January 2021
Intermediate to advanced
547 pages
12h 4m
Chinese
Content preview from 网络安全评估（第三版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
220
｜
第
7
章
表
7
-
15
：SNMP 协议版本
版本
认证机制
传输安全
（
可选
）
1
社区字符串无
无
2
3
用户名和密码
，
使用
MD5
或
SHA-1
进行哈希
168
位
3DES
或者
256
位
AES
渗透攻击
SNMP
SNMP
服务容易受到如下几种类型的远程攻击：
•
通过
SNMPv3
进行用户枚举。
• community
字符串和用户口令值暴力破解。
•
通过读取
SNMP
数据（低权限）暴露有用信息。
•
通过写
SNMP
数据（高权限）进行攻击渗透。
•
对软件实现漏洞进行渗透攻击并导致相应后果（如远程代码执行）。
下面对每一种攻击方式进行展开描述。
通过
SNMPv3
进行用户枚举
要查询运行
SNMPv3
的可访问
SNMP
服务并枚举用户名，需安装
SNMP
MIBS
软件包并下载
Rory McCune
的
snmpv3enum.rb
脚本，如下所示：
apt-get install snmp-mibs-downloader
download-mibs
wget http://bit.ly/2ccg7cj
wget http://bit.ly/2cch18I
chmod 755 snmpv3enum.rb
脚本就位后，可以使用缺省的用户名列表开展攻击：
root@kali:~#
./snmpv3enum.rb -i 10.0.0.5 -u usernames
valid username : snmpAdmin on host : 10.0.0.5
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.