English
- ___ ______ _ _
- / | _ | / |
- | / | | | | | _/ |
- | |___| | | |_ / | | _/ |
- ..oO THE | --- | | / | | | | CreW Oo..
- ''' ''' ''''''' '''' ''''
- presents
- [ ADMsnmp v 0.1 ]
- * SNMP audit scanner *
- ftp://ADM.isp.at/ADM/ADMsnmp.0.1.tar.gz
- http://ADM.isp.at/ADM/ADMsmp.0.1.tar.gz
- http://el8.org/~antilove/ADMsnmp.0.1.tar.gz
- ADMsnmp is an snmpd audit scanner.
- Any of you know how weak and funny snmp is?
- You can obtain a great deal of usefull info like admin name's,
- you can play with the interface of the router, reboot the machine
- get the password file of the router (Ascend), or execute commands remoteley,
- anyway snmp is a BIG hole.
- ADMsnmp can brute force the snmp community name (with a wordfile) or
- make a wordfile list derived the hostname.
- ADMsnmp can report to you all valid community
- names found and inform you if writable access to the MIB has been attained.
- ADMsnmp is very easy to use and designed with speed in mind!
- here is an example session
- [root@ADM apps]# a.out 172.21.6.1 -wor snmp.passwd -sleep 1
- ADMsnmp vbeta 0.1 (c) The ADM crew
- ftp://ADM.isp.at/ADM/
- greets: !ADM, el8.org, ansia
- >>>>>>>>>>> get req name=root id = 2 >>>>>>>>>>>
- >>>>>>>>>>> get req name=public id = 5 >>>>>>>>>>>
- >>>>>>>>>>> get req name=private id = 8 >>>>>>>>>>>
- >>>>>>>>>>> get req name=write id = 11 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 9 name = private ret =0 <<<<<<<<<<
- >>>>>>>>>>>> send setrequest id = 9 name = private >>>>>>>>
- >>>>>>>>>>> get req name=admin id = 14 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 10 name = private ret =0 <<<<<<<<<<
- >>>>>>>>>>> get req name=proxy id = 17 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 140 name = private ret =0 <<<<<<<<<<
- >>>>>>>>>>> get req name=ascend id = 20 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 140 name = private ret =0 <<<<<<<<<<
- >>>>>>>>>>> get req name=cisco id = 23 >>>>>>>>>>>
- >>>>>>>>>>> get req name=router id = 26 >>>>>>>>>>>
- >>>>>>>>>>> get req name=shiva id = 29 >>>>>>>>>>>
- >>>>>>>>>>> get req name=all private id = 32 >>>>>>>>>>>
- >>>>>>>>>>> get req name= private id = 35 >>>>>>>>>>>
- >>>>>>>>>>> get req name=access id = 38 >>>>>>>>>>>
- >>>>>>>>>>> get req name=snmp id = 41 >>>>>>>>>>>
- <!ADM!> snmp check on router.dream.on.it <!ADM!>
- sys.sysName.0:router.dream.on.it
- name = private write access
- ADMsnmp inform's you if it has write access to the MIB with the community name private.
