> For the complete documentation index, see [llms.txt](https://eslam3kl.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eslam3kl.gitbook.io/blog/hack-the-box-machines/bank-walkthrough.md). # Bank Walkthrough Hey folks, we are back again with one of **HackTheBox** retired machines “Bank”, before we talk about it let’s take a look at its info

Let’s get started… ## **Nmap Scan** We usually start our scan with `nmap` scan to discover all open ports, service running, OS detection, etc `nmap -A -T4 -oG bank.gnmap 10.10.10.29`

We have 3 open ports `ssh/dns/http` I’ve tried to brute-force `ssh` credentials and search for `vhosts` or `zone transfer` but it fails so let’s go to the next step, nothing important here ## **Web Enumeration** If you try to open `10.10.10.29:80` you will get the default page of the server

But if you try `echo "10.10.10.29 bank.htb" > /etc/hosts` and search for [`http://bank.htb`](http://bank.htb/) you will get a different page **‘Login portal’** and by using this [**plugin**](https://addons.mozilla.org/ar/firefox/addon/link-redirect-trace-addon/?utm_source=addons.mozilla.org\&utm_medium=referral\&utm_content=search) I know that it redirects me to an unknown page before getting the login portal. Let’s start to discover the hidden directories by using `dirbuster/gobuster/ffuf/dirsearch`

You will get more of a bunch of directories which is open and available. After discovering them, I’ve big data in the last one `/balance_transfer`

Note that all these files have the same size, but there’s one has a different size, so we will open it first

Good, we found credentials, let’s use them to login to the login portal

Here we go! Nice design :) ## **User Flag** After discovering the whole account, I found an upload function on `bank.htb/support` and then we grabbed a reverse shell from [**here**](https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php) and then uploaded it

The next step is to open `nc` as a listener on the port which I insert to the shell code `nc -lvp ` and then access the shell form the website

Nice, we’re in the server now but unfortunately in the user priv not root so let’s grab the `user.txt` first and then try to be root

## **Root Flag** It’s time now to grab the `root.txt`. I’ve used [**Linux-Exploit-Suggester**](https://github.com/jondonas/linux-exploit-suggester-2) to know which vulnerabilities the machine is affected by downloading it on the attack machine and then transferring it to the vulnerable machine I’ve used `python -m SimpleHTTPServer 80` to make the attacker machine act as a server, and then go to `/tmp` the directory in the vulnerable machine to have permission to write there and then downloaded `wget http:///` and it was downloaded. Let’s execute it

We have 4 vulnerabilities that works on this machine but unfortunately, there’s no one of them works with me, so I’ll try to discover all directories to find any juicy file which gave me a root access After minutes, I found this directory `/var/htb`

And have this executable file

As you can see I’ve tried to execute it, but it’s failed so I execute it from the `bin` directory, and it’s worked as you can see ❤