BLOCKY
- Layout for this exercise:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsegUQHvQR8azbLl3sgei7H8zSJZivg0_7i3N1LjfEqemL9inueBlodl3b_FBH5XW9NTHzZC2yOU-79qMSJeorqp1IHI6Qkyt4uBncfBdG-d4h9Yx-u90j82Cru-FWa7FzUUoS4EgoefQD/s1600/screenshot.34.jpg)
1 - INTRODUCTION
- The goal of this exercise is to develop a hacking process for the vulnerable machine Blocky, what is a retired machine from the Hack The Box pentesting platform:
https://www.hackthebox.eu/
2 - ENUMERATION
- Blocky's IP is 10.10.10.37:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgd1ZGt061BSYzVZTxTtDt7A3jEYc29zJdLcg0O8qKk7njsz1ohrNx8GueYUU6aWA7h1cN3m6dNHmVJAXG4Sf1VJKoyZvVfhaPq8FC4OnrEXawN1gbe3NRSRD-x4fSgLBGfz17OfN5ct9ro/s400/screenshot.36.jpg)
- Scanning with Nmap:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvaQH-5ZCQIBmnH3KOKhsw64ft5gVND7uzGMP04brHiAXCKN3KtLasESFZFl84jlZrEG9JpJzmSHHamBfEWZ_MkZe0gM1GmUrkKauVbXfEkFm3eBKksQn23xRhhM6bBY_o6biVs1CP3sJ8/s1600/screenshot.35.jpg)
- Scanning deeper ports 21,22,80 and 8192:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtGPNREbzZS57e0JGJaZb1HgJZKEmJerdLPWgL86FrWQTugEMhyh-pFpR5PLbyALH8GcLX0VvKhFuz5N_5DEmFSPisKSUQFuSUU4gzREKFD9ALYNZ6AacJLSQ3vJeafRxyE4qr7r2uiSU1/s1600/screenshot.37.jpg)
- Dirbusting the web server:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-qm4lonFGDc__FiGQK6m1jbtvCvq9Vup23cqrnDIc5zm65ZucyKH5qYfJimlk04nqEUBIwvr9zW6g3vm-zQDLFzFv_fStxPjcA3LbtEGSGYc4myoNwSsYvkjABjcv2SmzEsmHcJ_WiBIT/s1600/screenshot.28.jpg)
- Using the browser to explore some of those folders, the main page is Under Construction:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcB2UEy4DgcDsanBOx2S8RnX-GPOeHHZftS1HAAuC6WiAxnEJHYIDPSdx2C26qR4jXUcJfCDATQvVA8Qg07W3cceS2ZOpdFQQ8J5VQosqhL-HFCYak3dZarNSjIa4Ef5_YGicq0sNgsTu9/s640/screenshot.29.jpg)
- /wp-login:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyHqD2aiOu5yOmaATudpkT3ZSkBHQ8fPmWa2D7sV876yM8UlBZTOk6tKGrHDD_Kj-DgM6usOCVBhCY11cmkB4UQd5GqyuDQ9Xqmoo0nZLYmnySWDNvooGu_faB2dAAAygQqHK8smC8mOY8/s640/screenshot.30.jpg)
- /wp-includes:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2WJ-r_cWeesvDNvvluKcMJSqCW8a_0jkPyXMbDDcIA9qhJS9UXKg_3UMFU4E1HXkXRFiSL5n4VelezV7f6-Ssg4yOTbGDoOP7kJeIYNQ1XfqMUKsrLcWqPSmj3WD6fKtZmKAceF-Dvmlp/s640/screenshot.31.jpg)
- /phpmyadmin:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_Q-g_l8d5Up99f5xpEYmTaJtArxzvtXVWj_tIRnv-aUbLwhJmU5hkTh7NameQmeCFakUYMeuNptCulU5vvhTyMUYQcvrxxpBsWf4QWpeK8ZcE2NB9EMB7u4i8lr6s6hyphenhyphenfNIn1EBz38MZt/s640/screenshot.32.jpg)
- /plugins:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHyo_5y-eOl1OhMFYbh0q6rxwLSOj4xEv5MNe8IZwrOON5SFLq__0xZjtbkvZ8eLMYzf9ANAc027mTtVY4EUj4WHkC2ExFQqUfPhvAI1sIaWQ4RsGPO3IMQjVF3W46FP2xz_AC59ExPRp6/s640/screenshot.27.jpg)
3 - EXPLOITATION
- From /plugins let's save the file BlockyCore.jar:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPBWTCFoLgvk51SNXOvHgcxeXQ7mME-P3dz8bM4lMEMDIJnDluSv6pzRXhpyWrnwxiJFwzHKlDj5JZ6FPe1t-cEYjPMPj5CGc7MS7r1TI_Atgunkg1UMMjz-1bYZ8PSGxTJbUhcwqcdcoz/s640/screenshot.38.jpg)
- javadecompilers helps us to open and read the content of BlockyCore.jar:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhRWGyljA7GWt5a9vTVp-HmQhmnOW3g-f9nfTfGqVeJ07tnnDAyhYaUs33R-itV1ySmhAXMoFaNZ_uTpzSTw_taGZ8KGgLco_N4EkR7_VxPR3pGt-jGfbis22mBwPSV0T38bhJS-tPaqX4t/s1600/screenshot.16.jpg)
- Uploading BlockyCore.jar:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYR7-wSyXQCQGDB0Ic2aNA4AcqO_tftEa_q2aJtPDGTN4WFFK4MExFKFE3H2ZxpvC_0-lDNM5Hf2R2_oEpAuXyR4Hkkg4e0RaqOba7rBovEvfaoIcwBFQxzHsW7pU8ow4H71ECeLKyxTrf/s1600/screenshot.15.jpg)
