{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-linux-postman-en","result":{"data":{"markdownRemark":{"id":"2fed0608-e99d-5101-8f23-298f2a87b5e7","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I use the penetration-testing learning platform “Hack The Box” to study security.\nAt the time of writing, my rank on Hack The Box is ProHacker.

\n\"Hack\n

This time I am writing up the retired HackTheBox machine “Postman”.

\n\n

About This Article

\n

The content of this article is not intended to encourage acts that are contrary to social order.

\n

Please note that attempting attacks against environments other than those you own or are authorized to use may violate the Act on the Prohibition of Unauthorized Computer Access (the Unauthorized Access Prohibition Act).

\n

All statements here are my own and do not represent any organization I belong to.

\n\n

Table of Contents

\n\n

Enumeration

\n

As usual, I started with a port scan.

\n
sudo sed -i 's/^[0-9].*$RHOST/10.10.10.160  $RHOST/g' /etc/hosts\nnmap -sV -sC -Pn -T4 $RHOST| tee nmap1.txt\n# All ports\nnmap -p- $RHOST -Pn -sC -sV -A  | tee nmap_max.txt
\n

MiniServ 1.910 was an application I had never seen before.

\n
PORT      STATE SERVICE VERSION\n22/tcp    open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   2048 46:83:4f:f1:38:61:c0:1c:74:cb:b5:d1:4a:68:4d:77 (RSA)\n|   256 2d:8d:27:d2:df:15:1a:31:53:05:fb:ff:f0:62:26:89 (ECDSA)\n|_  256 ca:7c:82:aa:5a:d3:72:ca:8b:8a:38:3a:80:41:a0:45 (ED25519)\n80/tcp    open  http    Apache httpd 2.4.29 ((Ubuntu))\n|_http-title: The Cyber Geek's Personal Website\n|_http-server-header: Apache/2.4.29 (Ubuntu)\n10000/tcp open  http    MiniServ 1.910 (Webmin httpd)\n|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).\nService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
\n

Connecting to port 80 brought up what looked like a blog site.

\n

\n \n \n \n \n \n \n \n \n

\n

Checking the shell history showed various operations being performed under Matt’s account.

\n
redis@Postman:~$ history\n    1  exit\n    2  su Matt\n    3  pwd\n    4  nano scan.py\n    5  python scan.py\n    6  nano scan.py\n    7  clear\n    8  nano scan.py\n    9  clear\n   10  python scan.py\n   11  exit\n   12  exit\n   13  cat /etc/ssh/sshd_config \n   14  su Matt\n   15  clear\n   16  cd /var/lib/redis\n   17  su Matt\n   18  exit\n   19  cat id_rsa.bak \n   20  ls -la\n   21  exit\n   22  cat id_rsa.bak \n   23  exit\n   24  ls -la\n   25  crontab -l\n   26  systemctl enable redis-server\n   27  redis-server\n   28  ifconfig\n   29  netstat -a\n   30  netstat -a\n   31  netstat -a\n   32  netstat -a\n   33  netstat -a > txt\n   34  exit\n   35  crontab -l\n   36  cd ~/\n   37  ls\n   38  nano 6379\n   39  exit
\n

There are various things worth investigating, but first I looked at id_rsa.bak.

\n

Opening the file revealed an encrypted private key.

