Linuxito - Cómo recolectar información de hosts remotos con SNMP

Cómo recolectar información de hosts remotos con SNMP

Detalles: Categoría: Seguridad; Creado en Lunes, 12 Noviembre 2012 15:06; Visitas: 482

El Protocolo Simple de Administración de Red o SNMP (del inglés Simple Network Management Protocol) es un protocolo de la capa de aplicación que facilita el intercambio de información de administración entre dispositivos de red. Permite a los administradores supervisar el funcionamiento de la red, buscar y resolver sus problemas, y planear su crecimiento.

Dentro de una red corporativa, un atacante puede utilizar el protocolo SNMP para obtener información sensible sobre un sistema blanco de ataque. Este artículo explica cómo utilizar la herramienta snmpcheck para recolectar información de hosts remotos a través del protocolo SNMP.

snmpcheck permite enumerar dispositivos SNMP y obtener la salida en un formato legible y amigable. Es una herramienta útil para realizar test de penetración (penetration tests, pentest) o para monitorear sistemas. Se distribuye bajo la licencia GPL.

Para descargar la última versión de snmpcheck se debe utilizar el siguiente enlace. Como se trata de un script Perl, dependiendo del sistema tal vez sea necesario instalar alguna librería adicional. Para ello se debe utilizar la herramienta cpan, la cual se utiliza para acceder al repositorio de software de Perl (CPAN - Comprehensive Perl Archive Network - www.cpan.org).

Es posible instalar una librería desde CPAN de la siguiente forma (en mi caso debí instalas las librerías Net::SNMP y Number::Bytes::Human):

# cpan

cpan[1]> install Net::SNMP

cpan[2]> install Number::Bytes::Human

cpan[1]> quit

#

Luego de verificar que snmpcheck funcione correctamente (es decir, se instalen las dependencias faltantes) es posible escanear un host indicando su dirección IP mediante la opción -t:

# ./snmpcheck-1.8.pl -t 192.168.122.235

Como ejemplo de salida, el resultado de escanear un host Windows XP:

snmpcheck.pl v1.8 - SNMP enumerator
Copyright (c) 2005-2011 by Matteo Cantoni (www.nothink.org)

[*] Try to connect to 192.168.122.235
[*] Connected to 192.168.122.235
[*] Starting enumeration at 2012-11-12 10:12:39

[*] System information
-----------------------------------------------------------------------------------------------

Hostname : HAL9000VWXP
Description : Hardware: x86 Family 6 Model 3 Stepping 3 AT/AT COMPATIBLE - Software: Windows 2000 Version 5.1 (Build 2600 Multiprocessor Free)
Uptime system : 250 days, 09:34:36.40
Uptime SNMP daemon : 44 minutes, 12.37
Motd : -
Domain (NT) : WORKGROUP

[*] Devices information
-----------------------------------------------------------------------------------------------

Id Type Status Description

1 Printer Running Microsoft XPS Document Writer
10 Serial Port Unknown COM1:
2 Processor Running Intel
3 Processor Running Intel
4 Network Unknown MS TCP Loopback interface
5 Network Unknown Realtek RTL8139 Family PCI Fast Ethernet NIC - Packet Scheduler
6 Disk Storage Unknown E:\
7 Disk Storage Running Fixed Disk
8 Keyboard Running IBM enhanced (101- or 102-key) keyboard, Subtype=(0)
9 Pointing Running 5-Buttons (with wheel)

[*] Storage information
-----------------------------------------------------------------------------------------------

C:\ Label:Disco C Serial Number b035983e
Device id : 1
Device type : Fixed Disk
Filesystem type : NTFS
Device units : 4096
Memory size : 15G
Memory used : 4.8G
Memory free : 9.9G

D:\ Label:Disco D Serial Number ec2924ee
Device id : 2
Device type : Fixed Disk
Filesystem type : NTFS
Device units : 4096
Memory size : 25G
Memory used : 66M
Memory free : 25G

E:\ Label:VRMPVOL_EN Serial Number d1f75c22
Device id : 3
Device type : Compact Disc
Filesystem type : Fat
Device units : 2048
Memory size : 643M
Memory used : 643M
Memory free : 0

Virtual Memory
Device id : 4
Device type : Virtual Memory
Filesystem type : Unknown
Device units : 65536
Memory size : 1.7G
Memory used : 185M
Memory free : 1.5G

