Postman

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.2.1   
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-02 02:05 EDT
Nmap scan report for 10.129.2.1
Host is up (0.0065s latency).
Not shown: 65531 closed tcp ports (conn-refused)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
6379/tcp  open  redis
10000/tcp open  snet-sensor-mgmt

Redis is open interestingly. So we can try to check for vulnerabilities there first.

SSH Key Write

We can connect to Redis using redis-cli.

$ redis-cli -h 10.129.2.1
10.129.2.1:6379> info
# Server
redis_version:4.0.9

The Redis version is really outdated, so we can try to find some exploits regarding it. Hacktricks has some methods of exploiting this by writing SSH keys.

Logo6379 - Pentesting Redis - HackTricksbook.hacktricks.xyz

Just follow these commands:

This would generate a pair of keys, and afterwards write it into the machine as the keys for redis. Then we can directly SSH in.

Privilege Escalation

User SSH Key

Within the /home directory, we find the user is called Matt

Within the /opt directory, there's a password encrypted id_rsa file.

We can download this back to our machine and use ssh2john and john to crack it.

Great! We now have a password for the user. We can use su to change from redis to Matt.

We can then grab the user flag.

Webmin

In the earlier nmap scan, we found that there were some HTTP ports that I didn't touch till now. Port 10000 has a Webmin instance running, and we can login using the credentials we just found.

This was running Webmin 1.910, which is vulnerable to RCE through Package Updates. There are tons of PoCs online.

LogoWebmin-1.910-Package-Updates-RCE/exploit_poc.py at master · NaveenNguyen/Webmin-1.910-Package-Updates-RCEGitHub

This would give us an easy root shell.

PreviousPhotobombNextPrecious