On 05 June 2001 15:37, MJ Ray [SMTP:markj@cloaked.freeserve.co.uk] wrote:
[...] (SNMP walk Anyone ?).
Yep, that one scared me when I saw how talkative our machines were. Silly Compaq Unix enables no end of crap services by default.
Last year I spent 6 months writing an extensible SNMP agent for a call centre software suite. Wasn't fun and certainly wasn't easy. However about 4 weeks after it went live some bright spark noticed it was now possible to get a full picture of the network and its nodes, names and all sorts of other stuff (because of the newly functioning MS SNMP services) across the internet by issuing an SNMP Walk against the public MIB on the firewall's IP (which had been configured for SNMP traffic due to this new agent reporting to the sysadmin remotely!)
NB Anyone who hasn't a clue what I'm talking about try the following : 1) if you can, get the MS platform SDK and install the snmptool component. (there are tons of free SNMP tools about on the net if you can't get this... a quick lycos search should get you some) 2) Ensure you have the SNMP Service active (WIN NT... dunno about other flavours though I know you can have SNMP installed) 3) try the following command (other tools should be very similar in usage) snmptool walk 127.0.0.1 public 1 Here is the output from my work machine :
-----SNIP----- SnmpTool - Simple Network Management Protocol Tool for Win32
Performing branch walk starting at OID 1.3.6.1.2.1.1 Name: system.sysDescr.0 OID: 1.3.6.1.2.1.1.1.0 Type: OCTET STRING Length: 135 Value: Hardware: x86 Family 6 Model 5 Stepping 2 AT/AT COMPATIBLE - Software: Windows NT Version 4.0 (Build Number: 1381 Uniprocessor Free )
Name: system.sysObjectID.0 OID: 1.3.6.1.2.1.1.2.0 Type: OBJECT IDENTIFIER Length: 12 Value: 1.3.6.1.4.1.311.1.1.3.1.1
Name: system.sysUpTime.0 OID: 1.3.6.1.2.1.1.3.0 Type: TimeTicks Value: 6914
Name: system.sysContact.0 OID: 1.3.6.1.2.1.1.4.0 Type: OCTET STRING Length: 14 Value: Earl Brannigan
Name: system.sysName.0 OID: 1.3.6.1.2.1.1.5.0 Type: OCTET STRING Length: 6 Value: APOLLO
Name: system.sysLocation.0 OID: 1.3.6.1.2.1.1.6.0 Type: OCTET STRING Length: 13 Value: In the Window
Name: system.sysServices.0 OID: 1.3.6.1.2.1.1.7.0 Type: INTEGER Value: 79 End of MIB branch -----SNIP-----
Try the following command ... very interesting if you are connected to a network .... snmptool walk 127.0.0.1 public .1.3 (note the point in front of the 1 - important) For my machine I can see the shared drives, mapped network drives, ethernet adapters, the names/ip addresses of every other machine on my subnet......and all with little effort. It doesn't take einstein to figure out how useful some of this info is to the potential hacker.... BTW, try this against a few web servers when connected to the net....you could be intrigued.
I will also bring along some good info in pdf/html/text format for
further
reading for anyone who is interested.
We could upload this to the web site on the day, too?
Ha! what a fabulous idea... I'll get it all onto one disk and its all yours .....;o) Good excuse to organise it all anyway.
-- MJR
-
Earl Brannigan