HTB 10. Netmon
nmap -T4 -p- -A 10.10.10.152shows port 21 (ftp) with anonymous login enabled and lists possibly the
C:drive, port 80 (http) running
Indy httpd 18.104.22.16846, and ports 135/139/445 (rpc) reveal machine is running
Microsoft Windows Server 2008 R2, two webservers running on 5985 and 47001 both are 404s. Webpage probably in
- 2.Go to
10.10.10.152and shows login. Google
PRTG Network Monitor default credentialsshows
prgtadmin:prgtadminthat don't work. Google for
PRTG Network Monitor exploitfinds PRTG Network Monitor 18.2.38 - (Authenticated) Remote Code Execution which needs authentication.
cd "Users\All Users\Application Data\"is access denied. Try
cd "Users\All Users\Application Data\Paessler\PRTG Network Monitor"which works.
- 5.Download the three configurations files. Opening the
PRTG Configuration.datand searching for
prtgadmin(the default username) finds encrypted password. Test the
oldfile which is encrypted too. Test the
old.backwhich has the unencrypted password.
- 6.Login with credentials
prtgadmin:PrTg@admin2018, which fails. Lets try
prtgadmin:PrTg@admin2019since that was from a backup file from a year ago. This password works.
- 7.Open Burp Suite and intercept finds the cookie needed for the exploit find earlier.
- 8.Download the exploit and run with
./exploit.sh -u http://10.10.10.152 -c "OCTOPUS1813713946=XXXXXXXXXXXXXXXXXXXXXXXXXXXXX"to create admin user with credentials
pentest:P3nT3st!on the computer not the webinterface.
- 10.psexec can only work with the following:
- TCP port 445
- The admin$ administrative share available
- You know a local account’s credential
psexec.pyis less likely to trigger antivirus than metasploit verion. But, both
smbexec.pyare the least likely to trigger antivirus.