PRTG Network Monitor is a widely used Windows-based monitoring platform with a web interface (on 80/443, and 8080/8443 for the core). It is attacked primarily through its web authentication and its notification feature. The default administrator is prtgadmin/prtgadmin, frequently unchanged. Once authenticated as an administrator, PRTG's notifications, which can run an external program or script when an alert fires, are abusable: a crafted command parameter in a notification executes on the server, and because the PRTG core service runs as Local System, that execution is as SYSTEM. So a web login (default or weak credentials) chains directly to SYSTEM-level remote code execution on the monitoring server, which also holds the credentials PRTG uses to monitor the estate.
curl -sk https://<target>/index.htm | grep -i prtg # fingerprint
curl -sk https://<target>:8080/public/checklogin.htm --data 'loginurl=&username=prtgadmin&password=prtgadmin'
Subtopics#
- Enumeration: product and version fingerprinting.
- Authentication: the default prtgadmin and weak credentials.
- Notification command abuse: SYSTEM RCE via notifications.
- Known exploits: the known PRTG vulnerabilities.