> For the complete documentation index, see [llms.txt](https://www.jdksec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.jdksec.com/hack-the-box/netmon.md).

# Netmon

## Netmon - 10.10.10.152

### Target Enumeration:

OS: Windows

User: dd58ce67b49e15105e88096c8d9255a5

Root: 3018977fb944bf1878f75b879fba67cc

### Ports / Services / Software Versions Running

PORT      STATE SERVICE      VERSION

21/tcp    open ftp         Microsoft ftpd

80/tcp open http Indy httpd 18.1.37.13946 (Paessler PRTG bandwidth monitor)

135/tcp   open msrpc        Microsoft Windows RPC

139/tcp   open netbios-ssn  Microsoft Windows netbios-ssn

445/tcp   open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds

5985/tcp  open http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

47001/tcp open  http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

49664/tcp open  msrpc Microsoft Windows RPC

49665/tcp open  msrpc Microsoft Windows RPC

49666/tcp open  msrpc Microsoft Windows RPC

49667/tcp open  msrpc Microsoft Windows RPC

49668/tcp open  msrpc Microsoft Windows RPC

49669/tcp open  msrpc Microsoft Windows RPC

### Exploiting the host:

Anonymous FTP is allowed

![](https://lh6.googleusercontent.com/3nzCxDxC_HZFASz-WNOJsDnMlKp7hlYarw9NTWs7XFAFnPE6neSMHHxT2aiGxGnBzC0DYepIpVmzGK2xh3CUM1A08yrUXdLJ06xnmo4aGRvBxq_Tb5CgVUd7eEe6N4mbY0F1Cfkl)

Can gather the user hash in C:\users\public

<div align="left"><img src="https://lh6.googleusercontent.com/WESpJ_FpT-rFdT8NBoEeUOtHakTPOngzbnu9tiTPulDOKNNT4bRO6WDiTov64FbEVbkoO3TtGHw6DjjWlUZdy-19xi2IdRjRVTfUKc2KSgy2LULOmYDnabD1QTk9dDe27ULgPsXw" alt=""></div>

User flag

<div align="left"><img src="https://lh5.googleusercontent.com/zM3kKzTrWK10tn6THOUIyES5lbVzV2so1123r4H1-4AU3bIS9tmm5KUDlNY01zNVVzBKi_HVLS678D9iWeqi_ybrEfSBm1DGcydWzPfyk60dpaQFlko2xnNpQH1vi7VaPSa7GnuT" alt=""></div>

Searching around the FTP dir gives us&#x20;

![](https://lh5.googleusercontent.com/qBQLhs6dLoi-Zv2g6N0dyH36OZpNjqostL8YdFGDxQ_zF_JJUDcjtdzuqvkq6C1yMA_qE4hQJUUGGwOksQo7BaIbCTUGeR-EoPKKldLlP52uBNfJ_q8ELYYI-br9yvnZ6PiirngM)

Webapp is a monitoring service

![](https://lh6.googleusercontent.com/qiFE-8dP5jfflIEFFTXTyfTbCpQTdkYCDQG11sbc3KRRTEzTT1Khdo0BY1gpHvxSu4sHSUvZcAtiZk4ZVLjYrObqda8wn4RfBWeMs06SEYncLAy3J-gV2PyQAuFi3qpSUjWT6jCv)

Searchsploit gives us the following but we need to be authenticated:

![](https://lh4.googleusercontent.com/BhgAPw3aenBJPYosTzD7RrosQTPMgnH1KcJ5t_fU3jXKcN5UVQOAYoELjh0WBpZvyiYObKc8-Gl0B6KHjJPlkTzuhlEg_nkxChw2Um4UDNFDOu4eRXshpVo0-8H9NoiHouk6I68l)

Default creds dont work

The following shows us where the backup password is stored

<https://thehackingtutorials.com/prtg-network-monitor-exploit-with-poc/>

Download the old config file

![](https://lh5.googleusercontent.com/OTurQzcnpFoTlWZVs_Fsl5ZvxRz4V3MCi6iV77URLPMwt2Kv4hYB_7Zc3BmHGagef9LfuqfxflWbWNNDdDDezLTYzKMZMKXnFe5KMDMC7Y2Xw2P3SC2Fe4XnuuRTeKJTRJIrXUTO)

