Cómo recolectar información de hosts remotos con SNMP

El Protocolo Simple de Administración de Red o SNMP (del inglés Simple Network Management Protocol) es un protocolo de la capa de aplicación que facilita el intercambio de información de administración entre dispositivos de red. Permite a los administradores supervisar el funcionamiento de la red, buscar y resolver sus problemas, y planear su crecimiento.

Dentro de una red corporativa, un atacante puede utilizar el protocolo SNMP para obtener información sensible sobre un sistema blanco de ataque. Este artículo explica cómo utilizar la herramienta snmpcheck para recolectar información de hosts remotos a través del protocolo SNMP.



snmpcheck permite enumerar dispositivos SNMP y obtener la salida en un formato legible y amigable. Es una herramienta útil para realizar test de penetración (penetration tests, pentest) o para monitorear sistemas. Se distribuye bajo la licencia GPL.

Para descargar la última versión de snmpcheck se debe utilizar el siguiente enlace. Como se trata de un script Perl, dependiendo del sistema tal vez sea necesario instalar alguna librería adicional. Para ello se debe utilizar la herramienta cpan, la cual se utiliza para acceder al repositorio de software de Perl (CPAN - Comprehensive Perl Archive Network - www.cpan.org).

Es posible instalar una librería desde CPAN de la siguiente forma (en mi caso debí instalas las librerías Net::SNMP y Number::Bytes::Human):

# cpan

cpan[1]> install Net::SNMP

cpan[2]> install Number::Bytes::Human

cpan[1]> quit

#

Luego de verificar que snmpcheck funcione correctamente (es decir, se instalen las dependencias faltantes) es posible escanear un host indicando su dirección IP mediante la opción -t:

# ./snmpcheck-1.8.pl -t 192.168.122.235

Como ejemplo de salida, el resultado de escanear un host Windows XP:

snmpcheck.pl v1.8 - SNMP enumerator                                                                                                  
Copyright (c) 2005-2011 by Matteo Cantoni (www.nothink.org)                                                                          

 [*] Try to connect to 192.168.122.235
 [*] Connected to 192.168.122.235     
 [*] Starting enumeration at 2012-11-12 10:12:39

 [*] System information
 -----------------------------------------------------------------------------------------------

 Hostname               : HAL9000VWXP
 Description            : Hardware: x86 Family 6 Model 3 Stepping 3 AT/AT COMPATIBLE - Software: Windows 2000 Version 5.1 (Build 2600 Multiprocessor Free)                                                                                                                
 Uptime system          : 250 days, 09:34:36.40                                                                                      
 Uptime SNMP daemon     : 44 minutes, 12.37                                                                                          
 Motd                   : -                                                                                                          
 Domain (NT)            : WORKGROUP                                                                                                  

 [*] Devices information
 -----------------------------------------------------------------------------------------------

    Id                 Type   Status  Description

     1              Printer  Running  Microsoft XPS Document Writer
    10          Serial Port  Unknown  COM1:                        
     2            Processor  Running  Intel                        
     3            Processor  Running  Intel                        
     4              Network  Unknown  MS TCP Loopback interface    
     5              Network  Unknown  Realtek RTL8139 Family PCI Fast Ethernet NIC - Packet Scheduler 
     6         Disk Storage  Unknown  E:\                                                             
     7         Disk Storage  Running  Fixed Disk                                                      
     8             Keyboard  Running  IBM enhanced (101- or 102-key) keyboard, Subtype=(0)            
     9             Pointing  Running  5-Buttons  (with wheel)                                         

 [*] Storage information
 -----------------------------------------------------------------------------------------------

 C:\ Label:Disco C  Serial Number b035983e
        Device id       : 1               
        Device type     : Fixed Disk      
        Filesystem type : NTFS            
        Device units    : 4096            
        Memory size     : 15G             
        Memory used     : 4.8G            
        Memory free     : 9.9G            

