Blocky
Write up for the HTB machine 'Blocky'
1. Recon
1.1. nmap
cmd: nmap -sC -sV {target-ip}
Our nmap scan reveals port port 21-ftp, 22-ssh and port 80-http.
1.2. nikto
cmd: nikto -host {target-ip}
Our nikto scan reveals the site is vulnerable to XSS
It also reveals the url for the web application, blocky.htb, so let's add that to /etc/hosts
1.3. wpscan
cmd: wpscan --url http://blocky.htb -e u
Scrolling to the bottom of the web app we can see that it is powered by WordPress, so let's run wpscan
from wps scan we can see that there is a user notch
1.4. dirbuster
cmd: dirb http://blocky.htb
since we know it is a WordPress site, let's also run dirbuster to see what else we can find
after the scan has run let's enumerate through the directories it found.
at /plugins there are two files that we can download
1.5. jd-gui
cmd: jd-gui BlockyCore.jar
using jd-gui we can decompile both of the .jar files
in BlockyCore.jar we can see BlockyCore.class where we can find the password 8YsqfCTnvxAUeduzjNSXe22
from there we are able to ssh in to the machine with the credentials
2. Privilege escalation
sudo -l reveals:
which is not that exciting because we just enter the command sudo su and we are root!
navigate to /home/notch for user.txt and /root for root.txt.
Last updated