Command injection in PRTG Network Monitor (CVE-2018-9276)

PRTG Network Monitor (by Paessler) is a commercial network-monitoring suite for Windows. Versions before 18.2.39 suffer CVE-2018-9276: an authenticated command injection in the notifications system. PRTG lets you create Execute Program notifications that run a script (e.g. a demo .ps1) with some parameters, and that parameter field isn't sanitised before being concatenated into the PowerShell line the service executes. Since the PRTG service runs as NT AUTHORITY\SYSTEM, any injected command runs with maximum privileges.

The abuse requires a valid session in the panel (on Netmon it's obtained from credentials leaked in a backup of the config itself). Once in:

1. Setup → Account Settings → Notifications → Add new notification.
2. Enable Execute Program, pick a script (Demo exe notification - outfile.ps1) and in Parameter put the payload, using ; to chain commands after a legitimate value:

test.txt;net user jaime j4ime! /add;net localgroup administrators jaime /add

1. Save and trigger the notification (bell button / Send test notification).

The result is a new local administrator (or any command as SYSTEM). Validate with crackmapexec smb <ip> -u jaime -p 'j4ime!' (should show Pwn3d!) and log in over WinRM with Evil-WinRM.

How to detect it. The most reliable signature is process lineage on the host: the PRTG service (PRTG Server.exe, running as SYSTEM) spawning powershell.exe/cmd.exe/net.exe as a child (Event ID 4688 / Sysmon 1), something a legitimate notification does not do with net user. The creation of a new local administrator (4720 + 4732 to the Administrators group) right after triggering a notification is the direct signal. In the application, editing an Execute Program notification whose Parameter field contains ;/&/| is recorded in PRTG's configuration log.

Defence. Update PRTG to 18.2.39 or later; don't expose the panel to untrusted networks; and rotate any credentials that may remain in accessible configuration backups.