Physical Memory
Device id : 5
Device type : Ram
Filesystem type : Unknown
Device units : 65536
Memory size : 1.0G
Memory used : 291M
Memory free : 733M

[*] User accounts
-----------------------------------------------------------------------------------------------

Administrator
Guest
HelpAssistant
SUPPORT_388945a0

[*] Processes
-----------------------------------------------------------------------------------------------

Total processes : 26

Process type : 1 unknown, 2 operating system, 3 device driver, 4 application
Process status : 1 running, 2 runnable, 3 not runnable, 4 invalid

Process id Process name Process type Process status Process path

1 System Idle Process 2 1
1012 svchost.exe 4 1 C:\WINDOWS\system32\
1140 spoolsv.exe 4 1 C:\WINDOWS\system32\
1280 svchost.exe 4 1 C:\WINDOWS\system32\
1316 client32.exe 4 1 C:\Program Files\NetSupport\NetSupport Manager\
1372 wscntfy.exe 4 1 C:\WINDOWS\system32\
1464 vmware-usbarbitrator.exe 4 1 C:\Program Files\Common Files\VMware\USB\
1660 ClamTray.exe 4 1 C:\Program Files\ClamWin\bin\
1688 ctfmon.exe 4 1 C:\WINDOWS\system32\
1804 searchindexer.exe 4 1 C:\WINDOWS\system32\
248 alg.exe 4 1 C:\WINDOWS\System32\
2800 snmp.exe 4 1 C:\WINDOWS\System32\
360 vdagent.exe 4 1 C:\
3668 snmptrap.exe 4 1 C:\WINDOWS\System32\
4 System 2 1
408 smss.exe 4 1 \SystemRoot\System32\
464 csrss.exe 4 1 C:\WINDOWS\system32\
488 winlogon.exe 4 1
532 services.exe 4 1 C:\WINDOWS\system32\
544 lsass.exe 4 1 C:\WINDOWS\system32\
724 vdservice.exe 4 1 C:\Program Files\SPICE Guest Tools\32\
744 svchost.exe 4 1 C:\WINDOWS\system32\
796 svchost.exe 4 1 C:\WINDOWS\system32\
856 explorer.exe 4 1 C:\WINDOWS\
864 svchost.exe 4 1 C:\WINDOWS\System32\

[*] Network information
-----------------------------------------------------------------------------------------------

IP forwarding enabled : no
Default TTL : 128
TCP segments received : 109936
TCP segments sent : 74020
TCP segments retrans. : 1604
Input datagrams : 128143
Delivered datagrams : 128139
Output datagrams : 88002

[*] Network interfaces
-----------------------------------------------------------------------------------------------

Interface : [ up ] MS TCP Loopback interface

Interface Speed : 10 Mbps
IP Address : 127.0.0.1
Netmask : 255.0.0.0
MTU : 1520
Bytes In : 67039 (66K)
Bytes Out : 67039 (66K)

Interface : [ up ] Realtek RTL8139 Family PCI Fast Ethernet NIC - Packet Scheduler Miniport

Hardware Address : 52:54:00:f2:4c:fe
Interface Speed : 100 Mbps
IP Address : 192.168.122.235
Netmask : 255.255.255.0
MTU : 1500
Bytes In : 154872275 (148M)
Bytes Out : 6503747 (6.3M)

[*] Routing information
-----------------------------------------------------------------------------------------------

Destination Next Hop Mask Metric

0.0.0.0 192.168.122.1 0.0.0.0 20
127.0.0.0 127.0.0.1 255.0.0.0 1
192.168.122.0 192.168.122.235 255.255.255.0 20
192.168.122.235 127.0.0.1 255.255.255.255 20
192.168.122.255 192.168.122.235 255.255.255.255 20
224.0.0.0 192.168.122.235 240.0.0.0 20

[*] Network services
-----------------------------------------------------------------------------------------------

Application Layer Gateway Service
Automatic Updates
COM+ Event System
Client32
Computer Browser
Cryptographic Services
DCOM Server Process Launcher
DHCP Client
DNS Client
Distributed Link Tracking Client
Error Reporting Service
Event Log
Help and Support
IPSEC Services
Logical Disk Manager
Network Connections
Network Location Awareness (NLA)
Plug and Play
Print Spooler
Protected Storage
RHEV Spice Agent
Remote Access Connection Manager
Remote Procedure Call (RPC)
Remote Registry
SNMP Service
SNMP Trap Service
SSDP Discovery Service
Secondary Logon
Security Accounts Manager
Security Center
Server
Shell Hardware Detection
System Event Notification
System Restore Service
TCP/IP NetBIOS Helper
Task Scheduler
Telephony
Terminal Services
Themes
VMware USB Arbitration Service
WebClient
Windows Audio
Windows Firewall/Internet Connection Sharing (ICS)
Windows Management Instrumentation
Windows Search
Windows Time
Wireless Zero Configuration
Workstation

