루트 액세스를 위한 은행 서버 취약점 익스플로잇

### 은행 해킹 루트 액세스를 위한 취약점 익스플로잇
* 💻 이 동영상에서는 크리스 알루풀루이가 해킹 더 박스 챌린지의 일환으로 **은행 웹 애플리케이션의 취약점**을 살펴보며 이 연습의 교육적 목적을 강조합니다.
* 🔍 이 프로세스는 은행의 IP 주소를 `/etc/hosts` 파일에 추가하여 쉽게 액세스할 수 있도록 한 다음, **포괄적인 nmap 스캔**을 통해 열린 포트를 식별하여 **SSH 및 HTTP 서비스**를 표시하는 것으로 시작됩니다.
* 🔑 Chris는 OpenSSL을 사용하여 비밀번호 파일을 수정하여 권한 상승을 시도하는 **"neospring"의 비밀번호 해시**를 생성하여 상승된 권한을 가진 새 사용자를 추가하는 방법을 시연합니다.
* 📂 리버스 셸을 설정한 후 명령을 성공적으로 실행하여 서버에 액세스하고, 여기서 **사용자 플래그를 찾아 루트 액세스로 에스컬레이션할 준비**를 합니다.
* 🛠 비밀번호 파일에 대한 읽기 및 쓰기 기능을 통해 Chris는 **새 사용자를 추가**하고 루트 액세스 권한을 검색하여 궁극적으로 **제출할 루트 플래그**를 찾습니다.
* 📡 이 동영상에서는 파일 권한과 서버 구성, 특히 **/etc/passwd 및 /etc/shadow 파일에 대한 이해의 중요성**을 강조합니다.
* 📈 데모 내내 Chris는 스캔 및 퍼징을 위해 **Burp Suite 및 ffuf**와 같은 도구를 활용하여 웹 애플리케이션의 취약점을 발견하는 기술을 선보입니다.
* 🔒 이 세션은 해킹의 윤리적 함의를 상기시키며 **통제된 환경 내에서 교육 목적으로 실시하는 훈련**임을 강조하며 마무리됩니다.

Chris는 은행 서버의 취약점을 악용하여 루트 액세스 권한을 얻는 데 성공했습니다.

In this video, V asked me to take a look at his Banks web app, which he works at for any type of vulnerabilities. Now, this of course is a machine from the hack the box, and it is intended for educational purposes only. Welcome to my channel, I'm Chris Alupului. I'm a cyber Enthusiast diving deep into pen testing, CTF challenges, and all things hacking, so without further ado, let's get right into it. Now that we got the IP address from V, let's go ahead and take that and throw it into our /etc/host file so we don't have to remember the IP address going forward. So we'll do pseudo nano /etc/host, and we go down here, we'll just copy it and give it a name, in this case, bank.htb. Then go ahead and save that and exit, and then clear. After that, what I like doing is just a simple end map scan for all ports with a -p- flag on

the bank. HTB and typically I'll do a min rate of 10,000 because we don't have to worry about being noisy for hack the box machine, so I'm going to hit that and let that run and that's going to scan all 65,000 or so ports and it looks like it finished and it's giving us back three ports 22 TCP open SSH that's interesting 53 TCP domain which that's typically a DNS server so we'll probably run a dig on that and see if we can get any information 80 TCP for an HTTP and that's probably the online server so with that information let's go ahead and clear it and then do another end map scan instead of doing all ports this time let's just be specific for the three ports that are open and in this case we'll also run these scripts and save it into the nmap-tcp file so that we can reference that in the future if we need to,

So I'll let that run. That typically will run a lot longer than the first one, so I'll show you on the screen what those flags indicate so you have more information going forward on that. Now that finished, so we did get a lot more information on it. Let's see, so it is run on Linux, and the domain server, the DNS, is there. Okay, and here's an interesting thing. The HTTP title is hack the box bank with a login, and another piece of interesting information is the fact that it's built with PHP. So that's really cool. Now we know it's on Apache as well. So with that information, let's go ahead and clear it. And then now that we know that there is a domain and a DNS Port open, let's do a dig. And in this case, we'll do a dig axfr on the bank at the IP address specific for the bank.htb. And again, I'll show you the reason why we're using axfr on the screen and what goes into it.