\n
-----BEGIN RSA PRIVATE KEY-----\nProc-Type: 4,ENCRYPTED\nDEK-Info: DES-EDE3-CBC,73E9CEFBCCF5287C\n\nJehA51I17rsCOOVqyWx+C8363IOBYXQ11Ddw/pr3L2A2NDtB7tvsXNyqKDghfQnX\ncwGJJUD9kKJniJkJzrvF1WepvMNkj9ZItXQzYN8wbjlrku1bJq5xnJX9EUb5I7k2\n7GsTwsMvKzXkkfEZQaXK/T50s3I4Cdcfbr1dXIyabXLLpZOiZEKvr4+KySjp4ou6\ncdnCWhzkA/TwJpXG1WeOmMvtCZW1HCButYsNP6BDf78bQGmmlirqRmXfLB92JhT9\n1u8JzHCJ1zZMG5vaUtvon0qgPx7xeIUO6LAFTozrN9MGWEqBEJ5zMVrrt3TGVkcv\nEyvlWwks7R/gjxHyUwT+a5LCGGSjVD85LxYutgWxOUKbtWGBbU8yi7YsXlKCwwHP\nUH7OfQz03VWy+K0aa8Qs+Eyw6X3wbWnue03ng/sLJnJ729zb3kuym8r+hU+9v6VY\nSj+QnjVTYjDfnT22jJBUHTV2yrKeAz6CXdFT+xIhxEAiv0m1ZkkyQkWpUiCzyuYK\nt+MStwWtSt0VJ4U1Na2G3xGPjmrkmjwXvudKC0YN/OBoPPOTaBVD9i6fsoZ6pwnS\n5Mi8BzrBhdO0wHaDcTYPc3B00CwqAV5MXmkAk2zKL0W2tdVYksKwxKCwGmWlpdke\nP2JGlp9LWEerMfolbjTSOU5mDePfMQ3fwCO6MPBiqzrrFcPNJr7/McQECb5sf+O6\njKE3Jfn0UVE2QVdVK3oEL6DyaBf/W2d/3T7q10Ud7K+4Kd36gxMBf33Ea6+qx3Ge\nSbJIhksw5TKhd505AiUH2Tn89qNGecVJEbjKeJ/vFZC5YIsQ+9sl89TmJHL74Y3i\nl3YXDEsQjhZHxX5X/RU02D+AF07p3BSRjhD30cjj0uuWkKowpoo0Y0eblgmd7o2X\n0VIWrskPK4I7IH5gbkrxVGb/9g/W2ua1C3Nncv3MNcf0nlI117BS/QwNtuTozG8p\nS9k3li+rYr6f3ma/ULsUnKiZls8SpU+RsaosLGKZ6p2oIe8oRSmlOCsY0ICq7eRR\nhkuzUuH9z/mBo2tQWh8qvToCSEjg8yNO9z8+LdoN1wQWMPaVwRBjIyxCPHFTJ3u+\nZxy0tIPwjCZvxUfYn/K4FVHavvA+b9lopnUCEAERpwIv8+tYofwGVpLVC0DrN58V\nXTfB2X9sL1oB3hO4mJF0Z3yJ2KZEdYwHGuqNTFagN0gBcyNI2wsxZNzIK26vPrOD\nb6Bc9UdiWCZqMKUx4aMTLhG5ROjgQGytWf/q7MGrO3cF25k1PEWNyZMqY4WYsZXi\nWhQFHkFOINwVEOtHakZ/ToYaUQNtRT6pZyHgvjT0mTo0t3jUERsppj1pwbggCGmh\nKTkmhK+MTaoy89Cg0Xw2J18Dm0o78p6UNrkSue1CsWjEfEIF3NAMEU2o+Ngq92Hm\nnpAFRetvwQ7xukk0rbb6mvF8gSqLQg7WpbZFytgS05TpPZPM0h8tRE8YRdJheWrQ\nVcNyZH8OHYqES4g2UF62KpttqSwLiiF4utHq+/h5CQwsF+JRg88bnxh2z2BD6i5W\nX+hK5HPpp6QnjZ8A5ERuUEGaZBEUvGJtPGHjZyLpkytMhTjaOrRNYw==\n-----END RSA PRIVATE KEY-----
\n

If I could recover a password from somewhere on the machine, I might be able to decrypt it.

\n

I got stuck here, so I ran linpeas — but that did not reveal anything useful either, so I decided to try brute force.

\n

I cracked the password using the following commands:

\n
# Crack the SSH key\n$ python /usr/share/john/ssh2john.py id_rsa.txt > id.hash\n$ john id.hash -wordlist=/usr/share/wordlists/rockyou.txt
\n

\n \n \n \n \n \n \n \n \n

\n

I decrypted the RSA key using the recovered passphrase, but attempting to use it for SSH still failed for some reason.

\n
$ openssl rsa -in encrypted -out decrypted
\n

In the end, I used the SSH shell I had already obtained as redis and ran su Matt with the cracked password to get the User flag.

\n

Privilege Escalation

\n

After getting Matt’s shell, checking the history showed a wide range of commands that had been executed.

\n

I started by running linpeas with Matt’s privileges, but nothing obviously useful for privilege escalation turned up.

\n

Next, on a hunch, I tried logging into WebAdmin with the username Matt and the same password — and it worked.

\n

The version was 1.910.

\n

\n \n