Netmon

Netmon - 10.10.10.152

Target Enumeration:

OS: Windows

User: dd58ce67b49e15105e88096c8d9255a5

Root: 3018977fb944bf1878f75b879fba67cc

Ports / Services / Software Versions Running

PORT STATE SERVICE VERSION

21/tcp open ftp Microsoft ftpd

80/tcp open http Indy httpd 18.1.37.13946 (Paessler PRTG bandwidth monitor)

135/tcp open msrpc Microsoft Windows RPC

139/tcp open netbios-ssn Microsoft Windows netbios-ssn

445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds

5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

49664/tcp open msrpc Microsoft Windows RPC

49665/tcp open msrpc Microsoft Windows RPC

49666/tcp open msrpc Microsoft Windows RPC

49667/tcp open msrpc Microsoft Windows RPC

49668/tcp open msrpc Microsoft Windows RPC

49669/tcp open msrpc Microsoft Windows RPC

Exploiting the host:

Anonymous FTP is allowed

Can gather the user hash in C:\users\public

User flag

Searching around the FTP dir gives us

Webapp is a monitoring service

Searchsploit gives us the following but we need to be authenticated:

Default creds dont work

The following shows us where the backup password is stored

https://thehackingtutorials.com/prtg-network-monitor-exploit-with-poc/

Download the old config file

Run the file through strings and output to a file

Search the file for prtgadmin to get the password

Does not work so change to 2019

Login with the webapp

Reading the exploit we found on searchsploit states we need the cookies

Searchsploit version seems to be broken so grab it from github

Run the script as stated

Can login with pth-winexe although the machine keeps going down

Now login with psexec and download root.txt

Root.txt