Exploiting Bank Server Vulnerabilities for Root Access

Chris successfully exploited vulnerabilities in the bank server to gain root access.

### Hacking the Bank: Exploiting Vulnerabilities for Root Access
* 💻 In this video, Chris Alupului explores vulnerabilities in a bank's web application as part of a Hack the Box challenge, emphasizing the **educational purpose of the exercise**.
* 🔍 The process begins with adding the bank's IP address to the `/etc/hosts` file for easier access, followed by a comprehensive nmap scan to identify open ports, revealing **SSH and HTTP services**.
* 🔑 Using OpenSSL, Chris creates a password hash for "neospring" to attempt privilege escalation by modifying the password file, demonstrating how to **add a new user with elevated privileges**.
* 📂 After setting up a reverse shell, he successfully executes commands to gain access to the server, where he finds the **user flag** and prepares to **escalate to root access**.
* 🛠 With the ability to read and write to the password file, Chris adds the new user and retrieves **root access**, ultimately locating the **root flag for submission**.
* 📡 The video highlights the importance of **understanding file permissions and server configurations**, particularly regarding the **/etc/passwd** and **/etc/shadow** files.
* 📈 Throughout the demonstration, Chris utilizes tools like **Burp Suite** and **ffuf** for scanning and fuzzing, showcasing techniques for **discovering vulnerabilities in web applications**.
* 🔒 The session concludes with a reminder of the **ethical implications of hacking**, reinforcing that the exercise is intended for **educational purposes within a controlled environment**.

In this video, V asked me to take a look at his Banks web app, which he works at for any type of vulnerabilities. Now, this of course is a machine from the hack the box, and it is intended for educational purposes only. Welcome to my channel, I'm Chris Alupului. I'm a cyber Enthusiast diving deep into pen testing, CTF challenges, and all things hacking, so without further ado, let's get right into it. Now that we got the IP address from V, let's go ahead and take that and throw it into our /etc/host file so we don't have to remember the IP address going forward. So we'll do pseudo nano /etc/host, and we go down here, we'll just copy it and give it a name, in this case, bank.htb. Then go ahead and save that and exit, and then clear. After that, what I like doing is just a simple end map scan for all ports with a -p- flag on

the bank. HTB and typically I'll do a min rate of 10,000 because we don't have to worry about being noisy for hack the box machine, so I'm going to hit that and let that run and that's going to scan all 65,000 or so ports and it looks like it finished and it's giving us back three ports 22 TCP open SSH that's interesting 53 TCP domain which that's typically a DNS server so we'll probably run a dig on that and see if we can get any information 80 TCP for an HTTP and that's probably the online server so with that information let's go ahead and clear it and then do another end map scan instead of doing all ports this time let's just be specific for the three ports that are open and in this case we'll also run these scripts and save it into the nmap-tcp file so that we can reference that in the future if we need to,

So I'll let that run. That typically will run a lot longer than the first one, so I'll show you on the screen what those flags indicate so you have more information going forward on that. Now that finished, so we did get a lot more information on it. Let's see, so it is run on Linux, and the domain server, the DNS, is there. Okay, and here's an interesting thing. The HTTP title is hack the box bank with a login, and another piece of interesting information is the fact that it's built with PHP. So that's really cool. Now we know it's on Apache as well. So with that information, let's go ahead and clear it. And then now that we know that there is a domain and a DNS Port open, let's do a dig. And in this case, we'll do a dig axfr on the bank at the IP address specific for the bank.htb. And again, I'll show you the reason why we're using axfr on the screen and what goes into it.

Now that we got some information from our dig, let's go ahead and throw all these subdomains into our /etc/host so that we don't have to keep track of them going forward. So, we'll clear out of this and then go pseudo nano /etc/host, put in our super-secret password again, scroll down, and then we'll go here and add chris.bank.htb. And I think the other one was ns.bank.htb, and then I saw a www, and then save and exit and clear. From there, let's go ahead and check out the website. So, before we actually start up Firefox, let's start up Burp Suite, and we'll get that going. And since that's running, okay, that's running. Now we can go to Firefox and start that up. And here, we'll just do HTTP, and it looked like that redirected us pretty quickly. It redirected us to the login page. Um, not seeing anything else aside from just logging in, and since we're

