what's going on everyone welcome to another hack the box walkthrough today
we're looking at postman it's a linux box it's had 11,000 system and user owns
and the first blood was around three hours so it's a fairly easy box but it
has some services that you might not work with before so it's kind of a good
one to have a look at so let's get straight into this of course I'm using
Kali and the first thing I did was did an nmap scan at the top 5,000 pores the
reason that dear 5000 ports is because if you only do like the F flag or the
top 1000 ports you're unlikely to find all of the ports that you want to be
finding for example in this scenario you wouldn't get the reduce pore for this
box doing the top a thousand ports so it's you know when you do a numeration
you kind of want to get something quickly and then you can do the bigger
scans while you have something to play with so for example I might have done
nmap top ports and then once I've got this result and something to look at I
would then do the end map scans for like the 65,000 plus ports to see if I'm
missing anything in the future so looking in the ports what we got we've
got SSH we've got HTTP readers and some random port on 10,000 so what I tend to
do is think about what my best entry point is based on past experience so SSH
never really gets you anywhere to start with HTTP is worth looking at Reedus
never work with that but maybe 10,000 so what I like to do is I like to look at
the web GUI so the first thing I did was went to port 10,000 in the web tells you
to go to HTTPS so I did you can see that I think of web min is running so we know
a service called web min is on 10,000 and it's encrypted using HTTPS so that's
plenty something to look at and on port 80 there's a development website under
construction which also could be vulnerable you know as developers make
things they're not you know as security focused as you might be in
production so there might be some issues here but what I firstly looked at was
weapon because I thought this would be probably the most problematic thing
because it's you don't just have random services on these boxes um so I wanted
to see if there's any vulnerabilities in web mint so I went and had a look on
Google and yes there are quite a few vulnerabilities ranging from like 2007
all the way to 2019 obviously I didn't know what version of weapon this was
there's no version information here nothing in the source code anything like
that so what I did next was actually looked a mess like for any quick wins
that could be around there was a few modules some from 2006 some from 2019
2012 again I didn't know the versions of white did was like Google web min 2012
to see what it looks like and very clearly that's a 2012 login box all I've
ever saw one so that looks nothing like what we've
got today so we could probably determinate bigger than 2012 probably
the 2019 web min so that rules out some that's why modules I then looked at the
2019 modules to our unauthenticated one is authenticated the two unauthenticated
ones didn't work the authenticate one obviously we don't have a user yet so
not useful now but probably useful later so just keep that in mind so this is
kind of a dead end right now so looking back at our ports let's think about
Reedus so Reedus is a database as a key pair database that might be useful this
isn't a typical port you see on hosts so it's there for a reason most likely so
what I did with this is firstly try to connect to it there's a tool called
reduce CLI that comes with the read it's library it's in the description but you
can download it from the official Reedus website you just have to compile that
with make and that comes with the reader CLI so do a dash H flag with the IP
address and that's how you log into the readest database it's a nice prize
there was no password so that's good to look at the keys in the database you
type keys and the star and there was no keys in the database so I thought you've
got a database here but there's nothing in it I was hoping for a password or
something that you know could help us out here but there was nothing so that
made me think what am I going to use this for thinking about the ports where
could this be used could this be used as a web main kind of user password
database could it be used for SSH it may be the the website the constructional
HTTP so I googled for Reedus and SS Asian Reedus and web min and basically
come to the conclusion that it's going to be an SSH exploit because I found
this reduce remote command execution and this details using reduce to write a key
a private public key to the authorized SSH key file in order to gain access
through pets @h so that's what we're going to do so to do this by the way
that bugs in description if you want to look at that to do this we first need to
create ourselves an SSH key so ssh-keygen the t flag and then RSA go
ahead and just to generate that call it what you want I'm going to call it post
see and what passphrase e1 you don't have to have any and that creates you a
key pair a public and a private key that we can use later
right now we're interested in the public key because that's what we need to put
in your authorized keys file for Reedus using the realist database so if you
follow the blog it tells you that you need to get read is to save this prior
public key to the authorized keys file and it does a bit of corruption so you
actually need to pad that key with some new line well you'll see in a minute
let's just go ahead and do that so if we go to
where are we going - it's just create a new tab go to my desktop that's where I
saved the key so we go ahead and nano into the the public key but pub that's
what it looks like so we need to add some new lines on the end and and start
this so that I'd be like this don't do it like this using nano this cost me a
lot of time for some reason it escapes the new lines when you try to add it to
the readers database so we're gonna have to do this in a bash way using this so
if you do echo e with new lines and that puts it at the start and then echoey
new lines that preserve the end and that puts the new key with these new lines
into food or text and of course you want to change this to your own private key
mine was posted up up died into that so now if we take a look at we should cat
that out take a take a look at foo we've now got our private key with no new
lines probably because obviously if you Kadett you're not going to see the new
line so that's just me being dumb anyway that's got new lines in there I'm sure
so let's go to Reedus now we want to put that key in to read it and do that you
can cat root desktop it's not in desktop is it it's in this folder just go ahead
and take that and stick that here so we're going to
pipe this into Reedus go into a key and read it
so we're piping our food or text into the reader CLI into the host and the X
is going to allow you to create a key and we're calling it role no such file
directory why are you doing this to me because it's in route desktop there we
go okay so now if you log back into Reedus if you do keys all again you'll
now see that there's a lull and you can see there's an S key is well because
someone else is doing this box with me so I hope they don't mess this up for me
if you go ahead and get along you'll see look we've now got our an SSH key here
with the new lines so this means our key is in Reedus now we need to get realists
to actually save this to the correct authorized keys location usually the SSH
directory in a user's home folder we're being like slash home slash user
