# Exploitation

> Guides on exploiting SNMP write access for RCE via MIB extensions

- **URL:** https://hackindex.io/services/snmp/exploitation
- **Service:** [SNMP](https://hackindex.io/services/snmp.md)
- **Tags:** initial-access, execution
- **Published:** 2026-03-11
- **Updated:** 2026-03-29

SNMP exploitation leverages write access and agent features to modify device configuration or execute commands. A writable community string (often "private") lets you change router configs, modify sysLocation/sysContact for social engineering, or alter VLAN assignments to reposition yourself on the network.

NET-SNMP's extend functionality is the most direct path to RCE on Linux hosts. If snmpd.conf allows extend directives and you have write access, you can register arbitrary commands that execute under the SNMP daemon's user. Credential extraction through SNMP is also common: Cisco IOS leaks SNMP community strings and sometimes enable passwords through specific OIDs, while Windows SNMP agents can expose local account information.

On network devices, SNMP write access can rewrite TFTP boot configs, add GRE tunnels, or change ACLs. The impact scales with the device's role in the network. A writable community string on a core router is often equivalent to full infrastructure compromise.

## Guides

- [SNMP Write Abuse – RCE via NET-SNMP-EXTEND-MIB](https://hackindex.io/services/snmp/exploitation/snmp-write-abuse-rce-via-net-snmp-extend-mib.md): Exploit SNMP write access to inject arbitrary commands via NET-SNMP-EXTEND-MIB, achieving remote code execution on misconfigured SNMP agents.