search

Postman HTB

IP

10.10.10.160

initial nmap scan

sudo nmap -p- --min-rate 10000 10.10.10.160 | cut -d"/" -f1 | tr '\n' ','

we have the following ports open on the target machine

22,80,6379,10000

Lets run a more in-depth scan of these ports

sudo nmap -sCV -p22,80,6379,10000 -oA port_scan 10.10.10.160

results

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 46:83:4f:f1:38:61:c0:1c:74:cb:b5:d1:4a:68:4d:77 (RSA)
|   256 2d:8d:27:d2:df:15:1a:31:53:05:fb:ff:f0:62:26:89 (ECDSA)
|_  256 ca:7c:82:aa:5a:d3:72:ca:8b:8a:38:3a:80:41:a0:45 (ED25519)
80/tcp    open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: The Cyber Geek's Personal Website
6379/tcp  open  redis   Redis key-value store 4.0.9
10000/tcp open  http    MiniServ 1.910 (Webmin httpd)
|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 36.78 seconds

we can see

  • Port 80 http server Apache version 2.4.29

  • Port 6379 Redis: is an in-memory, key/value store, works much like a dictionary with a number of keys and corresponding values that can both be set and retrieved, essentially servers as a data structure server

    • Possibly vulnerable to RCE

  • Port 10000 MiniServ 1.910: web-based server management control panel for unix like systems

    • Possible vulnerable to RCE

Let's check out the HTTP server

let's run nikto and feroxbuster in the background and continue enumerating

ferox results (most interesting)

feroxbuster -u http://10.10.10.160 -w /usr/share/seclists/SecLists-master/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -o dirs.txt

nikto result

nikto --host http://10.10.10.160 > nikto_scan

Not a whole lot here

REDIS

We can check if we can connect to the reddis server by using the following tools

we are given anonymous authentication (no authentication is in place)

we try and kind any keys on the server

  • returns nothing

Maybe we can write a ssh key to the

Lets check the current directory for redis

We can make a educated guess and say this is most likely the redis home directory, we can confirm this by changing the current directory to ./.ssh

Now that we can see our commands do prove the exsistence of the .ssh dirtectory, making this the redis home directory, Next we can create a ssh key and place this in the redis .ssh directory

here is a great blog that explains the steps https://medium.com/@Victor.Z.Zhu/redis-unauthorized-access-vulnerability-simulation-victor-zhu-ac7a71b2e419)arrow-up-right

  1. Lets generate our key pairs

  1. Next we want to place our public key into temp.txt , we also want to add 2 blank line both before and after our text

  1. Now we need to place our public key to the redis server, for this we will use the tool redis-cli

  1. Now we should give the appropriate permissions to our private key and now be able to authenticate via SSH with our private key as Redis

Now we have a SSH session as the user redis

hashtag
Priv esc via redis

we do find a ssh private key within the /opt directory

we can copy this over to our local machine and possibly crack the password

  1. first lets generate a crackable hash using ssh2john

  1. we can crack the hash

we get the password

  1. We coulnt ssh in, but in our already establsihed shell as redis we can just change over to the user Matt by

we now have a session as Matt

miniserv

When we navigate to https://10.10.10.160:10000 we can see the following

we can try Matts credentials

we have access to the dashboard

Looking around we can use the following script

LogoGitHub - roughiz/Webmin-1.910-Exploit-Script: Webmin 1.910 - Remote Code Execution Using Python ScriptGitHubchevron-right

  1. Lets start a listner

  1. lets run the exploit script

  1. We should see within our listner we have a shell as root

PreviousHaircut HTBNextFriendzoned HTB

Last updated