Bank
🔗 Bank
Task 1 - Deploy the machine
🎯 Target IP: 10.10.10.29
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system, while Windows systems usually have a TTL of 128 secs.
2.1 - How many TCP ports are listening and accessible on Bank?
sudo
run as root
sC
run default scripts
sV
enumerate versions
A
aggressive mode
T4
run a bit faster
oN
output to file with nmap formatting
It looks like there are 3 open TCP ports on the machine: 22, 53, 80.
2.2 - What virtual host returns a website that isn't the default Ubuntu Apache page?
Going to http:\\bank.htb page, we see an hypotetical redirect to http:\\bank.htb/login.php:
We can check and confirm it using BurpSuite:
Now, we try to find potential hidden directory using gobuster:
and we find an interesting path: http://bank.htb/balance-transfer/
2.3 -
We can try to put a file using ftp, in this case we use nmap result file (port_scan):
2.4 -
2.5 -
We launch msfconsole:
Task 3 -
3.1 -
We've not access to babibs' directory, we can try to find "user.txt" flag using while command in C:\ root.
Starting to root folder (C:\) we can find quickly flags, using where command in recusive mode (/r):
and read user.txt flag using type command (equivalent to cat on *nix):
Task 4 - Find root flag
After that, we do the same thing for root.txt flag