Now that we got some information from our dig, let's go ahead and throw all these subdomains into our /etc/host so that we don't have to keep track of them going forward. So, we'll clear out of this and then go pseudo nano /etc/host, put in our super-secret password again, scroll down, and then we'll go here and add chris.bank.htb. And I think the other one was ns.bank.htb, and then I saw a www, and then save and exit and clear. From there, let's go ahead and check out the website. So, before we actually start up Firefox, let's start up Burp Suite, and we'll get that going. And since that's running, okay, that's running. Now we can go to Firefox and start that up. And here, we'll just do HTTP, and it looked like that redirected us pretty quickly. It redirected us to the login page. Um, not seeing anything else aside from just logging in, and since we're

Here, we might as well try just some simple default login credentials, and it looks like it's asking us for the email address. So, we could do admin at the bank and do maybe admin and then admin again. Whoops, here we go, admin. Uh, password, and let's see, um, one last time, admin maybe bank. And it looks like that's not working. Now remember, we did a dig previously. We got some information about Chris being a subdomain for the bank. So, let's go ahead and try that. We do Chris at the bank at hack the box, and maybe we'll try admin. Maybe password will work. Now, it looks like none of these credentials are really working for us. So, let's go back into our terminal and run a ffuf scan and start fuzzing for some directories and see if we can get more information to go forward with. Here's the ffuf scan that I like using, and we'll use the W flag to use the word list.

directory list 2.3 medium in this case and the U flag is for the bank.htb, and here in capital F U Z Z fuzz is where where where ffuf places the contents of the directory list and what it does is it's just going to continue down the list and insert it in there and start fuzzing it. So that's how fuff works, so we're going to go ahead and let that run, and it looks like it's already coming up with a few things uploads. We're getting some 301s as sets Inc 301's being that it's being redirected. So let's go ahead and take a look into the uploads assets and Inc. So we'll go back to the website and go up here and go into assets, and it looks like assets just has a bunch of different assets CSS CSS, so a lot of different styling sheets. Let's go into the theme. Okay, fonts, images, okay, JavaScript theme. So we can pretty much rabbit hole pretty deeply here, just go through

all the contents of all the assets, but I don't want to rabbit hole. So, and it looks like we're getting forbidden on that. Let's check our scan uploads, and then let's check Inc is the other one. Okay, let's take a look at the page Source. Interesting, getting some errors. All right, not seeing anything useful really. Again, we can rabbit hole and look through all these contents and see what's going on. Let's see what else comes up. The other thing that shows up that I'm noticing is the index page, which is the one that we're being redirected from to the login page. This page right here. What's unusual is the fact that it's showing the size being 7,322 with a great deal of words and lines. So, I'm curious about that. Um, let's see what else did fuff scan show us. Server status of 403, so that's a forbidden. And the other thing that's showing up is a balance transfer, so that's

very interesting. Let's take a look at that SS out, so we'll go back here and we'll throw that in, and let's see what's going on. Okay, so it looks like it's showing us a bunch of hashed looks like .ACC, so maybe that's account files showing us a great deal of account files. Um, so let's download the first one and take a look at it and see what's going on. So I'll zoom in for everybody to see. Here we go. All right, so we're getting some type of hashed full name. It looks like it's all encrypted, the full name, the email, the password is being encrypted, and you can see here at the top, encrypted success. So let's look and see if there's anything unusual that we're missing, something that stands out. Looks like nothing in the name. Let's check last modified. No, looks like it's all being modified at the same time. Nothing really stands out. Let's go size. Okay, I'm noticing one being a different

size so let's download that and see why that's different size from everything else. All right, so that finished. Here we go, let's zoom in. So it looks like this file particularly has an error encrypted failed in it, and it's giving us back some information that's not salted, that's not encrypted, uh, in this case the name, the email, okay, we're seeing the Chris from the Dig, remember, and in this case we did get his password. So I'm going to copy that, save that to my notes. That's super important. It's a password that we most likely would not be able to crack very easily, so that's awesome that we were able to get that. So with that, let's go back to the main page and uh, let's try to log in with these credentials. I'm just going to copy that, and we're in. We got access to Chris's bank information. So looks like his balance is pretty leet. That's awesome. Uh, this goes

back for a while. I'm trying to see if there's any other information that we can check out. It looks like the only thing here is in the menu bar for support, and in support, the only thing I'm seeing is the potential to send a ticket. It looks like that's the thing. Please select a file. Okay, so we're going to have to figure out how to create a reverse shell by submitting a malicious file into the ticket system. So let's go back into the terminal and start working on that. From here, let's go ahead and CD into our hackthebox/bank files so we can keep track of everything that way. And then we'll do a nano cmd.php, 'cause remember from our scan that the whole site is built on PHP. And here we can just start crafting our reverse shell. Let's see, think, all right, and um, after that, so PHP system just read it to see if I got everything and then go ahead.

