Disclaimer: This blog is for educational purpose only!!!
In this blog we will show how misconfiguration in SNMP protocol helps an attacker to use that misconfiguration issue for exploiting.
What is SNMP?
Simple Network Management Protocol(SNMP) used for network management. SNMP is used for collecting data from and configuring network devices such as Hub, Switches, Router, Server, Printer etc. on network.
To show practically SNMP protocol misconfiguration issue we installed VyOS” in VirtualBox which is a network operating system.
By using command “show service” we can see the configured services on VyOS
“Snmpwalk” tool to gather information about STRINGS. VyOS shows that snmp protocol is configured in “community public“. The below screenshot showing “public” using snmpwalk command.
Use “Snmpwalk” tool further to gather information about STRINGS in “community private“. The below screenshot showing “private” using snmpwalk command.
Use grep command particular STRING value from public community list.
Now we exploit SNMP Public community string by using snmpset tool.
Checking that exploit done successfully or not by using snmapwalk tool again.
The below screenshot shows that we successfully exploited the STRING value. The value is change from “vyos” to “HackedByName“
How to Prevent:
- Disable those services which are not in use. If SNMP service is required, then make sure that the default community strings are made more complex.
- SNMP service is not misconfigured with Read-Write authorization configuration.