> For the complete documentation index, see [llms.txt](https://yongjun04.gitbook.io/oscp-cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yongjun04.gitbook.io/oscp-cheatsheet/methodology/service-enumeration/udp-snmp-161.md).

# UDP: SNMP - 161

## Information

| MIB Values             | MIB              |
| ---------------------- | ---------------- |
| 1.3.6.1.2.1.25.1.6.0   | System Processes |
| 1.3.6.1.2.1.25.4.2.1.2 | Running Programs |
| 1.3.6.1.2.1.25.4.2.1.4 | Processes Path   |
| 1.3.6.1.2.1.25.2.3.1.4 | Storage Units    |
| 1.3.6.1.2.1.25.6.3.1.2 | Software Name    |
| 1.3.6.1.4.1.77.1.2.25  | User Accounts    |
| 1.3.6.1.2.1.6.13.1.3   | TCP Local Ports  |

## Enumeration

### Nmap

```bash
sudo nmap -sU --open -p 161 <Target IP Address>
```

### onesixtyone

```bash
onesixtyone -c community -i ips
```

> **NOTE: Prepare the following things**
>
> * Community
>
> {% code overflow="wrap" %}
>
> ```bash
> echo public > community && echo private >> community && echo manager >> community
> ```
>
> {% endcode %}
>
> * ips
>
> ```bash
> for ip in $(seq 1 254); do echo <Target IP Address>.$ip; done > ips
> ```

### snmpwalk

Leak command output

```bash
snmpwalk -c public -v2c <Target IP Address> NET-SNMP-EXTEND-MIB::nsExtendOutputFull
```

{% code overflow="wrap" %}

```bash
snmpwalk -c public -v2c <Target IP Address> NET-SNMP-EXTEND-MIB::nsExtendObjects
```

{% endcode %}

```bash
snmpwalk -c community -v2c <Target IP Address> NET-SNMP-EXTEND-MIB::nsExtendOutputFull
```

Increase timeout timing

```bash
snmpwalk -c public -v2c -t 10 <Target IP Address>
```

Enumerate Logged-In Users

```bash
snmpwalk -c public -v2c <Target IP Address> 1.3.6.1.4.1.77.1.2.25
```

Enumerate Running Processes

```bash
snmpwalk -c public -v2c <Target IP Address> 1.3.6.1.2.1.25.4.2.1.2
```

Enumerate Active TCP Connections

```bash
snmpwalk -c public -v2c <Target IP Address> 1.3.6.1.2.1.6.13.1.3
```