NET-SNMP-RW-COMMUNITYPrivilege Escalation

SNMPv2c Write Community

Default 'private' / 'public' RW community strings let attackers reconfigure routers / switches over SNMP — write configs to TFTP, change ACLs, etc.

§ Where this technique fits

NET-SNMP-RW-COMMUNITY is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 1 on average.

§ Dossiers chaining this technique

SNMPv2c write-community → router config exfil → cred sprays
Find a router with 'private' RW community. Trigger SNMP-to-TFTP config download to attacker host. The config has RADIUS shared secret, AAA server IP, ISAKMP PSKs, and SSH user-pubkeys — spray harvested creds.
step 1 / 6

§ What commonly comes next

01
SNMP TFTP Config Download
NET-SNMP-CONFIG-DL · Collection
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

SNMPv2c write-community → router config exfil → cred sprays

§ What commonly comes next