module

PRTG Network Monitor Authenticated RCE

Try Surface Command
Back to search
Disclosed
Jun 25, 2018
Created
Jan 28, 2021

Description

Notifications can be created by an authenticated user and can execute scripts when triggered.
Due to a poorly validated input on the script name, it is possible to chain it with a user-supplied command allowing command execution under the context of privileged user.
The module uses provided credentials to log in to the web interface, then creates and triggers a malicious notification to perform RCE using a Powershell payload.
It may require a few tries to get a shell because notifications are queued up on the server.
This vulnerability affects versions prior to 18.2.39. See references for more details about the vulnerability allowing RCE.

Authors

Josh Berry [email protected]
Julien Bedel [email protected]

Platform

Windows

Architectures

x86, x64

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/windows/http/prtg_authenticated_rce
    msf exploit(prtg_authenticated_rce) > show targets
        ...targets...
    msf exploit(prtg_authenticated_rce) > set TARGET < target-id >
    msf exploit(prtg_authenticated_rce) > show options
        ...show and set options...
    msf exploit(prtg_authenticated_rce) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report