Here, we might as well try just some simple default login credentials, and it looks like it's asking us for the email address. So, we could do admin at the bank and do maybe admin and then admin again. Whoops, here we go, admin. Uh, password, and let's see, um, one last time, admin maybe bank. And it looks like that's not working. Now remember, we did a dig previously. We got some information about Chris being a subdomain for the bank. So, let's go ahead and try that. We do Chris at the bank at hack the box, and maybe we'll try admin. Maybe password will work. Now, it looks like none of these credentials are really working for us. So, let's go back into our terminal and run a ffuf scan and start fuzzing for some directories and see if we can get more information to go forward with. Here's the ffuf scan that I like using, and we'll use the W flag to use the word list.

directory list 2.3 medium in this case and the U flag is for the bank.htb, and here in capital F U Z Z fuzz is where where where ffuf places the contents of the directory list and what it does is it's just going to continue down the list and insert it in there and start fuzzing it. So that's how fuff works, so we're going to go ahead and let that run, and it looks like it's already coming up with a few things uploads. We're getting some 301s as sets Inc 301's being that it's being redirected. So let's go ahead and take a look into the uploads assets and Inc. So we'll go back to the website and go up here and go into assets, and it looks like assets just has a bunch of different assets CSS CSS, so a lot of different styling sheets. Let's go into the theme. Okay, fonts, images, okay, JavaScript theme. So we can pretty much rabbit hole pretty deeply here, just go through

all the contents of all the assets, but I don't want to rabbit hole. So, and it looks like we're getting forbidden on that. Let's check our scan uploads, and then let's check Inc is the other one. Okay, let's take a look at the page Source. Interesting, getting some errors. All right, not seeing anything useful really. Again, we can rabbit hole and look through all these contents and see what's going on. Let's see what else comes up. The other thing that shows up that I'm noticing is the index page, which is the one that we're being redirected from to the login page. This page right here. What's unusual is the fact that it's showing the size being 7,322 with a great deal of words and lines. So, I'm curious about that. Um, let's see what else did fuff scan show us. Server status of 403, so that's a forbidden. And the other thing that's showing up is a balance transfer, so that's

very interesting. Let's take a look at that SS out, so we'll go back here and we'll throw that in, and let's see what's going on. Okay, so it looks like it's showing us a bunch of hashed looks like .ACC, so maybe that's account files showing us a great deal of account files. Um, so let's download the first one and take a look at it and see what's going on. So I'll zoom in for everybody to see. Here we go. All right, so we're getting some type of hashed full name. It looks like it's all encrypted, the full name, the email, the password is being encrypted, and you can see here at the top, encrypted success. So let's look and see if there's anything unusual that we're missing, something that stands out. Looks like nothing in the name. Let's check last modified. No, looks like it's all being modified at the same time. Nothing really stands out. Let's go size. Okay, I'm noticing one being a different

size so let's download that and see why that's different size from everything else. All right, so that finished. Here we go, let's zoom in. So it looks like this file particularly has an error encrypted failed in it, and it's giving us back some information that's not salted, that's not encrypted, uh, in this case the name, the email, okay, we're seeing the Chris from the Dig, remember, and in this case we did get his password. So I'm going to copy that, save that to my notes. That's super important. It's a password that we most likely would not be able to crack very easily, so that's awesome that we were able to get that. So with that, let's go back to the main page and uh, let's try to log in with these credentials. I'm just going to copy that, and we're in. We got access to Chris's bank information. So looks like his balance is pretty leet. That's awesome. Uh, this goes

back for a while. I'm trying to see if there's any other information that we can check out. It looks like the only thing here is in the menu bar for support, and in support, the only thing I'm seeing is the potential to send a ticket. It looks like that's the thing. Please select a file. Okay, so we're going to have to figure out how to create a reverse shell by submitting a malicious file into the ticket system. So let's go back into the terminal and start working on that. From here, let's go ahead and CD into our hackthebox/bank files so we can keep track of everything that way. And then we'll do a nano cmd.php, 'cause remember from our scan that the whole site is built on PHP. And here we can just start crafting our reverse shell. Let's see, think, all right, and um, after that, so PHP system just read it to see if I got everything and then go ahead.