- snmpwalk <ip> <community name> and enjoy ;)
- another example ADMsnmp localhost -g (with the guessname option)
- ADMsnmp vbeta 0.1 (c) The ADM crew
- ftp://ADM.isp.at/ADM/
- greets: !ADM, el8.org, ansia
- >>>>>>>>>>> get req name=public id = 2 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 3 name = public ret =2 <<<<<<<<<<
- >>>>>>>>>>> get req name=private id = 5 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 4 name = public ret =2 <<<<<<<<<<
- >>>>>>>>>>> get req name=localhost95 id = 8 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 6 name = private ret =0 <<<<<<<<<<
- >>>>>>>>>>>> send setrequest id = 6 name = private >>>>>>>>
- >>>>>>>>>>> get req name=localhost96 id = 11 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 7 name = private ret =0 <<<<<<<<<<
- >>>>>>>>>>> get req name=localhost97 id = 14 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 9 name = localhost95 ret =2 <<<<<<<<
- <<
- >>>>>>>>>>> get req name=localhost98 id = 17 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 10 name = localhost95 ret =2 <<<<<<<
- <<<
- >>>>>>>>>>> get req name=localhost99 id = 20 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 137 name = private ret =0 <<<<<<<<<<
- >>>>>>>>>>> get req name=localhost0 id = 23 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 137 name = private ret =0 <<<<<<<<<<
- >>>>>>>>>>> get req name=localhost1 id = 26 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 12 name = localhost96 ret =2 <<<<<<<
- <<<
- >>>>>>>>>>> get req name=localhost2 id = 29 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 13 name = localhost96 ret =2 <<<<<<<
- <<<
- >>>>>>>>>>> get req name=localhost3 id = 32 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 15 name = localhost97 ret =2 <<<<<<<
- <<<
- >>>>>>>>>>> get req name=localhost4 id = 35 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 16 name = localhost97 ret =2 <<<<<<<
- <<<
- >>>>>>>>>>> get req name=localhost5 id = 38 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 18 name = localhost98 ret =2 <<<<<<<
- <<<
- >>>>>>>>>>> get req name=localhost6 id = 41 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 19 name = localhost98 ret =2 <<<<<<<
- <<<
- >>>>>>>>>>> get req name=localhost7 id = 44 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 21 name = localhost99 ret =2 <<<<<<<
- <<<
- >>>>>>>>>>> get req name=localhost8 id = 47 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 22 name = localhost99 ret =2 <<<<<<<
- <<<
- >>>>>>>>>>> get req name=localhost9 id = 50 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 24 name = localhost0 ret =2 <<<<<<<<
- <<
- >>>>>>>>>>> get req name=localhost10 id = 53 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 25 name = localhost0 ret =2 <<<<<<<<
- <<
- >>>>>>>>>>> get req name=localhost00 id = 56 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 27 name = localhost1 ret =2 <<<<<<<<
- <<
- >>>>>>>>>>> get req name=localhost01 id = 59 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 28 name = localhost1 ret =2 <<<<<<<<
- <<
- >>>>>>>>>>> get req name=localhost02 id = 62 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 30 name = localhost2 ret =2 <<<<<<<<
- <<
- >>>>>>>>>>> get req name=localhost03 id = 65 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 31 name = localhost2 ret =2 <<<<<<<<
- >>>>>>>>>>> get req name=localhost04 id = 68 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 33 name = localhost3 ret =2 <<<<<<<<
- <<
- >>>>>>>>>>> get req name=localhost05 id = 71 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 34 name = localhost3 ret =2 <<<<<<<<
- <<
- >>>>>>>>>>> get req name=localhost06 id = 74 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 36 name = localhost4 ret =2 <<<<<<<<
- <<
- >>>>>>>>>>> get req name=localhost07 id = 77 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 37 name = localhost4 ret =2 <<<<<<<<
- <<
- >>>>>>>>>>> get req name=localhost08 id = 80 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 39 name = localhost5 ret =2 <<<<<<<<
- <<
- >>>>>>>>>>> get req name=localhost09 id = 83 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 40 name = localhost5 ret =2 <<<<<<<<
- <<
- >>>>>>>>>>> get req name=localhost10 id = 86 >>>>>>>>>>>
- <<<<<<<<<<< recv snmpd paket id = 42 name = localhost6 ret =2 <<<<<<<<
- <<
- >>>>>>>>>>> get req name=LOCALHOST95 id = 89 >>>>>>>>>>>
- etc..
- ADMsnmp is available on
- ftp://ADM.isp.at/ADM/ADMsnmp.0.1.tar.gz
- http://ADM.isp.at/ADM/ADMsmp.0.1.tar.gz
- http://el8.org/~antilove/ADMsnmp.0.1.tar.gz
- happy snmp walking :)
- The ADM Crew
- (thx to #as400 who help me to boot my as400 )
