Netmon Writeup

Brief Description / TL;DR

Netmon was a well known HTB box almost reaching meme status due to its over simplfied user flag. In order to exploit this box we connect to the anonymous FTP server and get user.txt, we enumerate find a old password and login to the admin panel, then we use a exploit to get a admin account and run SMBMAP to find root.txt


Begining Enumeration

The begining nmap(nmap -sV -sC gives us the following

Starting Nmap 7.70 ( ) at 2019-06-30 21:32 ADT
Stats: 0:00:09 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 20.00% done; ETC: 21:33 (0:00:24 remaining)
Nmap scan report for
Host is up (0.044s latency).
Not shown: 995 closed ports
21/tcp  open  ftp          Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 02-03-19  12:18AM                 1024 .rnd
| 02-25-19  10:15PM       <DIR>          inetpub
| 07-16-16  09:18AM       <DIR>          PerfLogs
| 02-25-19  10:56PM       <DIR>          Program Files
| 02-03-19  12:28AM       <DIR>          Program Files (x86)
| 02-03-19  08:08AM       <DIR>          Users
|_06-28-19  03:02AM       <DIR>          Windows
| ftp-syst: 
|_  SYST: Windows_NT
80/tcp  open  http         Indy httpd (Paessler PRTG bandwidth monitor)
|_http-server-header: PRTG/
| http-title: Welcome | PRTG Network Monitor (NETMON)
|_Requested resource was /index.htm
|_http-trane-info: Problem with XML parsing of /evox/about
135/tcp open  msrpc        Microsoft Windows RPC
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: -11m41s, deviation: 0s, median: -11m41s
| smb-security-mode: 
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2019-06-30 21:21:18
|_  start_date: 2019-06-28 03:24:00


In which we find a FTP Server with anonymous FTP login enabled. If we navigate to C:\Users\Public we find user.txt


Getting PRTG Admin Access:

Our first task it to get Access to the PRTG Admin Panel after basic enumeration we find C:/ProgramData/Paessler/PRTG Network Monitor Folder which contains 3 files of intrest if we open PRTG Configuration.old.bak we find the username and password in clear text Username: prtgadmin Password: PrTg@dmin2018 Although the password that we found doesnt work since it was in a ‘backup’ file we try changing it to PrTg@dmin2019 and we get in

Explotation Of PRTG Access

After searching google for authenticated PRTG admin exploits we find This, When we run this script it adds a user to the administrators group with the username pentest and the password P3nT3st! now we use our credentials to run SMBMAP to enumerate the shares, and find root.txt in C:\Users\Administrator\Desktop