and save that. From there, let's clear it and go to Burp Suite. Go in the top left to Proxy, and we'll start intercepting these requests. Now, going forward, so we can take a look at how this works on the back end. From here, we'll go ahead and select our file and go here into the Hack the Box, the bank, and here's the CMD.PHP file. I'm going to open that, and it was uploaded, so let's try it and submit and see what happens. Now, remember in the top left, it's going to stall because Burp Suite is intercepting it, so we'll go to Burp Suite, and here we go. So, we did intercept. Let's send that to Repeater so we can play around with that going forward. And you can see here, here's the code that's in the CMD.PHP file. So, let's forward that and see what's going on. It looks like we're getting an oops, you can't upload this file. You can only upload images. So, we

need to figure out how we can bypass this filter for only images. Go ahead and click okay and go back into burp suite and go into repeater. And then from here, let's go ahead and just send it again, see what it does. And it looks like it's giving us the same error. Let's scroll down and see, take a look at the code. And okay, here's the script. We're getting an error script since we're getting an error on the PHP. Let's see if we can try just changing this to PNG and send that and see what that does. So we're getting back at 200 okay. Let's scroll down and it looks like we did get a successful ticket. So let's render it, see what's it showing. It is a success. Okay, we can go back into our browser and reload this. And then from here, let's go ahead and click the attachment and see what's going on. If we're getting an error, go ahead and refresh it. And it looks like it says

here cannot be displayed because it contains error. So I'm wondering if we could do a question mark CMD ID, and we're doing that just to see if it will output any ID information. In this case, cannot be displayed because it contains errors. So looks like the back end PNG is not letting us work. So what's the alternative we can do? Maybe let's take a look at the file name, and instead of PNG, let's do something different. Let's do um .neo instead. Let's see if that works. Maybe it's going to be thinking that it's some type of file or something of that nature. So let's run that, see what happens. Looks like you can't upload this file. It can only upload images. Okay, it looks like we're missing something. So let's go back to the website and maybe look into the page source and see if there's any clues in there. Let's see here, maybe I can zoom in. All right, here's something. There's a comment that says debug. I added a follow

extension .htb to execute his PHP for debugging purposes only, so it looks like there's a .htb for debugging so let's go back and try that. .htb let's see what happens if we did that okay it looks like that worked and let's go back and check our browser we go back and let's see we got a few different tests we're running here um looks like PNG PNG here's the htb you can see in the bottom left corner when I hover it let's go ahead and click that and it does direct us to the CMD.htb and then from here let's do CMD=ID just to see if it works and it does work it outputs us some ID information. Now that we know that we can get a reverse Shell by writing in different commands maybe instead of ID we could do LS we can go ahead and as you can see it's showing us that it is being executed,

we can go ahead and place our reverse shell command here instead of the LS. We'll do reverse shells, so let's go ahead and open up a new tab and then go here to reverseshells.com. And we can see our VPN IP address is here in the top right, so we'll change that, and we'll change our Port 1234. After that, let's go here into the search, and I'll typically do just an NC for netcat. And here's a netcat command, and I'm just going to copy that, go back, and before I paste that, let me go back into the terminal, okay? And then I'll do a netcat -lnvp 1234, so that we're listening, so we could set up the reverse shell, and then go back into the browser. And instead of LS here, we'll paste this in and see what happens. Let's see if that connected. Now, we did get something back, but it didn't completely work out, so let's go ahead and

change this around do an E bin bash uh and instead of the es let's try that and we forgot to do the neck hat listener let's send that and it looks like it is stalling so that's awesome and here we go so we did set up our neck hat who am I? I'm www-data so that's awesome ID we're getting ID so that is great we got access to the bank server so from here before we start running any other commands what I like doing is I'll go ahead and create another pane and then do my breakout and from here we're pretty much just upgrading our reverse shell by just copying and pasting this and going back and there we go we've upgraded it and then here we can copy and paste this throw that in there and then we do want some color we love some color awesome and we'll skip the alias and then we will also do this so ctrl+Z paste it enter in a few times and now we can clear we can LS we can

