Bank HackTheBox Notes

Genius = https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/

IP address: 10.10.10.29

Recon

nmap -v -sU -sS -p- -A -T4 10.10.10.29

Port 80/tcp – http

Nmap -p 80 -sV 10.10.10.29

Reveals apache httpd 2.4.7 – no known critical vulnerabilities

Default Ubuntu Apache2 page

Port 53/tcp – DNS

Nmap -p 53 -sV 10.10.10.29

ISC BIND 9.9.5-3ubuntu0.14

Port 22/tcp – ssh

Nmap -p 22 -sV 10.10.10.29

OpenSSH 6.6.1p1

Continuing

I had to cheat on this one cause I don’t have the patience for this guessing crap. The accessible host on port 80 can be found at http://bank.htb

Running dirbuster we find the following

Response codes:

301 unauthorized

302 redirect

200 successful

Looking at login.php there is nothing extraordinary however, support.php and index.php both provide redirect codes. Looking at this more closely we can see the response size of both these redirects are far from equal. Using burp suite or any sort of redirect blocker we can visualize the page presented before the redirect. Support.php provides an interesting page.

Used to remove automatic redirect

Now we can look at index.php and support.php properly. The support page has an option to upload files so this is likely our way in. Looking at the source code we can see the following which states that we may use a file extension of .htb to upload php files.

I personally used the following reverse shell http://pentestmonkey.net/tools/web-shells/php-reverse-shell followed by the command nc -lvp 4444. This gives us a shell as www-data which can be used to read the user.txt file.

Using “find / -user root -perm -4000 -print 2>/dev/null” we can find potentially vulnerable commands with a SUID bit.

First one that sticks out to me is /var/htb/bin/emergency and of course executing this command gives us a root shell.