Blocky — HackTheBox

Foothold

We start as always with an Nmap scan

nmap 10.10.10.37
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-11 22:15 CEST
Nmap scan report for 10.10.10.37 (10.10.10.37)
Host is up (0.039s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT     STATE  SERVICE
21/tcp   open   ftp
22/tcp   open   ssh
80/tcp   open   http
8192/tcp closed sophos

Nmap done: 1 IP address (1 host up) scanned in 4.45 seconds

There are 3 services running on: FTP, SSH and HTTP

FTP

We tried to do an anonymous log-in but it didnt work

HTTP

The web application is made with WordPress, a famous CMS to make sites in an easy way. There is a method to eumerate the users in WordPress, and it is by putting ?author=ID in the url. Each users will have each ID which will display its username

notch

By doing a directory fuzzing we have also discovered /plugins/ folder which contains 2 jar files: BlockyCore.jar and griefprevention-1.1.jar.

Both of them are plugins used on a minecraft server: maybe they contain something interesting?

Get CTFMania’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

We download both of the files and we decompile them with jd-gui

8YsqfCTnvxAUeduzjNSXe22

There is an sqlPass, a password that we can also use to log-in via SSH with the user discovered before, notch!

Privilege Escalation

By doing sudo -l we notice that we are allowed to run every command as any user and any group.

sudo -l
[sudo] password for notch: 
Sorry, try again.
[sudo] password for notch: 
Matching Defaults entries for notch on Blocky:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User notch may run the following commands on Blocky:
    (ALL : ALL) ALL

So, to become root we just have to run sudo su

notch@Blocky:~$ sudo su
root@Blocky:/home/notch#

And we have finally rooted the machine!