SNMP Community Login Scanner

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'metasploit/framework/community_string_collection'
require 'metasploit/framework/login_scanner/snmp'

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::AuthBrute

  def initialize
    super(
      'Name'        => 'SNMP Community Login Scanner',
      'Description' => %q{
        This module logs in to SNMP devices using common community names.
      },
      'Author'      => 'hdm',
      'References'     =>
        [
          [ 'CVE', '1999-0508' ], # Weak password
          [ 'CVE', '1999-0517' ],
          [ 'CVE', '1999-0516' ],
        ],
      'License'     => MSF_LICENSE
    )

    register_options(
    [
      Opt::RPORT(161),
      OptEnum.new('PROTOCOL', [true, 'The SNMP protocol to use', 'udp', ['udp', 'tcp']]),
      OptEnum.new('VERSION', [true, 'The SNMP version to scan', '1', ['1', '2c', 'all']]),
      OptString.new('PASSWORD', [ false, 'The password to test' ]),
      OptPath.new('PASS_FILE',  [ false, "File containing communities, one per line",
        File.join(Msf::Config.data_directory, "wordlists", "snmp_default_pass.txt")
      ])
    ])

    deregister_options('USERNAME', 'USER_FILE', 'USERPASS_FILE')
  end

  # Operate on a single host so that we can take advantage of multithreading
  def run_host(ip)

    collection = Metasploit::Framework::CommunityStringCollection.new(
        pass_file: datastore['PASS_FILE'],
        password: datastore['PASSWORD']
    )

    scanner = Metasploit::Framework::LoginScanner::SNMP.new(
      configure_login_scanner(
        host: ip,
        port: rport,
        protocol: datastore['PROTOCOL'],
        cred_details: collection,
        stop_on_success: datastore['STOP_ON_SUCCESS'],
        bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
        version: datastore['VERSION'],
        framework: framework,
        framework_module: self,
        queue_size: 100
      )
    )

    scanner.scan! do |result|
      credential_data = result.to_h
      credential_data.merge!(
          module_fullname: self.fullname,
          workspace_id: myworkspace_id
      )
      if result.success?
        credential_core = create_credential(credential_data)
        credential_data[:core] = credential_core
        create_credential_login(credential_data)

        print_good "#{ip}:#{rport} - Login Successful: #{result.credential} (Access level: #{result.access_level}); Proof (sysDescr.0): #{result.proof}"
        report_service(
          :host  => ip,
          :port  => rport,
          :proto => 'udp',
          :name  => 'snmp',
          :info  => result.proof,
          :state => 'open'
        )
      else
        invalidate_login(credential_data)
        print_error "#{ip}:#{rport} - LOGIN FAILED: #{result.credential} (#{result.status})"
      end
    end
  end

  def rport
    datastore['RPORT']
  end

  def protocol
    datastore['PROTOCOL']
  end




end