The simple network management protocol S&P.
Is used to query networked devices for information such as bandwidth utilization, collision rates and
a whole lot of other information.
But it doesn't only provide network management and monitoring capabilities.
But it's also capable of changing the configurations on the host, allowing the remote management of
the network device.
Yes, I can tell this gets you excited, huh?
My young apprentice.
And you are right.
So S&P servers can offer considerable information for penetration testers to perform reconnaissance
on a specific system, you may also see S&P installations on some operating systems to specify information
such as CPU utilization, free memory and so on.
It's often automatically installed on many network devices with public and the restring and private
in the right string.
On Windows based devices by poorly configured S&P, you can extract patch levels, running services,
usernames, uptime routes and, well, so much information that it'll totally level up the penetration
test for you.
So let's use the services command to search for S&P service.
And yes, indeed, you only have to open the S&P report on Métis voidable three.
The version is one.
As an MP, version one and version two, both have proven security flaws, but S&P version three is
improved with encryption as well as better check mechanisms.
But anyway, I'll search for S&P auxiliaries.
And this time I'm going to start with S&P Inam.
Show me the options.
Oh, and by the way, the community strings are essentially passwords that are used to read or write
information to a device.
So if the SNP version is right and you guess the community strings.
The S&P itself can allow anything from excessive information disclosure to full system compromise.
Let me give you an example, if you get the read right, S&P community string for a Cisco router, you
can download, modify and upload the configuration to the router with a back door.
So here, I'm not going to change the community variable.
I will just set the poor to one six one.
And yeah, everything looks quite good.
Now, I'll run the module.
So as you can see, S&P brings all the information about the target, Métis voidable three.
From running applications to network interfaces.
Service information, device, information, user enumeration, nearly everything about the target.