Script `snmp-brute`

Script types: portrule
Categories: intrusive, brute
Download: https://svn.nmap.org/nmap/scripts/snmp-brute.nse

Script Summary

Attempts to find an SNMP community string by brute force guessing.

This script opens a sending socket and a sniffing pcap socket in parallel threads. The sending socket sends the SNMP probes with the community strings, while the pcap socket sniffs the network for an answer to the probes. If valid community strings are found, they are added to the creds database and reported in the output.

The script takes the snmp-brute.communitiesdb argument that allows the user to define the file that contains the community strings to be used. If not defined, the default wordlist used to bruteforce the SNMP community strings is nselib/data/snmpcommunities.lst. In case this wordlist does not exist, the script falls back to nselib/data/passwords.lst

No output is reported if no valid account is found.

Script Arguments

snmp-brute.communitiesdb: The filename of a list of community strings to try.
passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb: See the documentation for the unpwdb library.
creds.[service], creds.global: See the documentation for the creds library.
snmp.version: See the documentation for the snmp library.

Example Usage

nmap -sU --script snmp-brute <target> [--script-args snmp-brute.communitiesdb=<wordlist> ]

Script Output

PORT    STATE SERVICE
161/udp open  snmp
| snmp-brute:
|   dragon - Valid credentials
|_  jordan - Valid credentials

Requires

Authors:

Philip Pickering
Gorjan Petrovski
Patrik Karlsson
Gioacchino Mazzurco