README.md

Netmon

Write-up author: jon-brandy

DESCRIPTION:

• NONE

HINT:

• NONE

STEPS:

1. First, let's do nmap.

RESULT

2. Based from the result here, we know that anonymous ftp login allowed and the machine seems running a web service at port 5985. Not only that there's SMB ports open.
3. And it seems there's a vuln with the smb service.

4. Anyway let's login with ftp.

RESULT - INFORMATION GATHERING

5. Notice there's user.txt file, let's download that.

RESULT

USER FLAG

607cf9cc7557252d24df4bff40865833

6. Now let's open the host in the web browser.

RESULT

7. I did a small outsource about PRTG Network Monitor (NETMON) default credentials.

RESULT

https://www.192-168-1-1-ip.co/router/prtg/prtg-network-monitor/16981/

RESULT

8. Hmm.. Let's check any backup files available (?)

RESULT

9. Let's jump to programData.

RESULT

10. The Paessler directory called my attention.
11. Let's jump there.

RESULT

12. Notice there's a backup file, download the .bak file.

RESULT

13. When i cat the file, there's a lot of base64 encoded text, but none of what i found gave me the flag or any clue.
14. Anyway i found this tag which has the cred.

RESULT

username -> prtgadmin
password -> PrTg@dmin2018

15. Still got the wrong cred.
16. I'm stucked here, then i tried to change the year to 2019 (since the box was released in 2019).

RESULT

17. Got no clue now, let's search for PRTG Exploit.

https://www.exploit-db.com/exploits/46527
https://github.com/wildkindcc/CVE-2018-9276

18. It seems we can copy the root.txt file to the public repository by this command:

Copy-Item -Path "C:\Users\Administrator\Desktop\root.txt" -Destination "C:\Users\Public\root.txt" -Recurse

19. Anyway there's another way to get the root.txt file, you can run searchsploit prtg to find another approach.

RESULT

21. Let's copy the script to our directory.

RESULT

22. We can see there's a guide.

23. Let's go back to our first approach, open the web app again, go to setup -> account settings -> notifications.

RESULT

24. Choose add new notification and change the Notification name to New Notification.

25. Choose the Execute Program.

Choose the output file to outfile.ps1

Fill the parameter with this

flag.txt; Copy-Item -Path "C:\Users\Administrator\Desktop\root.txt" -Destination "C:\Users\Public\root.txt" -Recurse

26. Click save!
27. Now open the ftp again, then choose the bell symbol at the notification's name.

RESULT

28. Download the root.txt file.

RESULT

ROOT FLAG

4b0f0ae842643eb2251cc83372cf48b2