whoami and so forth and so on, and we can control C without worrying about closing our reverse shell. So after that, let's clear it, and then let's go LS. Let's take a look. It looks like this is just where we uploaded our shell. Um, let's go into CD. There is no home. There is a home. CD Chris. Okay. And here is the user flag. So if you're following along, you want to submit the user flag for Chris. There it is. So that's the user flag. Just copy and paste that and throw that in. All right, from here, let's take a look at the two most important files on a Linux system, and that's the password file and the shadow file. So we will ls -l /etc/passwd and /etc/shadow and see what file permissions are. And in this case, I'll show you on the screen why these are important to understand because this is what allows you to know if you have permissions for the particular file in a Linux system in

this case what's showing up for the password file is that we actually have a writability in the password files. So that's very interesting and that could be a very big problem. So let's cat the /etc/passwd and we'll go up here and looking at root here. The important thing to understand is that in the past the password used to contain the hashes in the password file. Now in this case if we see an X in place of where the password needs to be it's most likely in the shadow file. So that's just a little tip to know that no longer does the password file contain passwords, it just an indicator that the password is in the shadow file. So let's clear that. So now that we know that we can't access the shadow files with all the hashes and passwords for root but we do know that we have the read and write access to the password file and we also know that the password

file used to store the password hashes in it in the past before it got switched to the shadow file. Let's take advantage of the fact that we can read and write to it and try creating a new user and throwing in a hash password in the password file so that way we can try to priv escalate our user into root. So to do that we'll do open SSL password and then we'll use the -1 flag for md5 and in this case I'm going to Hash the password neospring. So the password is going to be neospring and it's going to do that and I'm going to copy this and we're going to now Echo it into the password file. So I'll do echo in quotes here and then I'll do neospring will be the user that will create and in this case I'll paste in and then we'll go and put 0 0 pwned and then we'll do a

root bin bash then we'll end the quotes so that we can have root access and then from here we'll pipe it into the /etc/passwd file and when we send that we'll get that thrown into to the password so let's do that and then we will cat the /etc/passwd and see if that shows up in this case I've added two of them so as you can see here Neospring is showing up being added into the password file and then from here let's uh su - neospring and then we'll enter in our super secret password neospring and there we go we have root access to the bank so from here we can go into CD into root and get the root flag so there is the root flag and let's cat that and if we're following Along on hack the box there you go we can right click copy that and submit that for our root flag and that's it for getting root on this machine I'm sure V would be pretty happy that I got access to

his bank server. If you guys enjoyed this video, give me a thumbs up. Subscribe. If you have any questions, throw them in the comment section below, and I'll see you guys in the next video.

Hacking Bank from Hackthebox |  HTB Bank Walkthrough | Ethical Hacking

Chris Alupului

The scan revealed three open ports: 22 TCP (SSH), 53 TCP (DNS), and 80 TCP (HTTP).

The user flag for Chris was obtained from the home directory.

The password and shadow files were checked for permissions, and the HTTP server was identified as running on Apache with a PHP backend.

Subdomains were added to the /etc/hosts file for easy access.

Burp Suite was started before launching Firefox to check the website, which quickly redirected to the login page.

A reverse shell was set up using netcat, leading to successful access as www-data, and then upgraded to gain root access and retrieve the root flag.

Fuzzing for Directory Listings and Exploiting Vulnerabilities

Fuzzing with ffuf is used to discover directory contents, and it's currently running on bank.

The assets directory contains various styling sheets and JavaScript files, providing potential for further exploration.

A comment in the page source reveals writability in the password files, indicating a possible security vulnerability, while the password file's X indicates that the actual passwords are stored in the shadow file.

Exploiting a Ticket System for a Reverse Shell

The only support option available is to send a ticket, which leads to the plan of submitting a malicious file.

The site is built on PHP, and a reverse shell is crafted using a PHP file.

The process reveals sensitive information, including a password, which is then used to gain access to the user's bank information and account files.

Exploring Vulnerabilities in a Bank Web App

The tutorial involves using Burp Suite to intercept requests while testing a bank web app for vulnerabilities.

PHP file upload is attempted, but it initially fails due to a file type restriction.

The presenter then explores different methods, including changing the file extension and using default login credentials, to bypass security measures and gain access.

Privilege Escalation through Password Hashing

The video discusses exploiting a bank server's password file to create a new user with a hashed password for privilege escalation.

The presenter uses OpenSSL to hash the password "neospring" and attempts to write it into the password file.

After facing some access issues, they discover a debugging PHP file that allows them to execute commands, ultimately gaining a reverse shell.