Exploiting Linux Machine having unauthenticated Redis server.
Intro
Recon
NMAP scan:
Found port 80, save for later
Play around for default port, found default Redis port in 6379:
Redis Exploit
From this article, it is known that we can smuggle our SSH public key to an unprotected Redis server, with steps:
-
Generate RSA key pair
-
Craft a payload
-
Smuggle it in
-
From the redis side, open the redis-cli (remember we have an unprotected redis server)
-
SSH time!
Recon as Redis
Now we have access to the server as redis user, start another recon session, and enumerate all files and directories, found this in /opt/id_rsa.bak
Escalate to Matt’s User
Having Matt’s id_rsa, we can start the John The Ripper to bruteforce the password
Password: computer2008
Try to switch to user Matt having the password above:
Voila! Matt’s access gained and we have our User Flag
FLAG user : 517ad0ec2458ca97af8d93aac08a2f3c
Recon as Matt
Circle back to discovered port from nmap above, we have port 10000, that if we opened it, a webmin with login-password page. Log with Matt’s user password (Matt:computer2008) and we have
Knowing the version is 1.910, we’ll use a combo of searchsploit and msfconsole to find the exploit of this exact version of webmin
Exploit
Use msf5 to exploit
Root access gained :), read the flag and we’re done!
FLAG ROOT : a257741c5bed8be7778c6ed95686ddce