 D:\ Label:Disco D  Serial Number ec2924ee
        Device id       : 2               
        Device type     : Fixed Disk      
        Filesystem type : NTFS            
        Device units    : 4096            
        Memory size     : 25G             
        Memory used     : 66M             
        Memory free     : 25G             

 E:\ Label:VRMPVOL_EN  Serial Number d1f75c22
        Device id       : 3                  
        Device type     : Compact Disc       
        Filesystem type : Fat                
        Device units    : 2048               
        Memory size     : 643M               
        Memory used     : 643M               
        Memory free     : 0                  

 Virtual Memory
        Device id       : 4
        Device type     : Virtual Memory
        Filesystem type : Unknown       
        Device units    : 65536         
        Memory size     : 1.7G          
        Memory used     : 185M          
        Memory free     : 1.5G          

 Physical Memory
        Device id       : 5
        Device type     : Ram
        Filesystem type : Unknown
        Device units    : 65536  
        Memory size     : 1.0G   
        Memory used     : 291M   
        Memory free     : 733M   


 [*] User accounts
 -----------------------------------------------------------------------------------------------

 Administrator
 Guest        
 HelpAssistant
 SUPPORT_388945a0             

 [*] Processes
 -----------------------------------------------------------------------------------------------

 Total processes : 26

 Process type    : 1 unknown, 2 operating system, 3 device driver, 4 application
 Process status  : 1 running, 2 runnable, 3 not runnable, 4 invalid             

 Process id              Process name  Process type  Process status  Process path

          1       System Idle Process             2               1  
       1012               svchost.exe             4               1  C:\WINDOWS\system32\
       1140               spoolsv.exe             4               1  C:\WINDOWS\system32\
       1280               svchost.exe             4               1  C:\WINDOWS\system32\
       1316              client32.exe             4               1  C:\Program Files\NetSupport\NetSupport Manager\
       1372               wscntfy.exe             4               1  C:\WINDOWS\system32\                           
       1464  vmware-usbarbitrator.exe             4               1  C:\Program Files\Common Files\VMware\USB\      
       1660              ClamTray.exe             4               1  C:\Program Files\ClamWin\bin\                  
       1688                ctfmon.exe             4               1  C:\WINDOWS\system32\                           
       1804         searchindexer.exe             4               1  C:\WINDOWS\system32\                           
        248                   alg.exe             4               1  C:\WINDOWS\System32\                           
       2800                  snmp.exe             4               1  C:\WINDOWS\System32\                           
        360               vdagent.exe             4               1  C:\                                            
       3668              snmptrap.exe             4               1  C:\WINDOWS\System32\                           
          4                    System             2               1                                                 
        408                  smss.exe             4               1  \SystemRoot\System32\                          
        464                 csrss.exe             4               1  C:\WINDOWS\system32\                           
        488              winlogon.exe             4               1                                                 
        532              services.exe             4               1  C:\WINDOWS\system32\                           
        544                 lsass.exe             4               1  C:\WINDOWS\system32\                           
        724             vdservice.exe             4               1  C:\Program Files\SPICE Guest Tools\32\         
        744               svchost.exe             4               1  C:\WINDOWS\system32\                           
        796               svchost.exe             4               1  C:\WINDOWS\system32\                           
        856              explorer.exe             4               1  C:\WINDOWS\                                    
        864               svchost.exe             4               1  C:\WINDOWS\System32\                           

 [*] Network information
 -----------------------------------------------------------------------------------------------

 IP forwarding enabled   : no
 Default TTL             : 128
 TCP segments received   : 109936
 TCP segments sent       : 74020 
 TCP segments retrans.   : 1604  
 Input datagrams         : 128143
 Delivered datagrams     : 128139
 Output datagrams        : 88002 

 [*] Network interfaces
 -----------------------------------------------------------------------------------------------

 Interface               : [ up ] MS TCP Loopback interface

        Interface Speed  : 10 Mbps
        IP Address       : 127.0.0.1
        Netmask          : 255.0.0.0
        MTU              : 1520     
        Bytes In         : 67039 (66K)
        Bytes Out        : 67039 (66K)

