# Bank

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjfVe9EGDv42hHwVIt%2Fimage.png?alt=media\&token=c3275144-b71b-40d2-b369-a7d01975f31d)

## Overview

Initial Foothold : File upload on webserver and execute&#x20;

Privilege Escalation : Permissions of /etc/passwd file

## Enumeration

Starting with port scanning

```
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 08:ee:d0:30:d5:45:e4:59:db:4d:54:a8:dc:5c:ef:15 (DSA)
|   2048 b8:e0:15:48:2d:0d:f0:f1:73:33:b7:81:64:08:4a:91 (RSA)
|   256 a0:4c:94:d1:7b:6e:a8:fd:07:fe:11:eb:88:d5:16:65 (ECDSA)
|_  256 2d:79:44:30:c8:bb:5e:8f:07:cf:5b:72:ef:a1:6d:67 (ED25519)
53/tcp open  domain?
| dns-nsid: 
|_  bind.version: 9.9.5-3ubuntu0.14-Ubuntu
80/tcp open  http    Apache/2.4.7 (Ubuntu)
|_http-server-header: Apache/2.4.7 (Ubuntu)
| http-title: HTB Bank - Login
|_Requested resource was login.php

```

Lets Start with port 80

### Web Enumeration

Visit the webpage

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjlJm_WT4AmJYpEpIo%2Fimage.png?alt=media\&token=18ff128f-58d9-403a-88a5-ca1da0f92a5e)

Apache2 Default page was there&#x20;

Add bank.htb into host file to see the webcontent

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjlfJNOKe9MzR3OY0B%2Fimage.png?alt=media\&token=4fcf7c67-ceef-47a8-8077-5ad5ddc99630)

Now visit bank.htb

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjlnc3FsMRLi9naTNw%2Fimage.png?alt=media\&token=21e3a334-ad07-4cec-83e2-ac680e2b46c3)

Got Default login page

we don't have any creds so we cannot login into this

Lets enumerate directories using dirbuster

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjmEde8It7Feg_v5Os%2Fimage.png?alt=media\&token=1946d9f5-10b3-4a8a-a3aa-06651d6cbba5)

Start the scan

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjmTYbXl3foGA4xg6P%2Fimage.png?alt=media\&token=4a7dbb52-df18-4e84-918d-bff32dde45f9)

Got some result support.php looks interesting.&#x20;

Open that webpage but from the response code we can observe that it is redirecting to another webpage&#x20;

Use brupsuite to intercept the request

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjn69BeFOSh8pZRMSA%2Fimage.png?alt=media\&token=ddeac08a-8022-4593-93b8-36652036d86a)

Got the webpage but when forwarding it redirects to login page

Change the 302 Found to 200   code

and now forward the request

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjnQW_jzo6cI1rNywa%2Fimage.png?alt=media\&token=54940976-fdc5-43b9-8c32-de47a4f66187)

Got the Support.php webpage

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjnZdPRgSYFwUpDg_q%2Fimage.png?alt=media\&token=6f0fc8db-eb03-46a9-8312-07ca7e80c2b6)

Check the source code of the webpage

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjoB1S_BdB2BENJlvO%2Fimage.png?alt=media\&token=7117ed95-c3e7-4ab1-941a-600d164a048a)

There is a comment which tells us to use .htb instead of .php while uploading files

## Exploitation

Uploading file is allowed on the webserver by using .htb extension

Upload reverse php code to confirm that we can upload and execute files&#x20;

Use pentestmonkey php reverse shell payload

{% embed url="<https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php>" %}

change lhost and lport in the code and change the extension to .htb and upload the file on the webserver

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjpivOusAA2potpdmY%2Fimage.png?alt=media\&token=e8a19c3f-2e21-44a8-913d-d50d191da0f2)

Payload was successfully uploaded now access this through upload folder and the name of the payload

Setup Listener for shell

```
kali@kali:~$ sudo rlwrap nc -lvnp 80
```

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjqGPa33eH9XuO-13P%2Fimage.png?alt=media\&token=9dc097be-8d82-451a-b703-afda0f102141)

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjqLW5PJ-qUkb_qX-U%2Fimage.png?alt=media\&token=52425679-f46f-45ee-b267-1e9ae59b5aaf)

Got the shell as www-data user&#x20;

## Privilege Escalation

After some enumeration got that user has permission to write /etc/passwd file

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjqyM3ahqSE-o0HFYA%2Fimage.png?alt=media\&token=7c5ce476-75f8-49c8-ab49-421f30abdbe5)

This means if we will add our user with root permission in this file we will get root access to the machine

Copy the content of /etc/passwd to our localhost

Now create the user password hash using openssl

```
openssl passwd -1 -salt yo pass123
```

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjrZoh-dTuVBmZcnXB%2Fimage.png?alt=media\&token=9243195e-e385-492e-a2f2-ad446335df5d)

Now add this to passwd file that we copied from victim host

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjs1JzxFn9IIqDp73P%2Fimage.png?alt=media\&token=3d51c6bc-1bba-4ea4-b029-d5c67c06274d)

{% hint style="info" %}
Format should be same as specified above
{% endhint %}

Now transfer this file to victim machine and replace this with /etc/passwd file

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjsPddHDc14EQAbEGG%2Fimage.png?alt=media\&token=11dcadd9-d430-4fc1-8d60-1c3c54ae5f32)

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjsTG7tCS26R_OArmJ%2Fimage.png?alt=media\&token=a660daf4-f838-40b2-af9f-5f8fba72eb9b)

now change user to yo and enter password pass123

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjsb_0wzP7x_xfm5mI%2Fimage.png?alt=media\&token=a8e93c9a-76ae-4b3d-a799-90e592ba5111)

Got the root access&#x20;

![](https://1638266387-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAPqJ1kUtt1Nbijm5O4%2F-MAjfIzkTcuOecv3vk3e%2F-MAjssUs132hIz26f5W_%2Fimage.png?alt=media\&token=c3815da4-f1ca-4239-bbac-ef5f972961c7)

That's all for this box

Good Bye :)