[*] Listening TCP ports and connections
-----------------------------------------------------------------------------------------------

Local Address Port Remote Address Port State

0.0.0.0 135 0.0.0.0 39086 Listening
0.0.0.0 3389 0.0.0.0 2192 Listening
0.0.0.0 445 0.0.0.0 39022 Listening
0.0.0.0 5405 0.0.0.0 47300 Listening
127.0.0.1 1025 0.0.0.0 2109 Listening

[*] Listening UDP ports
-----------------------------------------------------------------------------------------------

Local Address Port

0.0.0.0 161
0.0.0.0 162
0.0.0.0 445
0.0.0.0 4500
0.0.0.0 500
0.0.0.0 5405
127.0.0.1 123
127.0.0.1 1900
192.168.122.235 123
192.168.122.235 137
192.168.122.235 138

[*] Software components
-----------------------------------------------------------------------------------------------

1. ClamWin Free Antivirus 0.97.6
10. Security Update for Windows Media Player (KB2378111)
100. Security Update for Windows XP (KB974112)
101. Security Update for Windows XP (KB974318)
102. Security Update for Windows XP (KB974392)
103. Security Update for Windows XP (KB974571)
104. Security Update for Windows XP (KB975025)
105. Security Update for Windows XP (KB975467)
106. Security Update for Windows Media Player (KB975558)
107. Security Update for Windows XP (KB975560)
108. Security Update for Windows XP (KB975713)
109. Security Update for Windows XP (KB977816)
11. Security Update for Windows XP (KB2387149)
110. Security Update for Windows XP (KB977914)
111. Security Update for Windows XP (KB978338)
112. Security Update for Windows XP (KB978542)
113. Security Update for Windows Media Player (KB978695)
114. Security Update for Windows XP (KB978706)
115. Security Update for Windows XP (KB979309)
116. Security Update for Windows XP (KB979482)
117. Security Update for Windows XP (KB979687)
118. Security Update for Windows XP (KB981322)
119. Security Update for Windows XP (KB981997)
12. Security Update for Windows XP (KB2393802)
120. Security Update for Windows XP (KB982132)
121. Security Update for Windows XP (KB982665)
122. Microsoft .NET Framework 3.5 SP1
123. Microsoft Visual J# 2.0 Redistributable Package - SE
124. Microsoft National Language Support Downlevel APIs
125. UltraVnc
126. Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
127. Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
128. Windows Genuine Advantage Validation Tool (KB892130)
129. Windows Genuine Advantage Notifications (KB905474)
13. Security Update for Windows XP (KB2419632)
130. VMware vSphere Client 5.0
131. Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
132. WebFldrs XP
133. Microsoft .NET Framework 3.0 Service Pack 2
134. Microsoft .NET Framework 2.0 Service Pack 2
135. Microsoft .NET Framework 3.5 SP1
136. Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
137. NetSupport Manager
138. Microsoft Visual J# 2.0 Redistributable Package - SE
14. Security Update for Windows XP (KB2423089)
15. Security Update for Windows XP (KB2440591)
16. Security Update for Windows XP (KB2443105)
17. Security Update for Windows XP (KB2476490)
18. Security Update for Windows XP (KB2478960)
19. Security Update for Windows XP (KB2478971)
2. Microsoft Internationalized Domain Names Mitigation APIs
20. Security Update for Windows XP (KB2479943)
21. Security Update for Windows XP (KB2481109)
22. Security Update for Windows XP (KB2483185)
23. Security Update for Windows XP (KB2485663)
24. Update for Windows XP (KB2492386)
25. Security Update for Windows XP (KB2506212)
26. Security Update for Windows XP (KB2507618)
27. Security Update for Windows XP (KB2507938)
28. Security Update for Windows XP (KB2508429)
29. Security Update for Windows XP (KB2509553)
3. Windows Internet Explorer 7
30. Security Update for Windows XP (KB2510581)
31. Security Update for Windows XP (KB2535512)
32. Security Update for Windows XP (KB2536276-v2)
33. Security Update for Windows XP (KB2544521)
34. Security Update for Windows XP (KB2544893-v2)
