SNMP Query Running Process List Disclosure

#TRUSTED ac1e1686bfedc4bdef4a20126744ab3dc38cd079086cae811519fb8a814254a4a8dfa1d2abac6bbf018b79b4453fccae9b5a02c1b4f5da6993aaf62abc921f6f3741b183c86396cd1a2f7792abaa0b9345cdefa4c3c13af2e763f1a45470001ced25ce18ec810838015d62f5574845b88b4f36aa5528f4219e4879d3ae9d392adf06120605fad177f3de1431e4ab562cd10d17a5c95703572157a7bf3f0e26cdbb09ba478ed6d05dde68cadecfbb541bf5a527d6a37ecc344e4d52826127263f4db8b0860f919d3685ff59baa7d45ccd0b0598b926baab27fd18dd0a5105034b628ba3ddb53cddc15de2a95ef0fc35716ebddff9154cb4e1c82b8e6e9e51bcbbec2fb0bc7fb86f96bd8b423d4f442255736f5b4ecd000026bb0a0a94e07dd519651f89d3cdb3fc10c58129680e1b70d730bf38ecf3cb22d7c654c1ab3b44efb6f9e894aeb1df10d633baed711779933c17e95a50ccf2ca32a652ba826db2de33441a761d10adffd851653f0df92dea6e709c7cce12c5a89cbbe0ab33827d5c6e71a8fa0fe1d7ad49cb5b054c977bc25c00ec0ec8c240e33b5ef96b9d795a3e9d27d93d9f3c8f2b5bf301c94901940b7d3ae6211bc44e86fc5802025ca14b302bc33749702d69678aeed1be8849ebcdd526907466b2ff9923319259c65214b617f788df49745291c4c66ba57cb5768707d6b0ff489db8f067ba192ec789461081
#TRUST-RSA-SHA256 398d1e35b16d9ba1a56d06955a8f76471c557a9a6247bb53e118e4aee03ea68c432fb9d51d9c6456f385fde4b503ceb2fdeed31c6c1e5c5a46a905858e3e6efd1b8bcf150787d41ea003c74e4763ef03eec8f97eae61f9aefb6caf1bc0f95abdc2628a598f84dab60930255e0fbb671cc83e74872658e179a9e6c365e797461122f5e2e4f44f1acafc0c4039c46fe7a27014da7c35ce1b6c1ac2bab76cbed854b68f598b857414c09affedcbc14af98ed8326817e62fae51fb3a12d5d6a550c751d7ea6045968ccafee313a7983bb4d9513d7179416b32694391b7667000675e39f4cc635dfafe0749190993dda190f7a90c4f13a06dd5c92dcc2290f716d1f4d7f1651b2d777385a9b245ed1f28ef43863940419242e451e7028d8733ee10294cf5102e752c78d8572adb3986835e506cd1c8fd150665f4f0c3719207064b39075c0b6e8f914bc311e10a7bf46fc77ee9995bc063d4ba11a15ae36061981fa16eba28e60ce13dac6385cd946278df835019bca74661c923c840b76cf463b7f6540ae3cd0da2fa6cf19a2fc8679008da969b6f8b721a5fe5876ffbede07692ff5da232980393fef909c81214f022fb496f664bcbe22b6da39c5b4ab94db6ff2d5342866437e85a0b32eb13d786c8b953e3b150e994d1ba469b831b86933a9f53e92e23445335cbe370e5a41cd0ade3fab6cf26b89b15ee2a92103bedb8cd33ee
#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");

if(description)
{
 script_id(10550);
 script_version("1.28");
 script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/17");
 
 script_name(english:"SNMP Query Running Process List Disclosure");
 
 script_set_attribute(attribute:"synopsis", value:
"The list of processes running on the remote host can be obtained via SNMP." );
 script_set_attribute(attribute:"description", value:
"It is possible to obtain the list of running processes on the remote
host by sending SNMP requests with the OID 1.3.6.1.2.1.25.4.2.1.2

An attacker may use this information to gain more knowledge about
the target host." );
 script_set_attribute(attribute:"solution", value:
"Disable the SNMP service on the remote host if you do not use it,
or filter incoming UDP packets going to this port." );
 script_set_attribute(attribute:"risk_factor", value:"None" );
 script_set_attribute(attribute:"plugin_publication_date", value: "2000/11/13");
 script_set_attribute(attribute:"plugin_type", value:"remote");
 script_end_attributes();

 script_summary(english:"Enumerates processes via SNMP");
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2005-2026 Tenable Network Security, Inc.");
 script_family(english:"SNMP");
 script_dependencies("snmp_settings.nasl", "find_service2.nasl");
 script_require_keys("SNMP/community");
 exit(0);
}

include ("snmp_func.inc");
include ("misc_func.inc");

community = get_kb_item_or_exit("SNMP/community");

port = get_kb_item("SNMP/port");
if (!port) port = 161;

if (! get_udp_port_state(port))
  audit(AUDIT_PORT_CLOSED, port, 'udp');

var soc = open_sock_udp(port);
if (!soc)
  audit(AUDIT_SOCK_FAIL, port, "UDP");

oid = "1.3.6.1.2.1.25.4.2.1.2";

soid = oid;
re =  strcat("^",str_replace(string:oid, find:".", replace:'\\.'), '\\.');

report = '';
while(1)
{
  z = snmp_request_next (socket:soc, community:community, oid:soid);
  if (!isnull(z) && egrep (pattern:re,string:z[0]))
  {
   name = z[1];
   soid = z[0];
   p = z[0] - (oid+'.');
   cmdline = snmp_request(socket: soc, community:community, 
   	  oid:  '1.3.6.1.2.1.25.4.2.1.5.'+p);
   cpu = snmp_request(socket: soc, community:community, 
       oid: '1.3.6.1.2.1.25.5.1.1.1.'+p);
   cpu = int(cpu) / 100; cpu = strcat(cpu);
   mem = snmp_request(socket: soc, community:community, 
       oid: '1.3.6.1.2.1.25.5.1.1.2.'+p);
   mem = strcat(mem);
   t1 = 5 - strlen(p); if (t1 < 0) t1 = 0;
   t2 = 6 - strlen(cpu); if (t2 < 1) t2 = 1;
   t3 = 6 - strlen(mem); if (t3 < 1) t3 = 1;
   t4 = 16 - strlen(name); if (t4 < 1) t4 = 1;
   report = strcat(report,
   	  crap(data:' ', length: t1), p, 
   	  crap(data:' ', length: t2), cpu, 
	  crap(data:' ', length: t3), mem,
	  ' ', name, crap(data:' ', length: t4),
	  cmdline, '\n');
  }
  else
    break;
 }

if (strlen(report) > 0)
{
  report = strcat('\n  PID   CPU   MEM COMMAND           ARGS\n', report);
  security_note(port:port, extra:report, protocol:"udp");
}
else audit(AUDIT_LISTEN_NOT_VULN, 'SMTP server', port);