and save that. From there, let's clear it and go to Burp Suite. Go in the top left to Proxy, and we'll start intercepting these requests. Now, going forward, so we can take a look at how this works on the back end. From here, we'll go ahead and select our file and go here into the Hack the Box, the bank, and here's the CMD.PHP file. I'm going to open that, and it was uploaded, so let's try it and submit and see what happens. Now, remember in the top left, it's going to stall because Burp Suite is intercepting it, so we'll go to Burp Suite, and here we go. So, we did intercept. Let's send that to Repeater so we can play around with that going forward. And you can see here, here's the code that's in the CMD.PHP file. So, let's forward that and see what's going on. It looks like we're getting an oops, you can't upload this file. You can only upload images. So, we

need to figure out how we can bypass this filter for only images. Go ahead and click okay and go back into burp suite and go into repeater. And then from here, let's go ahead and just send it again, see what it does. And it looks like it's giving us the same error. Let's scroll down and see, take a look at the code. And okay, here's the script. We're getting an error script since we're getting an error on the PHP. Let's see if we can try just changing this to PNG and send that and see what that does. So we're getting back at 200 okay. Let's scroll down and it looks like we did get a successful ticket. So let's render it, see what's it showing. It is a success. Okay, we can go back into our browser and reload this. And then from here, let's go ahead and click the attachment and see what's going on. If we're getting an error, go ahead and refresh it. And it looks like it says

here cannot be displayed because it contains error. So I'm wondering if we could do a question mark CMD ID, and we're doing that just to see if it will output any ID information. In this case, cannot be displayed because it contains errors. So looks like the back end PNG is not letting us work. So what's the alternative we can do? Maybe let's take a look at the file name, and instead of PNG, let's do something different. Let's do um .neo instead. Let's see if that works. Maybe it's going to be thinking that it's some type of file or something of that nature. So let's run that, see what happens. Looks like you can't upload this file. It can only upload images. Okay, it looks like we're missing something. So let's go back to the website and maybe look into the page source and see if there's any clues in there. Let's see here, maybe I can zoom in. All right, here's something. There's a comment that says debug. I added a follow

extension .htb to execute his PHP for debugging purposes only, so it looks like there's a .htb for debugging so let's go back and try that. .htb let's see what happens if we did that okay it looks like that worked and let's go back and check our browser we go back and let's see we got a few different tests we're running here um looks like PNG PNG here's the htb you can see in the bottom left corner when I hover it let's go ahead and click that and it does direct us to the CMD.htb and then from here let's do CMD=ID just to see if it works and it does work it outputs us some ID information. Now that we know that we can get a reverse Shell by writing in different commands maybe instead of ID we could do LS we can go ahead and as you can see it's showing us that it is being executed,

we can go ahead and place our reverse shell command here instead of the LS. We'll do reverse shells, so let's go ahead and open up a new tab and then go here to reverseshells.com. And we can see our VPN IP address is here in the top right, so we'll change that, and we'll change our Port 1234. After that, let's go here into the search, and I'll typically do just an NC for netcat. And here's a netcat command, and I'm just going to copy that, go back, and before I paste that, let me go back into the terminal, okay? And then I'll do a netcat -lnvp 1234, so that we're listening, so we could set up the reverse shell, and then go back into the browser. And instead of LS here, we'll paste this in and see what happens. Let's see if that connected. Now, we did get something back, but it didn't completely work out, so let's go ahead and

change this around do an E bin bash uh and instead of the es let's try that and we forgot to do the neck hat listener let's send that and it looks like it is stalling so that's awesome and here we go so we did set up our neck hat who am I? I'm www-data so that's awesome ID we're getting ID so that is great we got access to the bank server so from here before we start running any other commands what I like doing is I'll go ahead and create another pane and then do my breakout and from here we're pretty much just upgrading our reverse shell by just copying and pasting this and going back and there we go we've upgraded it and then here we can copy and paste this throw that in there and then we do want some color we love some color awesome and we'll skip the alias and then we will also do this so ctrl+Z paste it enter in a few times and now we can clear we can LS we can

whoami and so forth and so on, and we can control C without worrying about closing our reverse shell. So after that, let's clear it, and then let's go LS. Let's take a look. It looks like this is just where we uploaded our shell. Um, let's go into CD. There is no home. There is a home. CD Chris. Okay. And here is the user flag. So if you're following along, you want to submit the user flag for Chris. There it is. So that's the user flag. Just copy and paste that and throw that in. All right, from here, let's take a look at the two most important files on a Linux system, and that's the password file and the shadow file. So we will ls -l /etc/passwd and /etc/shadow and see what file permissions are. And in this case, I'll show you on the screen why these are important to understand because this is what allows you to know if you have permissions for the particular file in a Linux system in

this case what's showing up for the password file is that we actually have a writability in the password files. So that's very interesting and that could be a very big problem. So let's cat the /etc/passwd and we'll go up here and looking at root here. The important thing to understand is that in the past the password used to contain the hashes in the password file. Now in this case if we see an X in place of where the password needs to be it's most likely in the shadow file. So that's just a little tip to know that no longer does the password file contain passwords, it just an indicator that the password is in the shadow file. So let's clear that. So now that we know that we can't access the shadow files with all the hashes and passwords for root but we do know that we have the read and write access to the password file and we also know that the password