obviously this is Reedus so it's a service and it's not got a slash home
like that so that's important to remember we need to configure Reedus to
save to this directory so first thing you want to do is config set dir to the
Reedus directory like so so that's setting the realest directory to save to
this directory now we need to set the file which is authorized keys and you do
that using this command this is all in the blog obviously as well and then
that's the final thing you - and you can just go ahead and save and that saves
your public key here to the authorized keys file now you should be able to SSH
in with your private key now using SSH okay cool so that's our private file
we're gonna be using the Redis user because I'll see that's where we save
the SSH key - and in the IP address okay into the
passphrase for route and we have accessed the read user lovely so at this
point the user also doing this machine hasn't killed us yet so that's good if
that happens I'll have to just carry on from where I am now anyway
carrying on so at this point I thought right lovely let's get the user on text
oh okay there's nothing in this directory okay is there another user
directory that I can get to so I just see deed out of here had a look okay
home go home as usable map okay let's see D into Mac user on text access
denied damn okay what can we do here so we obviously need to escalate ourselves
to Matt to get this user text so obviously I look to the obvious things a
look to cron jobs I look to the shadow file could I get his hash and crack that
I looked at running processes other to you know other files in the operating
system like lower level nothing really interesting there so what I did do was
look at history so this shows you the history of the reduce user and as you
can see here maxi deed so Matt's probably what allows actually probably
blew me never mind anyway scrolling up okay this is a lot of stuff from the
other person using this box let's get right to the top okay you can see Matt's
s you'd so that's interesting you can see he's cat and our ID RSA dot back so
at this point I figured okay so Matt to use the realest user and there's an ID
RSA got back probably some way in the operating system that I can get to if I
get that I could potentially SSH into the map user so let's go ahead and take
a look to see if we can find that ID'd off back file so to do that I use
the find command which is this find slash type F name ID RSA dot back so
it's looking for that file in the whole operating system essentially run that
and that was very quick permission diapering night so in somewhere in here
hopefully you will find the ID dot back file you know it's probably quite hard
to see pretty bad way to do this but you know it works as you can see here look
we've got opt Rd IDRs a dot back so if we go into the opt folder wonderful
there's an ID RSA got back in there so this just go ahead and cap that out
we've now got a private key so let's copy this what I did at this point was
copied that and tried to log in as mat using the identity file which is this
didn't work because this is password protected and thus you can't login his
map because you need password so what I did instead was cracked the password
with John so to do that you can use python ssh to john pi firstly you need
to go ahead and put that private key we just got into a file so call that map
not hash pop that into there and then go Sh to john matt not hash and that gives
you the output which is able to be used with john which is lovely now we want to
use john so let's just go ahead and create a new file in the john directory
and just call that matt dot put that Sh - john output in there save it and now
we can use that with John so you can use John with dot slash John use the
wordless rock texting cally under use a share word list and the
file is not there I've saved it in the same directory so Matt hash boom there
we go nice and quick is found the pastor straightaway which is computer 2008 so
why did at this point was trying to SSH using Matt the identity file and
computer 2008 however what I came across was he's not allowed to SSH him so the
next best thing to do in this case is go ahead go to where we go ahead to the
realest user wherever off site wherever I am and that which is here to clear
this off and su to Matt like we saw in the history file that's awfully gonna
you asked for the password case matters guys paste that password in we're now
than that user wonderful let's go back let's go to our home directory
Matt and we got the user text cat that out user wonderful we've got our first
hash of the user hash so we've escalated our privilege to Matt
user we've got the user hash absolutely fantastic now we need to get to the root
user so at this point I thought right so there's a Metasploit module left that we
can try that needed and authenticated user so let's go ahead and try that now
and we're back sorry about that Metasploit decided they wanted to
totally uninstall itself even though I had it running there as you saw but
whatever that's kind of the weirdest thing I've ever seen
so anyway where were we exploit Linux HTTP webmin package RCE is the one you
want to be using let's take a look at the options so now we've got a password
in the username let's go ahead and set that so set user
name to Maps which is the user we cracked earlier set the password to
compute 2008 because that's what we cracked it and using John what do you
else we got our host so you want to set that our host to 10-10-10 160
we want to set SSL because we know that somebody's using SSL and we want to set
the payload options as well so the L host is gonna be our port so I'll pour
our IP that we're using on hack the box so if you do an IP config or an if'
config sorry you can look on the tongue because that's the VPN connection take
that IP address and just pop that as your L host so let's just have a look at
the options one more time before you write to make sure everything's in order
our host is sorted that port is fine computer 2008 is a password got your
hosts correct port SSL yes username Matt correct so if we've run this we should
now gain a shell which we do which is lovely so we've got a shell obviously
the first thing we want to know is what user the shell is running it yeah in the
context of so you can do that with the Who am I
the shell is quite slow sometimes so just give that some time before you
think there you go so we've got the root user perfect now we need to get the
flags put that in to hack the box flags are typically under the home directory
so we could just do LS this doesn't look like the home directory this looks more
like the web min directory so to make this easy for ourselves just go ahead
and cat the root directory for root txt which is usually the text file for the
root user and there we go we have the hash for the root user that means we've
totally owned the system we will full system access wonderful see you later
postman you have been owned so that's kind of it guys thanks for watching and
have a think about how Reedus can affect an application how it can be used to
save files in different places depending on permissions so you know configure
that well think about what you're typing on the command line under your user
context four surfaces and even your own user
because if someone gets onto that they can see what you've done they can see
anything that you've done securely for the most part you know it's really
important so just have a think about these things thanks for watching guys
give us a subscribe give us a like thank you