 Interface               : [ up ] Realtek RTL8139 Family PCI Fast Ethernet NIC - Packet Scheduler Miniport

        Hardware Address : 52:54:00:f2:4c:fe
        Interface Speed  : 100 Mbps         
        IP Address       : 192.168.122.235  
        Netmask          : 255.255.255.0    
        MTU              : 1500             
        Bytes In         : 154872275 (148M) 
        Bytes Out        : 6503747 (6.3M)   


 [*] Routing information
 -----------------------------------------------------------------------------------------------

      Destination         Next Hop             Mask     Metric

          0.0.0.0    192.168.122.1          0.0.0.0       20
        127.0.0.0        127.0.0.1        255.0.0.0        1
    192.168.122.0  192.168.122.235    255.255.255.0       20
  192.168.122.235        127.0.0.1  255.255.255.255       20
  192.168.122.255  192.168.122.235  255.255.255.255       20
        224.0.0.0  192.168.122.235        240.0.0.0       20

 [*] Network services
 -----------------------------------------------------------------------------------------------

 Application Layer Gateway Service
 Automatic Updates                
 COM+ Event System                
 Client32                         
 Computer Browser                 
 Cryptographic Services           
 DCOM Server Process Launcher     
 DHCP Client                      
 DNS Client                       
 Distributed Link Tracking Client 
 Error Reporting Service          
 Event Log                        
 Help and Support                 
 IPSEC Services                   
 Logical Disk Manager             
 Network Connections              
 Network Location Awareness (NLA) 
 Plug and Play                    
 Print Spooler                    
 Protected Storage                
 RHEV Spice Agent                 
 Remote Access Connection Manager 
 Remote Procedure Call (RPC)      
 Remote Registry                  
 SNMP Service                     
 SNMP Trap Service                
 SSDP Discovery Service           
 Secondary Logon                  
 Security Accounts Manager        
 Security Center                  
 Server                           
 Shell Hardware Detection         
 System Event Notification        
 System Restore Service           
 TCP/IP NetBIOS Helper            
 Task Scheduler                   
 Telephony                        
 Terminal Services                
 Themes                           
 VMware USB Arbitration Service   
 WebClient                        
 Windows Audio                    
 Windows Firewall/Internet Connection Sharing (ICS)
 Windows Management Instrumentation                
 Windows Search                                    
 Windows Time                                      
 Wireless Zero Configuration                       
 Workstation                                       

 [*] Listening TCP ports and connections
 -----------------------------------------------------------------------------------------------

   Local Address   Port      Remote Address   Port       State

         0.0.0.0    135             0.0.0.0  39086       Listening
         0.0.0.0   3389             0.0.0.0   2192       Listening
         0.0.0.0    445             0.0.0.0  39022       Listening
         0.0.0.0   5405             0.0.0.0  47300       Listening
       127.0.0.1   1025             0.0.0.0   2109       Listening

 [*] Listening UDP ports
 -----------------------------------------------------------------------------------------------

   Local Address   Port

         0.0.0.0    161
         0.0.0.0    162
         0.0.0.0    445
         0.0.0.0   4500
         0.0.0.0    500
         0.0.0.0   5405
       127.0.0.1    123
       127.0.0.1   1900
 192.168.122.235    123
 192.168.122.235    137
 192.168.122.235    138

 [*] Software components
 -----------------------------------------------------------------------------------------------

