On 05 June 2001 15:37, MJ Ray [SMTP:markj@cloaked.freeserve.co.uk] wrote:
> > [...] (SNMP walk Anyone ?).
>
> Yep, that one scared me when I saw how talkative our machines were.
> Silly Compaq Unix enables no end of crap services by default.
>
Last year I spent 6 months writing an extensible SNMP agent for a call
centre software suite. Wasn't fun and certainly wasn't easy.
However about 4 weeks after it went live some bright spark noticed it was
now possible to get a full picture of the network and its nodes, names and
all sorts of other stuff (because of the newly functioning MS SNMP
services) across the internet by issuing an SNMP Walk against the public
MIB on the firewall's IP (which had been configured for SNMP traffic due to
this new agent reporting to the sysadmin remotely!)
NB Anyone who hasn't a clue what I'm talking about try the following :
1) if you can, get the MS platform SDK and install the snmptool component.
(there are tons of free SNMP tools about on the net if you can't get
this... a quick lycos search should get you some)
2) Ensure you have the SNMP Service active (WIN NT... dunno about other
flavours though I know you can have SNMP installed)
3) try the following command (other tools should be very similar in usage)
snmptool walk 127.0.0.1 public 1
Here is the output from my work machine :
-----SNIP-----
SnmpTool - Simple Network Management Protocol Tool for Win32
Performing branch walk starting at OID 1.3.6.1.2.1.1
Name: system.sysDescr.0
OID: 1.3.6.1.2.1.1.1.0
Type: OCTET STRING
Length: 135
Value: Hardware: x86 Family 6 Model 5 Stepping 2 AT/AT COMPATIBLE
-
Software: Windows NT Version 4.0 (Build Number: 1381 Uniprocessor Free )
Name: system.sysObjectID.0
OID: 1.3.6.1.2.1.1.2.0
Type: OBJECT IDENTIFIER
Length: 12
Value: 1.3.6.1.4.1.311.1.1.3.1.1
Name: system.sysUpTime.0
OID: 1.3.6.1.2.1.1.3.0
Type: TimeTicks
Value: 6914
Name: system.sysContact.0
OID: 1.3.6.1.2.1.1.4.0
Type: OCTET STRING
Length: 14
Value: Earl Brannigan
Name: system.sysName.0
OID: 1.3.6.1.2.1.1.5.0
Type: OCTET STRING
Length: 6
Value: APOLLO
Name: system.sysLocation.0
OID: 1.3.6.1.2.1.1.6.0
Type: OCTET STRING
Length: 13
Value: In the Window
Name: system.sysServices.0
OID: 1.3.6.1.2.1.1.7.0
Type: INTEGER
Value: 79
End of MIB branch
-----SNIP-----
Try the following command ... very interesting if you are connected to a
network ....
snmptool walk 127.0.0.1 public .1.3
(note the point in front of the 1 - important)
For my machine I can see the shared drives, mapped network drives, ethernet
adapters, the names/ip addresses of every other machine on my
subnet......and all with little effort.
It doesn't take einstein to figure out how useful some of this info is to
the potential hacker....
BTW, try this against a few web servers when connected to the net....you
could be intrigued.
> > I will also bring along some good info in pdf/html/text format for
further
> > reading for anyone who is interested.
>
> We could upload this to the web site on the day, too?
Ha! what a fabulous idea... I'll get it all onto one disk and its all yours
.....;o)
Good excuse to organise it all anyway.
>
> --
> MJR