Netmon
Last updated
Was this helpful?
Last updated
Was this helpful?
HTB 10. Netmon
nmap -T4 -p- -A 10.10.10.152
shows port 21 (ftp) with anonymous login enabled and lists possibly the C:
drive, port 80 (http) running Indy httpd 18.1.37.13946
, and ports 135/139/445 (rpc) reveal machine is running Microsoft Windows Server 2008 R2
, two webservers running on 5985 and 47001 both are 404s. Webpage probably in /inetpub
.
Go to 10.10.10.152
and shows login. Google PRTG Network Monitor default credentials
shows prgtadmin:prgtadmin
that don't work. Google for PRTG Network Monitor exploit
finds which needs authentication.
Search for prtg network monitor db file location
finds paths to possibly find login credentials
ftp 10.10.10.152
and cd "Users\All Users\Application Data\"
is access denied. Try cd "Users\All Users\Application Data\Paessler\PRTG Network Monitor"
which works.
Download the three configurations files. Opening the PRTG Configuration.dat
and searching for prtgadmin
(the default username) finds encrypted password. Test the old
file which is encrypted too. Test the old.back
which has the unencrypted password.
Login with credentials prtgadmin:PrTg@admin2018
, which fails. Lets try prtgadmin:PrTg@admin2019
since that was from a backup file from a year ago. This password works.
Open Burp Suite and intercept finds the cookie needed for the exploit find earlier.
Download and run with ./exploit.sh -u http://10.10.10.152 -c "OCTOPUS1813713946=XXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
to create admin user with credentials pentest:P3nT3st!
on the computer not the webinterface.
Get . Try psexec.py pentest:P3nT3st!@10.10.10.152
which works to gain a remote shell. Can also try wmiexec.py
or smbexec.py
.
psexec can only work with the following:
TCP port 445
The admin$ administrative share available
You know a local account’s credential
psexec.py
is less likely to trigger antivirus than metasploit verion. But, both wmiexec.py
and smbexec.py
are the least likely to trigger antivirus.