---
description: https://tryhackme.com/jr/bankctf
---

# Official Bank CTF Walkthrough

## <img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FDKiwDocnVbiB6og46691%2Fimage.png?alt=media&#x26;token=72ddfe74-746f-48bc-b718-9869f442c4ed" alt="" data-size="line">BANK\_CTF WRITEUP

_By Jacvbtaylor_

```
       Created by @jacvbtaylor / @jacvb 
                 https://tryhackme.com/jr/bankctf
         completed Oct 7, 2022
```

{% embed url="https://youtu.be/lR7gNc4wr1g" %}

### INTRO

Roger at work mentioned a new bank opening up in one of the small towns in your area. He said someone had reached out to him about designing their website but he declined because the pay was going to be too little and said whoever ends up building the site probably won’t know what they are doing.

You decide you want to check out the site and look for some vulnerabilities...

### OBJECTIVE

Capture all 6 flags by taking over the bank's server.

### STEP 1: Recon

Using my [NMAP ](https://github.com/jacvbtaylor/nmapscript)script, I was able to locate 2 open ports for the target machine, port 22 and 80. This means the bank's server is hosting a website and has remote access via SSH.  You can run a simple nmap scan using `nmap -sN <ip>`

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FzRmROgF8vDTpLJ4vdsFv%2Fimage.png?alt=media&#x26;token=67252700-725b-404d-a66b-616dc6d89874" alt=""><figcaption></figcaption></figure>

Next, I want to check out their website by visiting the IP address in my browser. The first thing I notice is a construction page with a broken button:

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FRtYrvZbxRkU9wk0MFf4w%2Fimage.png?alt=media&#x26;token=5a178033-b521-4bc3-b523-7b01fdc64408" alt=""><figcaption></figcaption></figure>

Since there isn't anything else to go off of, I'll check the source code of this page and see what the button is for:&#x20;

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2F3IiroosKAITktsdYFcrZ%2Fimage.png?alt=media&#x26;token=bb44e347-bf20-46fd-8bef-d660b0a0c7f7" alt=""><figcaption></figcaption></figure>

I can see it is referencing a robots.txt file. I'll use wget to try and take that file and then see what is inside:

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FiZz4d43BRqfRiZ1PVexB%2Fimage.png?alt=media&#x26;token=16f51e2a-c21f-4e67-9346-df0c0f42afce" alt=""><figcaption></figcaption></figure>

Looks like a wordlist! I'll save that for later and start enumerating the website URL for any hidden directories and files. You can use dirb or gobuster for this:

`dirb http://<ip>`

`gobuster dir -u http://<ip> -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -t 50`

I was able to locate a WordPress directory from my enumeration, I'll check that out next:

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FARIUuGYIEvy8QPRsUIHt%2Fimage.png?alt=media&#x26;token=c7301a84-1e50-44c5-8c52-4bb48f84cebf" alt=""><figcaption><p>/wordpress</p></figcaption></figure>

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FL1paYzjtILvXBR8yVUSu%2Fimage.png?alt=media&#x26;token=719835a6-ca10-4b3e-9dc7-1bf70f08cc75" alt=""><figcaption><p>city bank</p></figcaption></figure>

Navigating the site to the Banking page, I see flag 1 along with a possible username, Patrick. It is common to use public websites to gather information of a company, such as harvesting emails for future attacks. Since this website is not suppose to be public yet, there aren't any emails here but a note like this is even better.&#x20;

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FA2ugyF7OVKkcmbdvloTq%2Fimage.png?alt=media&#x26;token=261ffd9c-9484-4480-aac5-0343e897eea1" alt=""><figcaption><p>flag 1</p></figcaption></figure>

Once my directory enumeration scan completed, I saw `/wp-login.php`&#x20;

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FZmkE1mDVdORTu31Ntr2Y%2Fimage.png?alt=media&#x26;token=9c54a7f3-9f57-415b-9811-28111527d26d" alt=""><figcaption><p>wp-login</p></figcaption></figure>

Using the possible username from earlier, Patrick, I am going to attempt to log in with a test password. All I am looking for currently is if Patrick is a valid username, and it is:

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FZVlfXVTu3CDXklxUCJp2%2Fimage.png?alt=media&#x26;token=1a5e8093-f75c-4792-b118-8f4740dac321" alt=""><figcaption><p>username</p></figcaption></figure>

