
# snmp_agent_sim.py - SNMPv3 agent using well-known EngineID
from pysnmp.hlapi import *
def snmp_get(engine_id=SnmpEngineID(hexValue='8000000001020304')):
iterator = getCmd(
SnmpEngine(engineID=engine_id),
CommunityData('public', mpModel=0), # not v3, but demo
UdpTransportTarget(('localhost', 161)),
ContextData(),
ObjectType(ObjectIdentity('SNMPv2-MIB', 'sysDescr', 0))
)
errorIndication, errorStatus, errorIndex, varBinds = next(iterator)
print(varBinds)
# Vulnerability: EngineID is guessable; attacker can compute authentication keys offline.
print("SNMPv3 with default EngineID vulnerable to key derivation attacks.")
SNMPv3 设备使用了一个众所周知或易于猜测的 EngineID(例如,全为零或由 MAC 地址派生)。攻击者可以预先计算出身份验证密钥和隐私密钥,从而绕过 SNMPv3 安全机制,获得对设备的读/写访问权限。
该模拟会打印一条警告;实际攻击涉及嗅探 EngineID 并暴力破解或使用默认密码。运行:
pip install pysnmp
python snmp_agent_sim.py