SNMP Lab Simulator — CREST CPSA Module D

Target Network

192.168.1.1

CORE-RTR-01

Cisco IOS Core Router

SNMP v2cTelnet

192.168.1.2

ACCESS-SW-01

Cisco Catalyst 2960

SNMP v1

10.10.0.1

BACKUP-RTR-01

Legacy Cisco — Backup Net

SNMP v2cTelnetTFTP

192.168.1.50

TFTP-SRV-01

Linux — No Auth

TFTP

192.168.10.5

FW-01

FortiGate — HTTP Mgmt

HTTP Mgmt

Discovery

nmap -sU -p161

UDP scan — confirm SNMP port

onesixtyone

Brute-force community strings

braa

Fast mass SNMP scanner

snmp-check

Automated SNMP audit

snmp-enum

Perl-based full enumerator

Enumeration

snmpwalk [full]

Walk the full MIB tree

snmpbulkwalk

Fast bulk enumeration (GETBULK)

snmpwalk [routes]

Extract routing table

snmpwalk [interfaces]

Enumerate all interfaces

snmpwalk [arp]

Dump ARP cache

snmpwalk [processes]

List running processes

snmpget

Get a specific OID value

Exploitation

snmpset

Write via private community

msfconsole [snmp_enum]

Metasploit SNMP enumerator

msfconsole [snmp_login]

Metasploit community brute-force

Other

tftp

Connect to TFTP server

help

Show all commands

Engagement Progress

Host Discovery

Community Strings

SNMP Enumeration

Topology Mapped

Config Extracted

root@kali:~# — SNMP Lab Simulator v2.0 | Cyber Academy CREST CPSA

root@kali:~#

⬡ Offensive Intel

Run a command to begin.

Offensive intel and exam notes
appear here after each command.

─────────────────

Start here:
onesixtyone → find strings
snmpwalk → enumerate
tftp → pull configs

Target192.168.1.1

Commands0

Hosts0

Strings Found0

PhaseRECON