35. Security Update for Microsoft Windows (KB2564958)
36. Security Update for Windows XP (KB2566454)
37. Security Update for Windows XP (KB2570947)
38. Security Update for Windows XP (KB2584146)
39. Security Update for Windows XP (KB2585542)
4. Security Update for Windows XP (KB2079403)
40. Security Update for Windows XP (KB2592799)
41. Security Update for Windows XP (KB2598479)
42. Security Update for Windows XP (KB2603381)
43. Security Update for Windows XP (KB2618451)
44. Security Update for Windows XP (KB2619339)
45. Security Update for Windows XP (KB2620712)
46. Security Update for Windows XP (KB2624667)
47. Security Update for Windows XP (KB2631813)
48. Hotfix for Windows XP (KB2633952)
49. Security Update for Windows XP (KB2646524)
5. Security Update for Windows XP (KB2115168)
50. Security Update for Windows XP (KB2653956)
51. Security Update for Windows XP (KB2659262)
52. Security Update for Windows XP (KB2661637)
53. Security Update for Windows XP (KB2676562)
54. Security Update for Windows XP (KB2685939)
55. Security Update for Windows XP (KB2686509)
56. Security Update for Windows XP (KB2695962)
57. Security Update for Windows XP (KB2699988)
58. Security Update for Windows XP (KB2707511)
59. Security Update for Windows XP (KB2709162)
6. Security Update for Windows XP (KB2229593)
60. Update for Windows XP (KB2718704)
61. Windows Genuine Advantage Validation Tool (KB892130)
62. Update for Windows XP (KB898461)
63. Hotfix for Windows XP (KB915800-v4)
64. Security Update for Windows XP (KB923561)
65. Security Update for Windows XP (KB923789)
66. Windows Search 4.0
67. Security Update for Windows XP (KB946648)
68. Security Update for Windows XP (KB950762)
69. Security Update for Windows XP (KB950974)
7. Security Update for Windows XP (KB2296011)
70. Security Update for Windows XP (KB951376-v2)
71. Update for Windows XP (KB951978)
72. Security Update for Windows XP (KB952004)
73. Security Update for Windows Media Player (KB952069)
74. Hotfix for Windows XP (KB952287)
75. Security Update for Windows XP (KB952954)
76. Security Update for Windows Media Player (KB954155)
77. Security Update for Windows XP (KB954459)
78. Hotfix for Windows XP (KB954550-v5)
79. Security Update for Windows XP (KB956572)
8. Security Update for Windows XP (KB2347290)
80. Security Update for Windows XP (KB956744)
81. Security Update for Windows XP (KB956802)
82. Security Update for Windows XP (KB956844)
83. Security Update for Windows XP (KB958644)
84. Security Update for Windows XP (KB959426)
85. Security Update for Windows XP (KB960803)
86. Security Update for Windows XP (KB960859)
87. Security Update for Windows XP (KB961501)
88. Update for Windows XP (KB968389)
89. Security Update for Windows XP (KB969059)
9. Security Update for Windows XP (KB2360937)
90. Update for Windows XP (KB971029)
91. Update for Microsoft Windows (KB971513)
92. Security Update for Windows XP (KB971657)
93. Security Update for Windows XP (KB972270)
94. Security Update for Windows XP (KB973507)
95. Security Update for Windows Media Player (KB973540)
96. Update for Windows XP (KB973687)
97. Update for Windows XP (KB973815)
98. Security Update for Windows XP (KB973869)

[*] Web server information
-----------------------------------------------------------------------------------------------

Total bytes sent low word : -
Total bytes received low word : -
Total files sent : -
Current anonymous users : -
Current non anonymous users : -
Total anonymous users : -
Total non anonymous users : -
Max anonymous users : -
Max non anonymous users : -
Current connections : -
Max connections : -
Connection attempts : -
Logon attempts : -
Total gets : -
Total posts : -
Total heads : -
Total others : -
Total CGI requests : -
Total BGI requests : -
Total not found errors : -

[*] Enumerated 192.168.122.235 in 1.08 seconds
Signal USR1 received in thread 1, but no signal handler set. at ./snmpcheck-1.8.pl line 230.