HackTheBox - Postman 📮✉️

HackTheBox-Postman

Quick Summary

→ This easy machine is ideal for beginners to learn the basics of Penetration Testing. It has a vulnerable software – Redis.
Redis is unprotected without a password set up, and so forth. The simplest thing you can do in such a case is to write random files like SSH keys, which I’ll use to gain access to the machine. After getting the shell, there’s an SSH key for user Matt. Once you have the credentials, it’s straightforward to escalate privileges using another vulnerability – CVE Webmin 1.910.

Penetration Testing Methodologies

Network Scanning
- Nmap scan to discover open ports and running services.
Enumeration
- Browse HTTP service on different ports.
- Brute-force web page directories.
- Check software vulnerabilities.
Post-Exploitation
- Determine if we can inject files into Redis.
- Transfer SSH keys.
- Gain access to the Redis shell.
Exploitation
- Use LinEnum.sh to find exploitable items.
- Retrieve a backup SSH key for a user.
- Use credentials for CVE Webmin 1.910.
- Obtain root shell.

Network Scanning

Network scanning is a crucial step in identifying active hosts and open ports on a network. It helps security professionals gather information about potential targets for further testing or analysis. Common tools like Nmap are used to perform these scans efficiently. By using different scan types, such as SYN stealth scans or UDP scans, testers can adapt their approach based on the environment and requirements.

Identifying services running on open ports is also important. This allows for a deeper understanding of the network’s architecture and potential vulnerabilities. For example, if an outdated version of Apache HTTP Server is discovered, it could indicate a risk that needs to be addressed promptly.

In summary, network scanning provides valuable insights into network topology and security posture, enabling more informed decision-making in penetration testing and vulnerability assessments.

Walkthrough

First, I run Nmap to scan the target and gather information about the services running on it. I use:

-sV ⇒ Probe open ports to determine service/version info
-sC ⇒ Equivalent to --script=default
-T 0-5 ⇒ Set timing template - higher is faster (less accurate)
-p- ⇒ Scan all 65,535 ports
-oN ⇒ Save scan results to a text file

1 2	`# bash nmap -sV -sC -T4 -p- 10.10.10.154 -oN nmap-postman`

Nmap Results

Here are the open ports:

22: OpenSSH 7.6p1
80: Apache/2.24.49
6379: Redis key-value version 4.0.9
10000: MiniServ 1.910 (Webmin httpd)

HackTheBox-Postman/nmap-postman.png

Enumeration

I visited the web page on port 80, and there’s nothing interesting here except for the Postman@htb. I added it to my /etc/hosts/.

# bash

10.10.10.160	postman.htb

HackTheBox-Postman/postman-webpage.gif

Scan the Web Directories

Since I don’t have any clue what’s on the web page, I use dirsearch Web path scanner to find some stuff with the following command.

# bash

root in htb/boxes/postman 
❯ python3 /opt/dirsearch/dirsearch.py -u "http://10.10.10.160" -e asd -x 403,404 --simple-report=postman-directories

HackTheBox-Postman/postman-dirsearch.png

I found these directories, which are all normal web directories except for the /upload/ directory, which caught my attention.

# bash

[07:32:03] 301 -  310B  - /css  ->  http://10.10.10.160/css/                                                      
[07:32:18] 301 -  312B  - /fonts  ->  http://10.10.10.160/fonts/                                      
[07:32:24] 301 -  313B  - /images  ->  http://10.10.10.160/images/     
[07:32:26] 200 -    4KB - /index.html                                                                          
[07:32:29] 301 -  309B  - /js  ->  http://10.10.10.160/js/                                              
[07:33:26] 301 -  313B  - /upload  ->  http://10.10.10.160/upload/

[07:33:26] 200 -    8KB - /upload/

Going to the /upload/ directory reveals a lot of images. I tried looking for interesting ones but realized it was a rabbit hole and moved on to the next phase.