Postman
Initial Enumeration: Footprinting and Scanning
First of, we need to identify how to reach the system. In other words, we need to identify what are the services available from this machine.
Let's start by adding this machine's IP address to the hosts file and create an alias:
My go-to tools in this phase, which are typically used by many to start enumerating, are:
masscan: very nice port scanning tool that allows finding open ports quickly. To me this is a tool to narrow down the scope of the enumeration so we can focus on open ports only when using nmap.
Here, I am designating the interface to use when communicating to the HTB machine (-e) which will be the HTB VPN interface, along with -p to designate the port range to target but I will target ALL TCP and UDP Ports, and the transmission rate of packets per second (--rate). Similar to this, you could also run something like this:
nmap: I think most people in the information technology and security space know what nmap does. It is a very versatile Port scanning tool which also allows you to use scripts to further target the services found. Just like anything, it can be a useful tool while it can also be damaging if the user is not careful.
What I typically start with when using nmap is:
MASSCAN/NMAP
Through nmap we found 4 services available; TCP22 (SSH), TCP80 (HTTP running on an Apache Webserver), TCP6379 (Redis Server), and TCP10000 (Webmin Server).
A couple of take-offs from this finding is:
Attacking SSH directly as a first step will be a waste of time and hard to get anywhere.
We can attempt to start with HTTP and see what is there as apparently there is a site using the http-title "The Cyber Geek's Personal Website".
Redis Server is available (TCP6379) which is a key-value in-memory data structure/database server. Just like anything in this field, if it's not properly setup, it could allow an attacker get access to the system or information hosted. An important aspect of this service is that it seems to be running on version 4.0.9.
Webmin available on its default port TCP10000. This web application allows easy linux system management through a web interface. Just like applications handling sensitive information or handling system resources, it prompts for authentication through an encrypted HTTP service so you can access the appliction. The version currently used here is 1.910.
We can use the information from these two services (Redis and Webmin) to find if there are exploits available or simply documented flaws.
Below, we used dirb on the HTTP service simply to find if there is any web page or directory available on HTTP.
DIRB
As we only found index.html and not much is there we can move to another service.
Another one to point out is and as mentioned earlier, you need credentials to access Webmin and it seems to be vulnerable to an unauthenticated RCE (CVE-2019-15107) reintroduced on releases 1.900 through 1.920 through the password_change.cgi page but it seems to be restricted as it can be locked down.
Also, it seems to be vulnerable to another RCE through the Package Updates functionality (CVE-2019-12840) which allows any authorized user to the 'Package Updates' module to execute commands with root privileges, which means it will let us escalate privileges. This last one is also restricted as you would have to be authenticated, and we found that this exploit has a Metasploit module that we can use.
Exploitation and Gaining Access
Exploiting an unauthenticated RCE vulnerability in Redis:
As explained on Victor Zhu's post in Medium we can attempt to exploit a vulnerability in Redis were you can push a SSH Public Key (authorized_key) as the Redis configuration. In some instances, Redis could be running as the root user, but in others, just like some services (Apache for example), it could be running with its own service account, typically redis would be the username.
If I remember correctly, this flaw is something that could be configured to prevent it from happening, and along with this, you always have to make sure any service you configure does NOT allow anonymous authentication like FTP allows if not configured properly.
To interact with Redis, we need to install or have available redis-cli. Let's first create a SSH public/private key pairs for the redis user under postman.htb host.
Now that we had created the SSH key pair and saved the Public Key to temp.txt, let's try to interact with Redis and upload temp.txt as a configuration file of Redis. Something to mention is that at this point we already attempted to access Redis anonymously and complete successful.
As we were successful at uploading temp.txt, let's try to authenticate through SSH using the private key we created.
AND we have access to the system as the redis user (shown above). After doing some further enumeration, we found there is another user account in this system, Matt, and also a "backup" SSH private key which probably belongs to this user as there is no other account that can run a shell or is allowed to login. Let's take a look at this private key and copy it to our system.
As we copied the private to our system we can try to use it.
OOPS! Basically, not only we missed to set the proper permissions on the private key from the user found (Matt), but also this private key has a passphrase we need to crack, in this case using John the Ripper with rockyou.txt wordlist. Let do this!
Before running the private key through JtR, we need to convert it from SSH to JtR format. Then we can run it against JtR.
JTR
The passphrase has been cracked (computer2008), let's proceed with SSH.
**AND BOOM!! Not only we were successful at accessing the system as Matt, but we also found the user flag (obviously masked)!
Privilege Escalation
Something to mention here before we start is that before moving forward we attempted to use the private key passphrase as Matt's password in Webmin successfully, which means the passphrase is also Matt's password on the system (something is commonly done and technically defeats the purpose of using private keys to authenticate through SSH.
This same password will be used when exploiting the 'Package Updates RCE' vulnerability (CVE-2019-12840) through the Metasploit module.
METASPLOIT
I am breaking the output here simply to explain that we are basically setting up the options that will be used by the exploit we will be using after calling it (in simpler terms).
Now, let's show the options setup and try to run it (we need to catch a mistake done on purpose).
One mistake was caught, we forgot to setup the SSL option; remember we mentioned Webmin uses HTTPS.
Another error here: Webmin does NOT run on TCP80 and its default port is TCP10000. We need to keep this in mind.
And we now have a Shell Session created on postman.htb. Let's interact with it and see where are located, the user this shell is running as (should be root per the vulnerability) and let's try and get that Root Flag.
Root Shell:
AND we Rooted Postman and got the Root Flag!!
PS: This whole write-up looks straight forward but something to keep in mind is we are not perfect AND along the way while learning, we can make mistakes or end up going down rabbitholes. Be patient and try not to get frustrated and if you do, step out for a little bit. Go to the forum, go to Discord, contact other members that had rooted or completed the boxes. There is a lot of people wiliing to help.
Also, on the final phase, we used Metasploit, but keep in mind you cannot always rely on Metasploit. Force yourself in using other tools.
If you enjoyed my Walkthrough, thought it was useful AND you are a member of Hack The Box, feel free throw a 'Respect'. Thanks!
Last updated
Was this helpful?