 1. ClamWin Free Antivirus 0.97.6
 10. Security Update for Windows Media Player (KB2378111)
 100. Security Update for Windows XP (KB974112)          
 101. Security Update for Windows XP (KB974318)          
 102. Security Update for Windows XP (KB974392)          
 103. Security Update for Windows XP (KB974571)          
 104. Security Update for Windows XP (KB975025)          
 105. Security Update for Windows XP (KB975467)          
 106. Security Update for Windows Media Player (KB975558)
 107. Security Update for Windows XP (KB975560)          
 108. Security Update for Windows XP (KB975713)          
 109. Security Update for Windows XP (KB977816)          
 11. Security Update for Windows XP (KB2387149)          
 110. Security Update for Windows XP (KB977914)          
 111. Security Update for Windows XP (KB978338)          
 112. Security Update for Windows XP (KB978542)          
 113. Security Update for Windows Media Player (KB978695)
 114. Security Update for Windows XP (KB978706)          
 115. Security Update for Windows XP (KB979309)          
 116. Security Update for Windows XP (KB979482)          
 117. Security Update for Windows XP (KB979687)          
 118. Security Update for Windows XP (KB981322)          
 119. Security Update for Windows XP (KB981997)          
 12. Security Update for Windows XP (KB2393802)          
 120. Security Update for Windows XP (KB982132)          
 121. Security Update for Windows XP (KB982665)          
 122. Microsoft .NET Framework 3.5 SP1                   
 123. Microsoft Visual J# 2.0 Redistributable Package - SE
 124. Microsoft National Language Support Downlevel APIs  
 125. UltraVnc                                            
 126. Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
 127. Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
 128. Windows Genuine Advantage Validation Tool (KB892130)   
 129. Windows Genuine Advantage Notifications (KB905474)     
 13. Security Update for Windows XP (KB2419632)              
 130. VMware vSphere Client 5.0                              
 131. Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
 132. WebFldrs XP                                                   
 133. Microsoft .NET Framework 3.0 Service Pack 2                   
 134. Microsoft .NET Framework 2.0 Service Pack 2                   
 135. Microsoft .NET Framework 3.5 SP1                              
 136. Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)        
 137. NetSupport Manager                                            
 138. Microsoft Visual J# 2.0 Redistributable Package - SE          
 14. Security Update for Windows XP (KB2423089)                     
 15. Security Update for Windows XP (KB2440591)                     
 16. Security Update for Windows XP (KB2443105)                     
 17. Security Update for Windows XP (KB2476490)                     
 18. Security Update for Windows XP (KB2478960)                     
 19. Security Update for Windows XP (KB2478971)                     
 2. Microsoft Internationalized Domain Names Mitigation APIs        
 20. Security Update for Windows XP (KB2479943)                     
 21. Security Update for Windows XP (KB2481109)                     
 22. Security Update for Windows XP (KB2483185)                     
 23. Security Update for Windows XP (KB2485663)                     
 24. Update for Windows XP (KB2492386)                              
 25. Security Update for Windows XP (KB2506212)                     
 26. Security Update for Windows XP (KB2507618)                     
 27. Security Update for Windows XP (KB2507938)                     
 28. Security Update for Windows XP (KB2508429)                     
 29. Security Update for Windows XP (KB2509553)                     
 3. Windows Internet Explorer 7                                     
 30. Security Update for Windows XP (KB2510581)                     
 31. Security Update for Windows XP (KB2535512)                     
 32. Security Update for Windows XP (KB2536276-v2)                  
 33. Security Update for Windows XP (KB2544521)                     
 34. Security Update for Windows XP (KB2544893-v2)                  
 35. Security Update for Microsoft Windows (KB2564958)              
 36. Security Update for Windows XP (KB2566454)                     
 37. Security Update for Windows XP (KB2570947)                     
 38. Security Update for Windows XP (KB2584146)                     
 39. Security Update for Windows XP (KB2585542)                     
 4. Security Update for Windows XP (KB2079403)                      
 40. Security Update for Windows XP (KB2592799)                     
 41. Security Update for Windows XP (KB2598479)                     
 42. Security Update for Windows XP (KB2603381)                     
 43. Security Update for Windows XP (KB2618451)                     
 44. Security Update for Windows XP (KB2619339)                     
 45. Security Update for Windows XP (KB2620712)                     
