Hackthebox.eu - Retired - Netmon

Hackthebox.eu - Retired - Netmon

Recon

Starting as always is a simple up/down scan on all TCP ports

# nmap -T4 -p- -oX /root/Desktop/HTB/Netmon/nmapb.xml 10.10.10.152

Convert it to HTML

# xsltproc /root/Desktop/HTB/Netmon/nmapb.xml -o /root/Desktop/HTB/Netmon/nmapb.html

That's a bunch of ports open

Let's run -A against those ports for fingering the OS/Services

# nmap -T4 -A -p21,135,139,445,5985,47001,49664,49665,49666,19667,49668,49669 -oX /root/Desktop/HTB/Netmon/nmapf.xml 10.10.10.152

Then convert it to HTML

xsltproc /root/Desktop/HTB/Netmon/nmapf.xml -o /root/Desktop/HTB/Netmon/nmapf.html

Port 21 anonymous FTP, NetBIOS and something running on the 4000 port range… not sure yet

Let's take a look at that FTP running

Oh My God… They have the entire root directory open on FTP

I think we can move to exploit from here.

Exploit

So we just browse the FTP to users

There is the user hash..

dd5******************

So here I bounced around the ftp for a while

I found this under program files

PRTG network monitor…… is that running?

PRTG Network Monitor 18.1.37.13946 © 2018 Paessler AG 

What the hell nmap… you didn't see any web services running

Let's try that again..

That's what I thought nmap. Just playing cool like you saw it the whole time

Ok now that nmap can see the web server ( I would have found this using dirbuster or something else if nmap had seen it earlier)

Lets see if there are default creds for PRTG monitor

Nope

I did find this during my google searches… it looks like if we can get in we can add some code to a builtin PS1 script to make it do anything we want :) as system

https://www.codewatch.org/blog/?p=453

I also found this about exposed passwords in config files

https://www.reddit.com/r/sysadmin/comments/835dai/prtg_exposes_domain_accounts_and_passwords_in/

It looks like this leak was patched but maybe we can find some old backups from before this was patched.

I did

So Under

C:\Programdata\Paessler\PRTG Network Monitor

We see these three config files

I downloaded them all and grep'd for a password… no dice on the first two but we the old.bak - - Bingo

cat PRTG\ Configuration.old.bak  | grep -A1 admin

  <!-- User: prtgadmin -->

              PrTg@dmin2018

Let's try to login

Nope…. 

But this password is from an old config maybe they changed to a newer more secure password…. Or maybe they just changed the year at the end

      PrTg@dmin2019

Us admins can be lazy too right?

Ok so now we got in we have the authenticated user we were looking for

Let's modify the notification to add a new user to this box that we can then use to get our flag

Under Setup-> notifications we can add a new notification. I named my EvilHackerMan

So the original PS1 called for a text.txt file so I just left that there add a semi colon and the commands I wanted to run

So here we are adding a new user to the box

net user evilhackerman 3vilH@ck3rM@n /add

Then add that user to the local administrators group

Net localgroup administrators evilhackerman /add

So in the end we ended up with this string to add

test.txt;net user evilhackerman 3vilH@ck3rM@n /add;net localgroup administrators evilhackerman /add

Then save the notification

Now we select our new "notification" and click the bell icon to run it

Now lets see if we can get in.

I'm going to use psexec.py from

https://github.com/SecureAuthCorp/impacket

python psexec.py evilhackerman:3vilH@ck3rM@n@10.10.10.152 cmd -path C:\\windows\\system32

.

Now we just need to get the flag