Blocky
Blocky Linux · Easy
Task 1
What is the name of the FTP software running on Blocky?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
┌──(pmartinezr㉿kali)-[~]
└─$ nmap -p- -sCVS -T 5 --min-rate 5000 10.129.29.193
Starting Nmap 7.95 ( https://nmap.org ) at 2025-12-31 14:55 CET
Nmap scan report for 10.129.29.193
Host is up (0.044s latency).
Not shown: 65530 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
21/tcp open ftp?
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 d6:2b:99:b4:d5:e7:53:ce:2b:fc:b5:d7:9d:79:fb:a2 (RSA)
| 256 5d:7f:38:95:70:c9:be:ac:67:a0:1e:86:e7:97:84:03 (ECDSA)
|_ 256 09:d5:c2:04:95:1a:90:ef:87:56:25:97:df:83:70:67 (ED25519)
80/tcp open http Apache httpd 2.4.18
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Did not follow redirect to http://blocky.htb
8192/tcp closed sophos
25565/tcp open minecraft Minecraft 1.11.2 (Protocol: 127, Message: A Minecraft Server, Users: 0/20)
Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 266.82 seconds
Nmap no consigue obtener la versión.
1
2
3
4
5
6
7
8
┌──(pmartinezr㉿kali)-[~]
└─$ ftp 10.129.29.193
Connected to 10.129.29.193.
ls
220 ProFTPD 1.3.5a Server (Debian) [::ffff:10.129.29.193]
Name (10.129.29.193:pmartinezr): 331 Password required for ls
Password:
Pruebo a conectarme al servidor y lanzar un comando.
ProFTPD
Task 2
What username is given by enumerating the website?
Antes de nada incluimos en /etc/hostsla dirección de la máquina para facilitar la resolución. Aparece una web en http://blocky.htb/ Wappalizer nos dice que es un Wordpress 4.8
1
2
3
BlockyCraft
Under Construction!
Visito el enlace http://blocky.htb/index.php/2017/07/02/welcome-to-blockycraft/
1
Posted on July 2, 2017 by Notch
aparece un usuario Notch
Notch
Task 3
What relative path on the webserver offers two JAR files for download?
http://blocky.htb/index.php/author/notch/
Sin embargo http://blocky.htb/wp-admin nos redirige a la página de login de Wordpress.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
┌──(pmartinezr㉿kali)-[~]
└─$ dirsearch -u http://blocky.htb
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460
Output File: /home/pmartinezr/reports/http_blocky.htb/_26-01-01_18-50-41.txt
Target: http://blocky.htb/
[18:50:41] Starting:
[18:50:45] 403 - 296B - /.ht_wsr.txt
[18:50:46] 403 - 299B - /.htaccess.bak1
[18:50:46] 403 - 299B - /.htaccess.orig
[18:50:46] 403 - 301B - /.htaccess.sample
[18:50:46] 403 - 299B - /.htaccess.save
[18:50:46] 403 - 299B - /.htaccess_orig
[18:50:46] 403 - 300B - /.htaccess_extra
[18:50:46] 403 - 297B - /.htaccessBAK
[18:50:46] 403 - 297B - /.htaccessOLD
[18:50:46] 403 - 298B - /.htaccessOLD2
[18:50:46] 403 - 297B - /.htaccess_sc
[18:50:46] 403 - 289B - /.htm
[18:50:46] 403 - 290B - /.html
[18:50:46] 403 - 299B - /.htpasswd_test
[18:50:46] 403 - 296B - /.httr-oauth
[18:50:46] 403 - 295B - /.htpasswds
[18:50:47] 403 - 290B - /.php3
[18:50:47] 403 - 289B - /.php
[18:51:36] 404 - 48KB - /index.php/login/
[18:51:37] 301 - 313B - /javascript -> http://blocky.htb/javascript/
[18:51:42] 301 - 0B - /index.php -> http://blocky.htb/
[18:51:48] 200 - 7KB - /license.txt
[18:51:59] 301 - 313B - /phpmyadmin -> http://blocky.htb/phpmyadmin/
[18:52:07] 301 - 310B - /plugins -> http://blocky.htb/plugins/
[18:52:09] 200 - 409B - /plugins/
[18:52:13] 200 - 3KB - /phpmyadmin/doc/html/index.html
[18:52:15] 200 - 3KB - /phpmyadmin/
[18:52:15] 200 - 3KB - /phpmyadmin/index.php
[18:52:20] 200 - 3KB - /readme.html
[18:52:22] 403 - 299B - /server-status/
[18:52:22] 403 - 298B - /server-status
[18:52:37] 301 - 307B - /wiki -> http://blocky.htb/wiki/