### STEP 2:  Attack

Using the wordlist I found in the robots.txt file and this username, I set up an attack with hydra:

`hydra -l patrick -P robots.txt <ip> http-post-form '/wordpress/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:ERROR' -vV -t 30`

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2Fr2ipRC4Naa1DXvAgo1Sc%2Fimage.png?alt=media&#x26;token=9d006ab3-4daf-4af1-ad3e-998d02f9a72b" alt=""><figcaption><p>Hydra1</p></figcaption></figure>

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FrcAKQ7Z6U8Gsw4H3suxC%2Fimage.png?alt=media&#x26;token=1da7c36c-6873-46cb-8437-dcdb3d736bbd" alt=""><figcaption><p>Hydra2</p></figcaption></figure>

I got a valid password! After logging in, I realize this user doesn't have many abilities, so I need to find a better user.. Why not try the addresser of the note to Patrick?

First, I want to grab flag 2 in Patrick's bio. It isn't formatted like the other, so I'll have to edit it to match, easy.

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2F7ZFUn50CiqBL6YvevB4w%2Fimage.png?alt=media&#x26;token=5028f7b0-aa19-4b48-9284-5005cea5994e" alt=""><figcaption><p>flag2</p></figcaption></figure>

Using hydra again, I ran my attack one more time, just changing the username to manager.&#x20;

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2F3qWKNDbVA34r8UFaDFuI%2Fimage.png?alt=media&#x26;token=a0432cf9-ea44-4786-a32e-f58307f95845" alt=""><figcaption><p>manager</p></figcaption></figure>

Hydra wasn't getting any valid passwords, so I changed `ERROR` to `incorrect` and it got a valid password!

`hydra -l manager -P robots.txt <ip> http-post-form '/wordpress/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:incorrect' -vV -t 30`

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2F05M7UCoE6u1tGGzcvblA%2Fimage.png?alt=media&#x26;token=c45b21de-b179-4e1f-b411-579abf15acc9" alt=""><figcaption><p>manager2</p></figcaption></figure>

Now that I have administrative access, there are a couple things I could do.&#x20;

1. Add a PHP reverse shell using Appearance > Theme Editor
2. Keep snooping for valuable information

I decided to keep looking around first. Sometimes the simple option really pays off. Here's flag 3 along with a note:

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FfC3prdEEkfKKl1JYT7VX%2Fimage.png?alt=media&#x26;token=c211292c-c154-42a3-ac9d-5cf797c60489" alt=""><figcaption><p>ascii/flag 3</p></figcaption></figure>

I don't read ASCII, but I know a few websites that do, I'll decrypt it:

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FlszJgJjPHM21hIFtHsfY%2Fimage.png?alt=media&#x26;token=9c715f4f-0891-445f-9299-a8828f850aae" alt=""><figcaption><p>wordlist2</p></figcaption></figure>

Another wordlist. The manager says he left a port open. I haven't touched port 22 from the nmap scan yet. I'll save this into a text file and see if I can use this list to get in using hydra again:

`hydra -L word.list -P word.list 10.10.75.42 ssh -t 4`

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FaOY61thwp3Ps36mvi2fW%2Fimage.png?alt=media&#x26;token=5a30b6cf-01f9-47c2-9838-e1874b9497a0" alt=""><figcaption><p>cat</p></figcaption></figure>

I got a username and password! Time to log in `ssh cat@10.10.75.42 -p 22`

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FpCToYyu7MwrnU0tCELn8%2Fimage.png?alt=media&#x26;token=fced7937-85d0-42ec-b629-b2532a45b719" alt=""><figcaption><p>flag4</p></figcaption></figure>

using the `ls` command I found a lot of files and directories inside of Cat's home folder, one being flag 4

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FIruwHft60uuxDDtHbKwE%2Fimage.png?alt=media&#x26;token=39f14e1e-ceee-4921-b5ca-3e7d503cde90" alt=""><figcaption><p>flag4.0</p></figcaption></figure>

After snooping around in this folder, I looked at the README file&#x20;

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FDIouuH7Zin0NLk9tPLRR%2Fimage.png?alt=media&#x26;token=acf05ae6-8bd4-4f11-a99c-990bef4d2eed" alt=""><figcaption><p>README</p></figcaption></figure>

I need to find a certain script. I don't see one in my current directory, so I'll move back one. I moved to Patrick's directory and found a hidden folder called .bank\_work by running `ls -a` inside `/patrick` and here was the script:

