HTB Netmon Walkthrough

In this article, we’re going to explore the retired easy box of Netmon, following the guided mode.

Task 1: What is the name of the application running on port 80? Given the three words in the logo.

As usual, we start with an nmap scan:

sudo nmap -sSCV 10.10.10.152 -p- --min-rate=1000 -oA netmon-nmap

And we get the results:

From here, we can see our answer in the port 80 section.

Answer: PRTG Network Monitor

Task 2: What service is running on TCP port 21?

We can get our answer from the nmap results in Task 1.

Answer: FTP

Task 3: Submit the flag located on the Public user’s desktop.

We can anonymously connect to the FTP share, so let’s go ahead and do that:

ftp 10.10.10.152

We enter the user anonymous, and leave the password field blank.

We navigate to C:\Users\Public\Desktop and get the user.txt flag there.

*Answer: 3659*****9089*

Task 4: What is the full path of the folder where PRTG Network Monitor saves its configuration files by default?

Let’s search for “prtg network monitor configuration location”.

We see this:

Answer: C:\ProgramData\Paessler\PRTG Network Monitor

Task 5: What is the name of the backup config file?

In the FTP share, let’s navigate to the location in Task 4. In this directory, we see this:

We know backup files generally have a .bak extension, and there’s only one file with that.

Answer: PRTG Configuration.old.bak

Task 6: What was the prtgadmin user’s password according to that file?

We can download the backup file onto our host machine:

get PRTG\ Configuration.old.bak

Now on our host, let’s open the file and search for prtgadmin:

mousepad PRTG\ Configuration.old.bak

Answer: PrTg@dmin2018

Task 7: What is the prtgadmin user’s password on the website now?

We know that passwords have to be changed regularly, and the box was released in 2019. So we can venture a guess that the password would have been updated.

Answer: PrTg@dmin2019

Task 8: What version of PRTG is installed?

We can find the answer to this in the config file in Task 6:

Answer: 18.1.37.13946

Task 9: Which user is this software running as by default? Don’t include anything before a \.

Lets run msfconsole, and search for prtg and see what we find:

As previously mentioned, we know the box was released in 2019, so let’s look at “exploit/windows/http/prtg_authenticated_rce”

set ADMIN_PASSWORD PrTg@dmin2019
set RHOSTS 10.10.10.152

And we run the exploit!

Answer: system

Task 10: Submit the flag located on the administrator’s desktop.

The flag is located at C:\Users\Administrator\Desktop\root.txt.

*Answer: df0b****86dc*

Hope this helped you solve the box!