- Selecting JDCore as decompiler:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihZWEGtBwPt7P4a56NDs-OmC7cG5YZnlqxNRmGul9e9VJlGonNjoM62oy2qrrm_hC1p7S9L8p_K_v6y226DbJzDmt_pmmUbzf5G_n51fxSK_gd560jxTUErTneo8-8-fl8QneTge5PxrHX/s1600/screenshot.17.jpg)
- The decompiling process is successful:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhd2vvz9RkkOItpCTHmnHa7Qeq98RIN4P-ATDPVNXJ4PrYSD1rhsa2iwXLIOLFzx71jQejfnwEp41bEmvpjYxjhyyRAAW7rEmpK0xvIR7XTCiZrgXq0YZOXrdDk_JMwyDlzdHaJ2KHeydPp/s1600/screenshot.18.jpg)
- Reading the results online (we could also download the results to the local machine clicking Save):
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKVkkvVEhyphenhyphen7DSC317Oep5ktGoVPwW8E1_Tf6VUxlBZPLELQRPRoGCuziNRbzjcz0w2XNYjSQd_55CkP0dH0pEiCC7hh7ZEL4kq-13rrYDfVF_MBwAMvraF3m99_79EaaS-iGStfherBZ3B/s1600/screenshot.22.jpg)
- So there is an SQL password available for user root, let's store that password:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEge9LqlL-NorgU0UQpyDKFU3pBH5tYvI21hlZr1Y3XrL5VmkO-4_99yRcQUQf7svHP7cIPYOBR-lDGZ6RZxfV2n8cOLoCW0wNqZkwZ69nTsAfn0dE_0_5SIp58QkGicVQ9D1BTOOOfMkMMd/s1600/screenshot.23.jpg)
- Though the password is for an SQL database, let's try to use it to SSH as root, just in case it works.
- Unfortunately the access is denied:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiaqlbMHxGKOqVdbVAHjgVX_2GY1gGVCiObBo_o6hjJM-NnSBFMkLCz1tjNMF7W3VPzZRLZC2-0x4k1AvoQDR8KjRrD_i84LdkhZsnp4BvM1svmnbMZC7Y2xiey1bxtNqkMeeWCVgv6VIbi/s1600/screenshot.24.jpg)
- However the password works for the phpMyAdmin login portal:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjeaf5gCzIlEIJc0VM8YIGDF-WD0_2B0WjG-70bdrg93xlhU91p1YFObcGs5j7BYriODOcmCr32BlCshLugtXBRRDyGHG58AQsPnAb48zzwvE7sxn2pM0Tbb9ju7aWmVixluKmVzWQBU0d/s1600/screenshot.25.jpg)
- Once having accessed to phpMyAdmin, at the database wordpress there is a user notch:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3caApl2Pxc1gVARuSFphHfjYMj-OyyUdQ7J5wiI0nQr6q6QfQDOOIBEnUnDRlJxNMrmdS9DlwY3tx-PsHR0XBLVlhSL2UI8_TdPA6otxEo8u8DcF0Hlf53xJSgpOoTcdKvvxV2KQ5Ttoe/s1600/screenshot.26.jpg)
- Now, credentials notch:8YsqfCTnvxAUeduzjNSXe22 are sucessful to access with SSH:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgl4DSCctTv2SyjBFX-PB1ycwqfFRtyiQa1bARLJE0MMRlo33QXg0Ufa85MbyO1QCmIcwf44FOG4TElU7tIPPXVs7yJ9IwlQnvv1f2fD2QgEz_2QAeeDk3WBfImOzGcIuRyUBVvW41UFIFj/s1600/screenshot.39.jpg)
4 - READING THE 1st FLAG
- Reading user.txt:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbiG1YpHfK62MF9lQZvxQVMGO14ZMDQki1iRqNq2hrSZiP1_xrS4UWP5qwowx1382JP6jiTIX0lymSkkpn8zFrdP6PQxybWCq_kGEJTJWQW5FTzJF1AE9pRRjiMadstl0aJXK6CP1NEOGd/s320/screenshot.40.jpg)
5 - PRIVILEGE ESCALATION
- Access to folder /root is denied:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzfEKYT2lnYNrHOTqW3Ocn48f4lMZv_oV0-B6bOWOIEdruuSUXuJo6c1xFvMpBFXq5Q7RfKApy79iMkIPuBUpK4oJc4daw1b5eFGdHuXsgxSIwEjDDqqKFwCfsSbQmgbFcogBl7RgsSaf8/s1600/screenshot.41.jpg)
- We are lucky because user notch is a full privilege sudoer:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBD6sTgn5t_Xb8YcbKH9T8bVYbCxM3qp6TWydWl0ezvg66TGnzlPFhBbxtngoq7Qecoj3szm1MAjwD2i2hAvB5aX_5f77CHqrRx3KiXSaNeBg0ccLHSK_PP7TzsFvOFPUhFfwHBqy5zBgI/s1600/screenshot.42.jpg)
- Getting a root shell:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAhPrm7gemBZXuPuL9Fqi9i18qhxcabHGU4aIFpeaUdonCgOL0ULYIZHffMClIYlBobnYwi2zNAQy4MtWTNngLf-q7UbC5nb05K6coCN5NlutM6GwHW7BXxjW_6a-wlS2PqqUiYcegUG9E/s1600/screenshot.43.jpg)
6 - READING THE 2nd FLAG
- Reading root.txt:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDxMnR5PnPwe3jir6xMEfdaF9wkt6khMEeFVkfHDtoXJa6mb4bYd7UUruR-VFdgYftM4TziRzdaq5sj9Y0RZnG5MOUSKKTJY6x3q78m2X7L2m4GPGR_DQflur5cnkmu_apwS0sgPpv91Xn/s1600/screenshot.44.jpg)