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FJ7uWZIcUdD8srPaaJXWB%2Fimage.png?alt=media&#x26;token=ea33b890-6882-4e75-8b3a-83c6cb7adcfc" alt=""><figcaption><p>script</p></figcaption></figure>

I tried running the script, since I could see it was an executable, but received _permission denied_.&#x20;

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FDMIylAI2un6YxPemGwBD%2Fimage.png?alt=media&#x26;token=05471a38-b300-424d-810e-e8846fb990b4" alt=""><figcaption><p>denied</p></figcaption></figure>

After running `getent group | grep sudo` I see that cat is not part of the sudo group but `sudo -l` shows cat does have specific sudo privileges given to them by the system admin so that they can run root's script. I'll use sudo to run it:

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FRLPLVNo72EDYLz8nKdRV%2Fimage.png?alt=media&#x26;token=ace91442-5e11-47aa-a1ab-7ee440fa761c" alt=""><figcaption><p>script.sh</p></figcaption></figure>

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2F3niw6hsB8y4Q9BfywLuj%2Fimage.png?alt=media&#x26;token=bfe65915-d5a4-43a1-94e3-bbc55bd73f8c" alt=""><figcaption><p>no file</p></figcaption></figure>

I entered the suggested prompt but changed the game name and got an error, so I looked at the files and I only have 2 schedules to choose from. Good to know, 0312 and 0315. I attempted to read the script to find out how it works but got _"cat: script.sh: Permission denied"._&#x20;

After assessing the files I can read, I find the program is probably calling to the files and finding certain keywords based off of what I input.&#x20;

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FMNumfhJZVPciFjDjvXGL%2Fimage.png?alt=media&#x26;token=73f371fc-057f-433b-8358-8c049d402d0b" alt=""><figcaption><p>BlackJack</p></figcaption></figure>

After testing different inputs, I found the most important thing to enter is the game name. As long as the game name is true, the rest of the script attempts to run. After some fiddling around, I find an exploit in this script and since I have sudo privileges on the file, I may be able to use it to see information I normally wouldn't be allowed, like the /etc/shadow file.&#x20;

I input `x : /etc/shadow BlackJack` and found flag 5.&#x20;

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2F7D8zTXjJNHyGE1mr0LFR%2Fimage.png?alt=media&#x26;token=33b7d36d-6907-4ea7-829c-c40aa8bb591a" alt=""><figcaption><p>flag5</p></figcaption></figure>

### STEP 3: Escalation

Since I now have the password hashes, I can do 3 things&#x20;

1. Attempt to crack them with John the Ripper tool
2. Keep looking for more clues
3. Exploit my sudo privilege&#x20;

I decided to try all 3 options, starting with adding the hash to a file and running John. While that ran I looked into the bank directory and found a note:

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FYBj49Y42x28dNcSehW5J%2Fimage.png?alt=media&#x26;token=01403402-783d-412e-be82-00152edb3739" alt=""><figcaption><p>riddle</p></figcaption></figure>

After solving the riddle, I see 137256 as the number of lines and John cracked the hash to also be the same thing. Now that I know I have the right password for root, I can switch users very easily, but I opted for the awk privilege escalation to get the last flag: &#x20;

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FHWPR9vWnsVYOY1CcIlUl%2Fimage.png?alt=media&#x26;token=c474b4d3-ec3d-4340-827a-fa28b31866ed" alt=""><figcaption><p>crunch</p></figcaption></figure>

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2FodQxySZfu1H6Ruu5AQ7E%2Fimage.png?alt=media&#x26;token=26c20b6b-e0e3-428d-9486-7d81f2cb5949" alt=""><figcaption><p>John</p></figcaption></figure>

<figure><img src="https://4063747065-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGFFT9lXcArnSZPy6uxOC%2Fuploads%2F70NGBF8S23ERneULZy5F%2Fimage.png?alt=media&#x26;token=845583e1-479c-4279-b0d4-d0e7a020b29a" alt=""><figcaption><p>awk</p></figcaption></figure>

Flag 6 has been moved out of the `/` directory but it should be very easy for to find.

You can read about awk privilege escalation [here](https://gtfobins.github.io/gtfobins/awk/). Thank you for playing and congratulations if you made it to the end. Hopefully you learned a thing or two.

Feel free to reach out to me if you have any questions or feedback jacvbtaylor@gmail.com
