Blocky

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.37 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p21,22,80,8192,25565 10.10.10.37 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

If analyze the website with the whatweb tool, we'll see that it is a WordPress site.

whatweb http://10.10.10.37

Now, let's take a look at the website.

We can see that there is only one post, made by the user notch.

Let's try to enumerate directories with gobuster.

gobuster dir -u http://10.10.10.37/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

If we take a look at the /wp-admin directory, we'll see the WordPress login panel.

And if we take a look at the /phpmyadmin directory, we'll see the PHPMyAdmin login panel.

We can also see the /plugins directory, which contains two files.

Exploitation

If we download the BlockyCore.jar file, and unzip it, we'll get two files.

unzip BlockyCore.jar

We can see that the BlockyCore.class file, is a binary.

file com/myfirstplugin/BlockyCore.class

But, we can try to see if there are any interesting strings in the file.

strings com/myfirstplugin/BlockyCore.class

We can see some credentials, the user root with the password 8YsqfCTnvxAUeduzjNSXe22. if we try those credentials in the PHPMyAdmin login panel, we'll see that we will get in.

As we are logged in as the user root, we can modify any database. Let's change the notch user password from the wp_users table inside the wordpress database.

To change the password of the notch user, we can press on the Edit button, then change the value of the user_pass column to test, select the MD5 function, and press Go.

Now we could log in the WordPress login page with the user notch, and the password test.

Time to get a shell. First, click on Appearance > Editor.

Then, press on the 404 Template.

Then remove all the code, and replace it with the following one. Make sure to replace the IP address of your local machine. After replacing the code, press on Update File.

Now, let's set a netcat listener on port 1234, that will catch the reverse shell.

nc -lvnp 1234

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

If now we access the following URL, we'll get a reverse shell as the www-data user.

http://10.10.10.37/wp-content/themes/twentyseventeen/404.php

Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

Now we could see that the user notch, is also a user on the machine.

cat /etc/passwd | grep sh

Let's try to become the user notch, with the password 8YsqfCTnvxAUeduzjNSXe22,that we found earlier. Then we could grab the user flag.

su notch

If we list the sudo privileges of the notch user, we'll see that we can execute any command as the root user. So, as we can become the root user, and all we have to do is reap the harvest and take the root flag.

sudo su

Last updated

Was this helpful?