 46. Security Update for Windows XP (KB2624667)                     
 47. Security Update for Windows XP (KB2631813)                     
 48. Hotfix for Windows XP (KB2633952)                              
 49. Security Update for Windows XP (KB2646524)                     
 5. Security Update for Windows XP (KB2115168)                      
 50. Security Update for Windows XP (KB2653956)                     
 51. Security Update for Windows XP (KB2659262)                     
 52. Security Update for Windows XP (KB2661637)                     
 53. Security Update for Windows XP (KB2676562)                     
 54. Security Update for Windows XP (KB2685939)                     
 55. Security Update for Windows XP (KB2686509)                     
 56. Security Update for Windows XP (KB2695962)                     
 57. Security Update for Windows XP (KB2699988)                     
 58. Security Update for Windows XP (KB2707511)                     
 59. Security Update for Windows XP (KB2709162)                     
 6. Security Update for Windows XP (KB2229593)                      
 60. Update for Windows XP (KB2718704)                              
 61. Windows Genuine Advantage Validation Tool (KB892130)           
 62. Update for Windows XP (KB898461)                               
 63. Hotfix for Windows XP (KB915800-v4)                            
 64. Security Update for Windows XP (KB923561)                      
 65. Security Update for Windows XP (KB923789)                      
 66. Windows Search 4.0                                             
 67. Security Update for Windows XP (KB946648)                      
 68. Security Update for Windows XP (KB950762)                      
 69. Security Update for Windows XP (KB950974)                      
 7. Security Update for Windows XP (KB2296011)                      
 70. Security Update for Windows XP (KB951376-v2)                   
 71. Update for Windows XP (KB951978)                               
 72. Security Update for Windows XP (KB952004)                      
 73. Security Update for Windows Media Player (KB952069)            
 74. Hotfix for Windows XP (KB952287)                               
 75. Security Update for Windows XP (KB952954)                      
 76. Security Update for Windows Media Player (KB954155)            
 77. Security Update for Windows XP (KB954459)                      
 78. Hotfix for Windows XP (KB954550-v5)                            
 79. Security Update for Windows XP (KB956572)                      
 8. Security Update for Windows XP (KB2347290)                      
 80. Security Update for Windows XP (KB956744)                      
 81. Security Update for Windows XP (KB956802)                      
 82. Security Update for Windows XP (KB956844)                      
 83. Security Update for Windows XP (KB958644)                      
 84. Security Update for Windows XP (KB959426)                      
 85. Security Update for Windows XP (KB960803)                      
 86. Security Update for Windows XP (KB960859)                      
 87. Security Update for Windows XP (KB961501)                      
 88. Update for Windows XP (KB968389)                               
 89. Security Update for Windows XP (KB969059)                      
 9. Security Update for Windows XP (KB2360937)                      
 90. Update for Windows XP (KB971029)                               
 91. Update for Microsoft Windows (KB971513)                        
 92. Security Update for Windows XP (KB971657)                      
 93. Security Update for Windows XP (KB972270)                      
 94. Security Update for Windows XP (KB973507)                      
 95. Security Update for Windows Media Player (KB973540)            
 96. Update for Windows XP (KB973687)                               
 97. Update for Windows XP (KB973815)                               
 98. Security Update for Windows XP (KB973869)                      

 [*] Web server information
 -----------------------------------------------------------------------------------------------

 Total bytes sent low word     : -
 Total bytes received low word : -
 Total files sent              : -
 Current anonymous users       : -
 Current non anonymous users   : -
 Total anonymous users         : -
 Total non anonymous users     : -
 Max anonymous users           : -
 Max non anonymous users       : -
 Current connections           : -
 Max connections               : -
 Connection attempts           : -
 Logon attempts                : -
 Total gets                    : -
 Total posts                   : -
 Total heads                   : -
 Total others                  : -
 Total CGI requests            : -
 Total BGI requests            : -
 Total not found errors        : -

 [*] Enumerated 192.168.122.235 in 1.08 seconds
Signal USR1 received in thread 1, but no signal handler set. at ./snmpcheck-1.8.pl line 230.



Suscribirse

    Registrate para recibir las novedades y artículos por correo electrónico.

Linuxito en G+