Netmon-htb ❲2027❳

You can log in via FTP using the username anonymous and no password.

To gain administrative access, you must move from FTP to the web interface: netmon-htb

Once logged in as an administrator on the PRTG dashboard, you can exploit the "Notifications" feature. By creating a new notification that executes a malicious .ps1 or .bat file, you can trigger a reverse shell or create a new admin user. Tools Used Nmap: For port scanning and service identification. FTP Client: To browse the file system anonymously. You can log in via FTP using the

Searching through the PRTG configuration files (typically in C:\ProgramData\Paessler\PRTG Network Monitor ) reveals backup configuration files. Phase 3: Privilege Escalation (PRTG Exploitation) Tools Used Nmap: For port scanning and service

A standard scan with Nmap typically reveals several open ports, including: Allows anonymous login. Port 80 (HTTP): Hosts a PRTG Network Monitor login page. Port 135/445 (RPC/SMB): Standard Windows networking ports. Phase 2: User Access (FTP & Information Disclosure)

In an old configuration backup (e.g., PRTG Configuration.old.bak ), you may find a password like PrTg@dmin2018 .

To log in once administrative credentials or a new user have been established. HackTheBox Writeup — Netmon - Faisal Husaini