[18:52:37] 200 - 256B - /wiki/
[18:52:37] 301 - 311B - /wp-admin -> http://blocky.htb/wp-admin/
[18:52:37] 500 - 4KB - /wp-admin/setup-config.php
[18:52:37] 200 - 0B - /wp-config.php
[18:52:38] 200 - 531B - /wp-admin/install.php
[18:52:38] 301 - 313B - /wp-content -> http://blocky.htb/wp-content/
[18:52:38] 200 - 0B - /wp-content/
[18:52:38] 500 - 0B - /wp-content/plugins/hello.php
[18:52:39] 200 - 84B - /wp-content/plugins/akismet/akismet.php
[18:52:39] 301 - 314B - /wp-includes -> http://blocky.htb/wp-includes/
[18:52:39] 500 - 0B - /wp-includes/rss-functions.php
[18:52:39] 200 - 0B - /wp-cron.php
[18:52:39] 302 - 0B - /wp-signup.php -> http://blocky.htb/wp-login.php?action=register
[18:52:40] 200 - 453B - /wp-content/uploads/
[18:52:41] 200 - 1KB - /wp-login.php
[18:52:42] 405 - 42B - /xmlrpc.php
[18:52:45] 302 - 0B - /wp-admin/ -> http://blocky.htb/wp-login.php?redirect_to=http%3A%2F%2Fblocky.htb%2Fwp-admin%2F&reauth=1
[18:52:45] 200 - 1B - /wp-admin/admin-ajax.php
[18:53:15] 200 - 4KB - /wp-includes/
Task Completed
Por una parte tenemos el wp-login y el phpmyadmin también parece que hay una wiki bajo construcción.
Nos preguntan por un path así que debemos recorrer los encontrados hasta dar con alguna pista.
En el directorio plugins nos encontraremos dos archivos http://blocky.htb/plugins/ BlockyCore.jar y griefprevention-1.11.2-3.1.1.298.jar
/plugins
Task 4
What password is present in the BlockCore.jar file?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
package com.myfirstplugin;
public class BlockyCore {
public String sqlHost = "localhost";
public String sqlUser = "root";
public String sqlPass = "8YsqfCTnvxAUeduzjNSXe22";
public void onServerStart() {
}
public void onServerStop() {
}
public void onPlayerJoin() {
this.sendMessage("TODO get username", "Welcome to the BlockyCraft!!!!!!!");
}
public void sendMessage(String username, String message) {
}
}
Usando esta herramienta online https://www.decompiler.com/ decompilo el archivo BlockyCore.jar java y obtengo una password 8YsqfCTnvxAUeduzjNSXe22esta debería ser la password de entrada a mysqladmin.
8YsqfCTnvxAUeduzjNSXe22
Submit User Flag
Submit the flag located in the notch user’s home directory.
Se puede entrar al panel de phpmyadmin con esa password y podemos modificar los datos puediendo modificar el usuario o añadir otro o cambiar el correo de notch@blockcraftfake.com pero no es necesario, es otro caso más de password reutilizado.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
┌──(pmartinezr㉿kali)-[~/htb/blocky]
└─$ ssh notch@blocky.htb
The authenticity of host 'blocky.htb (10.129.29.193)' can't be established.
ED25519 key fingerprint is: SHA256:ZspC3hwRDEmd09Mn/ZlgKwCv8I8KDhl9Rt2Us0fZ0/8
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'blocky.htb' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
notch@blocky.htb's password:
Welcome to Ubuntu 16.04.2 LTS (GNU/Linux 4.4.0-62-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
7 packages can be updated.
7 updates are security updates.
Last login: Fri Jul 8 07:24:50 2022 from 10.10.14.29
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
Reutilizo la password y entramos por SSH.
1
2
notch@Blocky:~$ cat user.txt
d6634294436facf353041b72258a3290
d6634294436facf353041b72258a3290
Task 6
Is notch able to run sudo -i and get a shell as root?
1
2
3
notch@Blocky:~$ sudo -i
[sudo] password for notch:
root@Blocky:~#
yes
Submit Root Flag
Submit the flag located in root’s home directory.
1
2
root@Blocky:~# cat root.txt
e9ef95edb9d94ea7d4a8cfebbac6f85b
e9ef95edb9d94ea7d4a8cfebbac6f85b