PRTG Network Monitor

Default Credentia:s prtgadmin:Password123.

#Obtain the PRTG Version from curl
Intrusionz3r0@htb[/htb]$ curl -s http://10.129.201.50:8080/index.htm -A "Mozilla/5.0 (compatible;  MSIE 7.01; Windows NT 5.0)" | grep version

To exploit

Go to Setup in the top right, then navigate to the Account Settings menu, and click on Notifications. Next, click on Add new notification. Set a Name and tick the box next to EXECUTE PROGRAM. Under Program File, select Demo exe notification - outfile.ps1 from the drop-down. Finally, in the parameter field, enter a command. For this example, we'll add a new local admin user by entering test.txt;net user prtgadm1 Pwn3d_by_PRTG! /add;net localgroup administrators prtgadm1 /add.