> For the complete documentation index, see [llms.txt](https://0xdecaf2bad.gitbook.io/red-team-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xdecaf2bad.gitbook.io/red-team-notes/08-commands/snmp.md). # snmp SNMP ``` ********Process********* ``` nmap -sU -p 161 10.10.10.10 if found do snmp-check -t 10.10.10.10 if snmp stuff is found, gather the following Names Services Listening ports SNMP ## downloads snmpenum commands for this tool perl snmp.pl 10.10.10.5 public windows.txt the "public" refers to the fact you want to search for public strings. The "windows" shows you want to search a known windows host to find people running snmp nmap -sU -p 161 snmp-check -t if SNMP is found, type the following onesixtyone -c /usr/share/doc/onesixtyone/dict.txt if you find some usernames from the snmp enumeration, you can do the following echo -e "admin\nAdministrator\nGuest " > users.txt this will make a wordlist -- the admin, Administrator, and guest are just examples of usernames found, the \n after the usernames just specifies a carriage return. Snmpwalk snmpwalk -v -2c 192.168.30.53 -c public -v option specifies the snmp version IE version 2c -c option specifies to use the "public" string if the output returns numerically then be sure to install the snmp-mibs-downloader package \===================== \===================== nmap snmp scripts snmp-brute snmp-info snmp-interfaces snmp-netstat snmp-processes snmp-sysdescr snmp-win32-services or view them all /usr/share/nmap/scripts ls -l | grep -i snmp IE: nmap -sU -p 161 --script= **optional, you can append the following** --script-args snmp-brute.communitiesdb=