Run the file through strings and output to a file

<div align="left"><img src="https://lh6.googleusercontent.com/jimd2jr7n0ACcxqsB5VOpwyDGEfBPxwTePPcHG-qoATdD3CbrKvzpY7HYigySQeHhWy3qj0uEZC10aly3TOjcWUSNKjtWd4RFG6jgDldJsui02Gn0DVVD_2ubfY9dvfY0kszQX_G" alt=""></div>

Search the file for prtgadmin to get the password

<div align="left"><img src="https://lh5.googleusercontent.com/fWS0EMxOjHjz9DtCZRzFTsZ8BZfcs6DUlGe_H8THal1F4KFvt0ZeX1O9u-I1B5ob-t1yvEtnr9gHT3DC2lviMGGnNaoPQFGJ1TpvSrpePsGBohP1Ax--ZgjsMsVrxW6IzIwA5GRO" alt=""></div>

Does not work so change to 2019

Login with the webapp

![](https://lh5.googleusercontent.com/pVlQukNcj68a37uEnSXQnqtw9d1F7sD5tKiEp0Zb7HAVQyDHG8Huu9bcR1s6iYrVDYmPOKke6O2EudCm-zcXD8mFRQYW5wLDT0LvLLOmKTsA7RO4t2C_Yo7MHzViqhepuf9rFF36)

Reading the exploit we found on searchsploit states we need the cookies

![](https://lh5.googleusercontent.com/XjakbZMu79Cyu7LTFZFfwC-liImS050Yxla7CR3vHjOxK0xSJiJCVM-hlUGAWwjNkr0XExSvIzbH3Jm9LiYwNTeL1HycigYNXpmKUelVrHh0CSCBgvSPflPvQ_P6jhpMqpb_nOg0)

Searchsploit version seems to be broken so grab it from github

![](https://lh6.googleusercontent.com/76xv0k352Ey1ysg3Xfjd-xnIQlhCBPHc8PQ_mg_U-gWAKy4fHlhj-c5I4e63tsdR8LbvEDYj1p-Ksvmtz1GFjdGjOpN7KVVhyX42D0qXRqnzRNK4TGSwOGkn6563tPSnjrcnJ4G3)

Run the script as stated

![](https://lh5.googleusercontent.com/cPPb9pn6P4p7oZZYjCmHraMtEHm1oYoNawPCK4SxVi6qeUSPJGuHT9e_Zs76JEKH9Lhb459BThOQwJHjOadYTbPksSIl4k1yt6bsFT0Wu1dhU6-5iZs_a_-Xstj_K-k7COfIk3EW)

Can login with pth-winexe although the machine keeps going down

![](https://lh5.googleusercontent.com/fBPUR4yTnz-ebh-fCvzfWgTvYx-HDWDVISLsu-IlADPQFR66fYlETvD4jk7gwGh3juEFRa4X01YL-dZJGo0RI-4vkNEZLKQ6DdJvVxtTmeDNFWXg9j9IfMv-na1lPhiTGU9okETS)

Now login with psexec and download root.txt

<div align="left"><img src="https://lh5.googleusercontent.com/UnayVEh4q28mpngBo-10DFJrsivwMOZfltnuNIj4Lq-IWXhEJ-A8vw7IpLMe2QrmIZmoWX-xK6FGd6HcdNySxY8UCSdMUNn441rp0C-id6Cs4b9EqdRr8LEaAVV4okKFakJhLM5S" alt=""></div>

Root.txt

<div align="left"><img src="https://lh4.googleusercontent.com/HpBdpFXU8LQPrvFKDbFz0883bMjXYgOSPLKCuDzNavUrBhc2DE6NiAjXAIcWjO5O0EIDmncVpX3tQh7NVaBiRN576eUpb87SkVH7wET9BtbQkpw5zGe-NeG14ijBr8Gk7TlOrBle" alt=""></div>