Hack The Box · Linux Machine
Bank
| Name | Bank |
|---|---|
| Release date | 16 Jun 2017 |
| Retire date | 10 Oct 2017 |
| OS | Linux |
| Difficulty | Easy - Retired [0] |
| Rated difficulty |  |
| Radar graph |  |
| Creator | makelarisjr |
| CherryTree file | Download and remove the .txt extension |
Virtual host and exposed records
Nmap found SSH, DNS, and Apache. The default page became useful after adding bank.htb to /etc/hosts. Directory discovery exposed /balance_transfer/, where one unusually small .acc file contained credentials.
10.10.10.29 bank.htb
Email: [email protected]
Password: !##HTBB4nkP4ssw0rd!##
Upload bypass and shell
The authenticated support portal accepted a PHP reverse shell when it used the .htb extension. Opening the uploaded file returned a shell as www-data.
SUID privilege escalation
LinEnum identified the SUID binary /var/htb/bin/emergency. Running it produced a privileged shell capable of reading both flags.
file /var/htb/bin/emergency
/var/htb/bin/emergency
