HTB 10. Netmon

  1. nmap -T4 -p- -A shows port 21 (ftp) with anonymous login enabled and lists possibly the C: drive, port 80 (http) running Indy httpd, and ports 135/139/445 (rpc) reveal machine is running Microsoft Windows Server 2008 R2, two webservers running on 5985 and 47001 both are 404s. Webpage probably in /inetpub.

  2. Go to and shows login. Google PRTG Network Monitor default credentials shows prgtadmin:prgtadmin that don't work. Google for PRTG Network Monitor exploit finds PRTG Network Monitor 18.2.38 - (Authenticated) Remote Code Execution which needs authentication.

  3. Search for prtg network monitor db file location finds paths How and where does PRTG store its data? to possibly find login credentials

  4. ftp and cd "Users\All Users\Application Data\" is access denied. Try cd "Users\All Users\Application Data\Paessler\PRTG Network Monitor" which works.

  5. Download the three configurations files. Opening the PRTG Configuration.dat and searching for prtgadmin (the default username) finds encrypted password. Test the old file which is encrypted too. Test the old.back which has the unencrypted password.

  6. Login with credentials prtgadmin:PrTg@admin2018, which fails. Lets try prtgadmin:PrTg@admin2019 since that was from a backup file from a year ago. This password works.

  7. Open Burp Suite and intercept finds the cookie needed for the exploit find earlier.

  8. Download the exploit and run with ./ -u -c "OCTOPUS1813713946=XXXXXXXXXXXXXXXXXXXXXXXXXXXXX" to create admin user with credentials pentest:P3nT3st! on the computer not the webinterface.

  9. Get impacket. Try pentest:P3nT3st!@ which works to gain a remote shell. Can also try or

  10. psexec can only work with the following:

    • TCP port 445

    • The admin$ administrative share available

    • You know a local account’s credential

  11. is less likely to trigger antivirus than metasploit verion. But, both and are the least likely to trigger antivirus.

Last updated