HTB is an excellent platform that hosts machines belonging to multiple OSes. It also has some other challenges as well. Individuals have to solve the puzzle (simple enumeration plus pentest) in order to log into the platform and download the VPN pack to connect to the machines hosted on the HTB platform. Note: Only write-ups of retired HTB machines are allowed. The machine in this article, named Blocky, is retired.
The walkthrough
Let’s start with this machine.
Download the VPN pack for the individual user and use the guidelines to log into the HTB VPN.
The Blocky machine IP is 10.10.10.37.
We will adopt the same methodology of performing penetration testing as we have used previously. Let’s start with enumeration in order to learn as much about the machine as possible.
As usual, let’s start with the Nmap scan to gather more information about the services running on this machine. [CLICK IMAGES TO ENLARGE] «nmap -sC -sV -oA Blocky 10.10.10.37»
As we can see, ports 21, 22 and 80 are opened.
Let’s start the enumeration with port 80. We can see a normal webpage hosted on WordPress.
Let’s try to enumerate the directories with gobuster. We can see that we have a lot of WordPress directories hit. After enumerating, we found something interesting in the plugin directory. «gobuster -u http://10.10.10.37 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 20»
We have a jar file. Let’s download it and analyze it.
We can just unzip the jar file to inflate the classes within. We can see that there is a Blockycore.class in it. «unzip BlockyCore.jar»
Decompiling the class with JAD, we can see there are SQL users and passwords in cleartext. «jad BlockyCore.class» «cat BlockCore.jad»
We can browse the phpmyadmin and use these creds to enter the portal. We were able to successfully log in. So far, so good.
We can see that there is a user named “Notch.” We can try to edit the password as well, but let’s try to directly ssh in with the password discovered above.
SSH with user Notch and password discovered above results in a successful login. «ssh notch@10.10.10.37»
We can easily capture the user.txt flag. «cat user.txt»
Now let’s try to escalate privileges to root.
As you might have seen from previous articles, that first thing is to check current user access.
Running sudo -l reveals that this user has all the access. «sudo -l» «sudo su»
It can be easily escalated to root using sudo su. «cd /root» «cat root.txt»
We’re done! This was a very straightforward HTB box: Just enumerate and everything will fall in place. We will continue this series with more of this type of HTB box.
