Postman (HackTheBox) (English)
Content
HTB Postman writeup#
‘Easy’ machine, user was a bit of a challenge, rooting was easier. The process is: Scan –> Initial foothold –> Own User –> Own Root.
Initial Scan#
Scan results
We got an OpenSSH server and two different webservers. The Apache server on port 80 does not seem to contain anything interesting.
I launched dirbuster in the background just in case while I investigated the other services.
On port 10000, we got a Webmin instance, v1.910 (from the Server header). Looking at the official website, looks like Webmin is a tool used to remotely manage UNIX machines. Moreover, Searching for “Webmin 1.910” on Google returns an interesting set of results. This should be easy, right?
Most of the exploits are written for Metasploit, so lets launch it and see what we can do.
Initial foothold?#
Lets launch Metasploit and search for the Webmin exploits.
exploit/unix/webapp/webmin_backdoor). Looking at the description, we can see that some Webmin versions served by SourceForge were backdoored, and this exploit will try to use the introduced backdoor to gain access.The exploit failed, looks like our target is not vulnerable. Looks like a dead end, and dirbuster did not find anything. What did we miss?
Initial Scan - Part 2 ¯\(ツ)/¯#
Lets launch nmap again, scanning all ports this time:
truncated output:
Initial foothold#
We can directly access the Redis server using redis-cli, without authentication. Redis is a key-value storage (you may think of it as a giant dictionary), so the first logical step seems to enumerate all the keys.
Is there anyway to turn our Redis database access to RCE? Luckily yes, and the process is well documented [1] [2]
The idea is to configure Redis to backup its data (where we will put our public ssh key) to a file named authorized_keys, whose path we will set to a .ssh folder of our convenience, so we can normally login using ssh.
We can manually exploit it, use the redis upload Metasploit module, or use an existing Python exploit. I failed to manually exploit it, there were multiple people connected to the Redis server and I was taking to long to complete the steps, so I tried the Python exploit, and after several attempts I finally got a shell.
Note: If you get asked for a password after successfully installing the certificate, you may need to reset the machine.
Looks like the flag is in /home/Matt, but we do not have read access. Time to escalate!
Escalating to user#
Using the redis account, lets enumerate the machine, using the helper script htbenum.
On the host machine:
On the remote machine:
Inside the generated report file, we get something interesting, a private (but password protected) SSH key in the /opt directory.
Let’s download it (copy pasting works fine), and try to crack it with john:
And we get the password computer2008. Using the private key or the password with SSH does not work, but su Matt from the redis user does.
Root#
Remember the login form on port 10000 for Webmin? We got a valid pair of user/password, lets try them in the login form on https://Postman:1000.
Nice, we have valid credentials for the Webmin server! That reminds me of two exploits that needed working credentials :). Lets try with one of the exploits, exploit/linux/http/webmin_packageup_rce
And we owned root.
Acknowledgments#
Thanks to @J4ri for the nudge that led to the discover of the Redis server, that went completely unnoticed at first.