SNMP Request Network Interfaces Enumeration

#TRUSTED 0e3bf42c04f400f16ce24c1c4574ff2496c774f8464195e317c338da03f57d93c5d6f89abaef3be704f2ea5199d06a604ac268c4592c62149423c581d4032eac7f3d22ac5d0eb65042ac3bf62df6795278391e422643fe3753f1b0630d18a07714b60eacd159ca06fe66cae30b42bcdb2d69299f6717dd365e7d5087f3e1b865f8a295de5cd780a8c85a791d82b2158678b2945b72ada8de0dcebc55bdc4e81273bd549dbfbc51c95731e3137c092a052e9157eea0c812f5f1f1b76c181cac6d267efbc8aaa684e48d14683295689a7edf63fb05e1e95d1427471e894c9870076182640e7676d69da86e6c1d6b759c1a41cb879caab95b91813800144f6dfbf5737fed8d9bb723c1d948e00d3e2629f21b061040c510d25bc1ebad714b343b095dd64432fb047edf44e48296def0e3995bad6789877b33fca4cfbd9b17d400a1ff4e5eb4448617670db748aaaf6c6e5bd1f2765b7c1a4de4b27ce125ca1d4fdcd9ea051b6b4c1f269222a27f6dc54d200c74d845097e4303ad4c121958a344c39a056059ccc299862c11142648f9573f67d670dfa123b1f9b1bd55c8ad37f05dc71ccf105504e5fc6a020742ef6f357cbe9df203a9f05c84f1fcf8f363219fa78f0b6f05533a9c1c39265f9be2550230655b48d9e4a567af5bd441cbc04223b07630cdb246959aa07332a59694d2ff2af3ef1a184b753be3bae23305aa9d139b
#TRUST-RSA-SHA256 59ced97e01dab114a6b0f80460aefd3d7b4ce1ae2c17ca97ea372016da1867f4625e20a1e81d1abe3912b3e168f64f12b1b51caaa64da852ca5314dcfdca94d71cc8c4dbb1e769d44f1746300ef31150781f8f75dc1313c0af7bdcaf62b264a97e5c87009debc94a8b703494ec6a84dad6b3056a783826b466f747006e3b6a24bf9c3075bcfa23446e5d605bf550368dadeaeaa7b61673b1787a255958ccf0d55b475e57215762113a443e7a0d58caba490ef4150858a73f1ca2df1145247643519f18fc31565409de1921352344f4b8e7cc7c590b80c5c42897ec1449a0837770b58b4548fe5fedf1a6659020e164401b6dbb8f75b2f5e150ad4a3be121ba59a684e7c90bb60feb57be56496fe3d6608b9487f3a2242905163969ceb4eaf1c7d726e2053db736d60fa759212d279487ada01eb96b307dc510c60e66bb0ecb6bc4255837d80e7d2244f6fa6f2e070a6e435391da08570fc39795fa0f431057cf0e2618177f8bf1d7e97488c0a6f85837dc6abf324f93c4119de0c4eff78fc7c4b7e76dad58cbe57698e48eb0b4c685a22f99e46660019decf27a94adda009906eea9825c6fa7b52d6db8eafc028dee5e392bea2b0108333b01d90cd4aef2bf23b771f100d808bed9e8e62ad7aafc241bd3492a6a4248ca23b521cb6be99dc4ed4ae8beb8629e741a1ed91980febaaa758480df9240eb5b963bd14cf9fc42e39b
#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");

if(description)
{
 script_id(10551);
 script_version("1.33");
 script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/17");
 
 script_name(english:"SNMP Request Network Interfaces Enumeration");
 
 script_set_attribute(attribute:"synopsis", value:
"The list of network interfaces cards of the remote host can be obtained via
SNMP." );
 script_set_attribute(attribute:"description", value:
"It is possible to obtain the list of the network interfaces installed
on the remote host by sending SNMP requests with the OID 1.3.6.1.2.1.2.1.0

An attacker may use this information to gain more knowledge about
the target host." );
 script_set_attribute(attribute:"solution", value:
"Disable the SNMP service on the remote host if you do not use it,
or filter incoming UDP packets going to this port." );
 script_set_attribute(attribute:"risk_factor", value:"None" );
 script_set_attribute(attribute:"plugin_publication_date", value: "2000/11/13");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_end_attributes();

 script_summary(english:"Enumerates processes via SNMP");
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2005-2026 Tenable Network Security, Inc.");
 script_family(english:"SNMP");
 script_dependencies("snmp_settings.nasl", "find_service2.nasl");
 script_require_keys("SNMP/community");
 exit(0);
}

include ("snmp_func.inc");
include ("misc_func.inc");

community = get_kb_item("SNMP/community");
if(!community) exit(0);

port = get_kb_item("SNMP/port");
if(!port)port = 161;

if (! get_udp_port_state(port))
  audit(AUDIT_PORT_CLOSED, port, 'udp');

var soc = open_sock_udp(port);
if (!soc)
  audit(AUDIT_SOCK_FAIL, port, "UDP");

number = snmp_request (socket:soc, community:community, oid:"1.3.6.1.2.1.2.1.0");
oid = "1.3.6.1.2.1.2.1.0";

network = NULL;

cnt = 0;

for (i=1; i<=number; i++)
{
 index = snmp_request_next (socket:soc, community:community, oid:oid);
 if ( index == NULL ) break;
 descr = snmp_request (socket:soc, community:community, oid:'1.3.6.1.2.1.2.2.1.2.'+index[1]);
 phys = snmp_request (socket:soc, community:community, oid:'1.3.6.1.2.1.2.2.1.6.'+index[1]);

 oid = index[0];

 network += strcat(
 '\n Interface ', i, ' information :\n',
 ' ifIndex       : ', index[1], '\n',
 ' ifDescr       : ', descr, '\n',
 ' ifPhysAddress : ', hexstr(phys), '\n',
 '\n'
 );

 if (strlen(phys) == 6 )
 {
   str = hexstr(phys[0]) + ':' + hexstr(phys[1]) + ':' + hexstr(phys[2]) + ':' + hexstr(phys[3]) + ':' + hexstr(phys[4]) + ':' + hexstr(phys[5]); 
  set_kb_item(name:"SNMP/ifPhysAddress/" + cnt, value:str);
  cnt++;
 }
}


if(strlen(network))
{
 security_note(port:port, extra:network, protocol:"udp");
}
else audit(AUDIT_LISTEN_NOT_VULN, 'SMTP server', port);