Bank

Verified writeups for the Bank machine of Hack The Box

Bank

$ tldr AXFR → file upload RCE → SUID emergency.sh

·	·
Operating system	Linux
Difficulty	Easy
Vector	Web
IP	10.10.10.29
Retirement date	2020-07-07
Skills	Domain Zone Transfer Attack - AXFR (dig) Information Leakage Abusing File Upload [RCE] Abusing SUID Binary (WTF?) [Privilege Escalation]

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇪🇸 ES	El Pingüino de Mario	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Information Leakage	HackTricks	Open
DNS zone transfer	HackTricks	Open
File Upload Vulnerabilities	PortSwigger	Open
SUID binaries	GTFOBins	Open
Remote Code Execution (RCE)	HackTricks	Open

Related skills worth mastering

Sudo abuse · linPEAS · Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

If you liked this machine, try

• Laboratory — Linux, Easy
• Talkative — Linux, Hard
• OpenSource — Linux, Easy
• Frolic — Linux, Easy
• Nibbles — Linux, Easy

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07