file used to store the password hashes in it in the past before it got switched to the shadow file. Let's take advantage of the fact that we can read and write to it and try creating a new user and throwing in a hash password in the password file so that way we can try to priv escalate our user into root. So to do that we'll do open SSL password and then we'll use the -1 flag for md5 and in this case I'm going to Hash the password neospring. So the password is going to be neospring and it's going to do that and I'm going to copy this and we're going to now Echo it into the password file. So I'll do echo in quotes here and then I'll do neospring will be the user that will create and in this case I'll paste in and then we'll go and put 0 0 pwned and then we'll do a

root bin bash then we'll end the quotes so that we can have root access and then from here we'll pipe it into the /etc/passwd file and when we send that we'll get that thrown into to the password so let's do that and then we will cat the /etc/passwd and see if that shows up in this case I've added two of them so as you can see here Neospring is showing up being added into the password file and then from here let's uh su - neospring and then we'll enter in our super secret password neospring and there we go we have root access to the bank so from here we can go into CD into root and get the root flag so there is the root flag and let's cat that and if we're following Along on hack the box there you go we can right click copy that and submit that for our root flag and that's it for getting root on this machine I'm sure V would be pretty happy that I got access to

his bank server. If you guys enjoyed this video, give me a thumbs up. Subscribe. If you have any questions, throw them in the comment section below, and I'll see you guys in the next video.

Hacking Bank from Hackthebox |  HTB Bank Walkthrough | Ethical Hacking

Chris Alupului

검사 결과 3개의 열린 포트가 발견되었습니다: 22 TCP(SSH), 53 TCP(DNS), 80 TCP(HTTP)입니다.

Chris의 사용자 플래그는 홈 디렉토리에서 가져왔습니다.

비밀번호와 섀도 파일에 권한이 있는지 확인했고, HTTP 서버는 PHP 백엔드가 있는 Apache에서 실행 중인 것으로 확인되었습니다.

은행 서버에 대한 루트 액세스 권한 얻기

쉽게 액세스할 수 있도록 /etc/hosts 파일에 하위 도메인을 추가했습니다.

웹사이트를 확인하기 위해 Firefox를 실행하기 전에 Burp Suite를 시작하면 로그인 페이지로 빠르게 리디렉션되었습니다.

넷캣을 사용하여 리버스 셸을 설정하여 www-data로 성공적으로 액세스한 다음 루트 액세스 권한을 얻고 루트 플래그를 검색할 수 있도록 업그레이드했습니다.

디렉토리 목록 퍼징 및 취약점 익스플로잇

ffuf를 사용한 퍼징은 디렉토리 콘텐츠를 검색하는 데 사용되며, 현재 bank.

htb에서 실행 중이며 약 301개의 리디렉션을 생성하고 있습니다.

자산 디렉토리에는 다양한 스타일링 시트와 JavaScript 파일이 포함되어 있어 추가 탐색이 가능합니다.

페이지 소스의 주석은 비밀번호 파일의 쓰기 가능성을 나타내며 보안 취약점이 있을 수 있음을 나타냅니다.

비밀번호 파일의 X는 실제 비밀번호가 섀도 파일에 저장되어 있음을 나타냅니다.

리버스 셸을 위한 티켓 시스템 악용하기

사용 가능한 유일한 지원 옵션은 티켓을 보내는 것뿐이며, 이는 악성 파일을 제출하는 계획으로 이어집니다.

이 사이트는 PHP를 기반으로 구축되었으며, PHP 파일을 사용하여 리버스 셸이 만들어집니다.

이 과정에서 비밀번호를 포함한 민감한 정보가 노출되며, 이 정보는 사용자의 은행 정보 및 계정 파일에 액세스하는 데 사용됩니다.

이 튜토리얼에서는 은행 웹 앱의 취약점을 테스트하는 동안 Burp Suite를 사용하여 요청을 가로채는 방법을 설명합니다.

PHP 파일 업로드를 시도하지만 처음에는 파일 형식 제한으로 인해 실패합니다.

그런 다음 발표자는 보안 조치를 우회하고 액세스 권한을 얻기 위해 파일 확장자를 변경하고 기본 로그인 자격 증명을 사용하는 등 다양한 방법을 살펴봅니다.

비밀번호 해싱을 통한 권한 에스컬레이션

이 동영상에서는 은행 서버의 비밀번호 파일을 악용하여 권한 상승을 위해 해시된 비밀번호를 가진 새 사용자를 만드는 방법에 대해 설명합니다.

발표자는 OpenSSL을 사용하여 비밀번호 "neospring"을 해시하고 이를 비밀번호 파일에 쓰려고 시도합니다.

몇 가지 액세스 문제에 직면한 후 명령을 실행할 수 있는 디버깅 PHP 파일을 발견하여 결국 리버스 셸을 얻게 됩니다.