Postman

Hack The Box · Easy Linux Box · Retired

Enumeration

A full-port scan exposed SSH, Apache, Redis 4.0.9 on TCP 6379, and Webmin on TCP 10000.

22/tcp open ssh
80/tcp open http
6379/tcp open redis Redis 4.0.9
10000/tcp open http MiniServ 1.910

Initial Access

Redis accepted unauthenticated commands. The walkthrough generated an SSH key pair, wrote the public key into Redis, changed the Redis working directory to the Redis user's .ssh directory, and saved it as authorized_keys. That provided SSH access as the Redis user.

Lateral Movement

Enumeration uncovered an encrypted private key associated with the user Matt. The key passphrase was cracked and used to access Matt's account.

Privilege Escalation

Matt's credentials also authenticated to Webmin. The installed Webmin version permitted authenticated command execution, which was used to obtain a root shell.