2KKUU7ita

134
Part III: Hacking Network Hosts
Figure 8-4:
General
SNMP
information
gathered by
Getif.
If SNMP is compromised, a hacker may be able to gather such network information
as ARP tables, usernames, and TCP connections to attack your systems
further. If SNMP shows up in port scans, you can bet that a malicious
attacker will try to compromise the system.
Here are some utilities for SNMP enumeration:
✓ The commercial tools NetScanTools Pro and Essential NetTools
✓ Free Windows GUI-based Getif
✓ Free Windows text-based SNMPUTIL (www.wtcs.org/snmp4tpc/
FILES/Tools/SNMPUTIL/SNMPUTIL.zip)
You can use Getif to enumerate systems with SNMP enabled, as shown in
Figure 8-4.
In this test, I was able to glean a lot of information from a wireless access point,
including model number, firmware revision, and system uptime. All this could
be used against the host if an attacker wanted to exploit a known vulnerability
in this particular system. By digging in further, I was able to discover several
management interface usernames on this access point, as shown in Figure 8-5.
You certainly don’t want to show the world this information.
For a list of vendors and products affected by the well-known SNMP vulnerabilities,
refer to www.cert.org/advisories/CA-2002-03.html.