network devices — retrieve information such as CPU usage, memory usage, bandwidth utilization, and error rates
- Manage network devices — configure settings on devices, reboot them, or shut them down
- Detect and resolve issues — helps administrators receive alerts about hardware failures or network problems
How SNMP Works
SNMP operates using a client-server architecture. The network management system (NMS) acts as the client, while the managed devices (routers, switches, etc.) run SNMP agents that communicate with the NMS.
The interaction involves three main components:
1. SNMP Manager (NMS)
The system that oversees network management. It sends requests to the agents to collect data or make configuration changes. It is typically a software application running on a server, which issues requests for information and receives responses from agents.
2. SNMP Agent
A software component running on the managed devices (e.g., routers, switches). It collects and stores data about the device and responds to requests from the SNMP manager. Agents can also respond to commands from the SNMP manager like changing configurations.
3. MIB (Management Information Base)
A virtual database of managed objects. It defines what data can be collected from devices and is organized hierarchically using object identifiers (OIDs). Each variable in the MIB is identified using a unique OID — a hierarchical value used to specify a particular metric on a device.
SNMP Operations
SNMP allows the SNMP manager to communicate with agents using the following key operations:
GET Request
The SNMP manager uses a GET request to retrieve information about a specific variable (such as CPU usage or network traffic) from the SNMP agent.
SET Request
A SET request allows the SNMP manager to change or configure a variable on the agent (for example, updating device settings).
GETNEXT Request
Used to retrieve the next object in the MIB hierarchy, which allows the SNMP manager to navigate through the data structure without knowing the exact OID beforehand.
TRAP
An unsolicited notification or alert sent by the agent to the SNMP manager when certain conditions or events (like device failures) occur. It is a way for devices to notify the manager of important or critical issues without waiting for a request.
INFORM
Similar to TRAPs, but includes an acknowledgment from the SNMP manager to ensure the message was received.
GETBULK
Used to efficiently retrieve large blocks of data, reducing the number of requests needed.
Versions of SNMP
| Version | Description |
|---|---|
| SNMPv1 | Original version. Simple but has very weak security — sends data in plain text, vulnerable to interception |
| SNMPv2 | Improvement over v1, better performance and additional features, but still uses weak community string authentication |
| SNMPv3 | Latest and most secure version — provides encryption, message integrity, and authentication |
Security in SNMP
Community Strings (SNMPv1 and SNMPv2c)
Used for basic authentication where a string (like a password) is sent along with SNMP requests:
- Public — default string used to read data
- Private — default string used to write or change configurations
This method is not secure because the strings are sent in plaintext.
SNMPv3 Security features:
- Message Integrity — ensures the message has not been altered
- Authentication — confirms the identity of the sender
- Encryption — encrypts messages to ensure confidentiality
In SNMP, object information is stored in a hierarchical form so every object has an OID (Object Identifier) point.
The SNMP stores information in a global hierarchical tree. Every value (hostname, uptime, interface, etc.) is located at a specific path in this tree. This structure is defined in the Management Information Base (MIB).
├── 0 ITU-T The Top of the tree, managed by international standard bodies.
├─ ─ 1 ISO │ └── 3 identified-organization │ └── 6 dod │ └── 1 internet │ ├── 1 directory │ ├── 2 management │ │ └── 1 mib-2 │ │ ├── 1 system │ │ │ ├── 1 sysDescr │ │ │ ├── 2 sysObjectID │ │ │ ├── 3 sysUpTime │ │ │ ├── 4 sysContact │ │ │ ├── 5 sysName │ │ │ └── 6 sysLocation │ │ │ │ │ ├── 2 interfaces │ │ ├── 3 at │ │ ├── 4 ip │ │ ├── 5 icmp │ │ └── 6 tcp │ │ │ └── 4 private │ └── 1 enterprises │ ├── Cisco │ ├── Microsoft │ └── HP
Some Useful SNMP OIDs:
| Information | OID |
|---|---|
| Hostname | 1.3.6.1.2.1.1.5 |
| System uptime | 1.3.6.1.2.1.1.3 |
| System description | 1.3.6.1.2.1.1.1 |
| Network interfaces | 1.3.6.1.2.1.2.2.1.2 |
| Running processes | 1.3.6.1.2.1.25.4.2.1.2 |
Now the question is how Hacker/Attackers use the SNMP protocol to gether information about target?
First let's setup our lab for SNMP enumeration.
Lab Setup
In VMware create three VMs:
- VM 1 — Windows Server — network adapter VMnet1 (Host-Only), IP:
10.1.1.100 - VM 2 — Windows 10 Client — network adapter VMnet1 (Host-Only), IP:
10.1.1.50 - VM 3 — Kali Linux (Attacker) — two adapters: VMnet8 (NAT) and VMnet1, IP:
10.1.1.10
Step 1 - Now we need to enable SNMP on windows server(I am using Windows server 2019).
Open Server Manager --> Add roles and features --> SNMP Service --> Also install SNMP WMI provider.
Step 2 - Configure SNMP
Open service.msc --> find snmp service --> Right click properties --> Security Tab --> Add community string (public) --> Permission (Read-only) --> Accept SNMP packet from kali linux IP
Step 3 - Check both machines are able to ping each other, if kali linux is not able to ping the windows server, then enable the File and Printer Sharing (Echo Request - IPv4 in) at inbound rule of windows defender firewall.
Step 4 - Install SNMP tool on kali linux
Check whether the tool is already installed or not:
snmpwalk
sudo apt install snmp snmp-mibs-download-y
Step 5 - Now we can perform SNMP enumeration in kali linux
snmpwalk -v2c -c public 10.1.1.100
At Output:
- System update
- System name
- Running services
- Network interfaces
- Processes
- Installed software
Example Output:
SNMPv2-MIB::sysName.0 = STRING:WindowsServer2019 SNMPv2-MIB::sysLocation.0 = STRING:Datacenter
More command to gather much information as possible Discover if SNMP is Running
nmap -sU -p 161 10.1.1.100
You can also scan by defining the port no. of SNMP
nmap -sS -sU -p 161,162, 10.1.1.100 -sS --> TCP SYN scan -sU --> UDP scan
More detailed SNMP scan
nmap -U -p 161 --script snmp-info, snmp-sysdescr,snmp-win32-users 10.1.1.100`
Enumerate Basic System information
snmpwalk -v2c -c public 10.1.1.100 1.3.6.1.2.1.1
Discover Network interfaces
snmpwalk -v2c -c public 10.1.1.100 1.3.6.1.2.1.2.2.1.2
After than you can also enumerate running process, installed software, and many more information using the SNMPwalk tool in kali linux.
"If SNMP community string is public and exposed, attackers can enumerate sensitive information remotely. But if the community string is set to other string then we have to guess the community string." Note: We can also use metasploit to perform enumeration of SNMP.