Writeup: HackTheBox Blocky - Without Metasploit (OSCP Prep)
Tags: cybersecurity, wordpress, hackthebox
Published: 2021-08-13 15:55:58

Hello All!

Did another walk-through and this time its Blocky from HackTheBox.

So let's kick this off. 

##Command:
**nmap -sC -sV -T4 -oN nmap.txt 10.10.10.37**
1. -sC = Default Scripts
2. -sV = Probe open ports to determine service/Versions info
3. -T4 = Set timing for faster output (0-5)
4. -oN = Output to save it to a file

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rnu18x0qtggdzbkbxdn2.PNG)

#Current Ports Open:
1. 21 FTP ProFTP 1.3.5a
2. 22 SSH OpenSSH 7.2p2
3. 80 HTTP Appache HttpD 2.4.18
4. 8192 Closed

Now let's try to run **Dirb** on the system. 

##Command:
**dirb http://10.10.10.37**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kfewcsctd64875tmt4ox.PNG)

After a few moments we should get a response from the busting.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1h06uqkvcgjoorpdll6g.PNG)

There is a lot of information here so let's take 1 step at a time. Going to the first Directory found brings up a **Landing Page** that if you scroll down to the bottom has a Comment section. Granted there is no option for uploading files to this section but you can run **html** code that will display.

##Command:
**</h1> test <h1>**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zamlfs4isjels68yrvlw.PNG)

So this isn't the most interesting thing but if you scroll down you will see a **Login** button.

I am going to try some quick common passwords on the site:
**admin:admin; admin:password; admin:password1234; root:toor; root:root**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7tg0tm805vqg6xkq5guw.PNG)

None of these seems to work so I went over to Google to see if there are any default creds I could use.

But scrolling down the **Dirb** list the **/phpmyadmin/** brings up a new potential avenue for access.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qw78loagb899vxua62mi.PNG)

I attempted some common username:password combinations like above but no juice. Going back down the list from **Dirb**, I came across 2 different files under the **/plugins/** location. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lj1lmyq2s8orll4mfcce.PNG)

Let's go ahead and download these files to our Kali machine.

##Command:
**mv BlockyCore.jar /home/huey/Documents/HTB/Blocky**
**mv griefprevention-1.11.2-3.1.1.298.jar /home/huey/Documents/HTB/Blocky**

Then head to google and search for **Java Decompilers**.

##Command:
**Select Browse then upload your file**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5pyqn5yz9tcpjn7g4p1m.PNG)

##Command:
**Select Com**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ydjfbub7bu9e0r0x9bjv.PNG)

##Command:
**Select myfirstplugin**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zu385kz4l3x2px0mtnqf.PNG)

Now we can read the file. We can see that there is a **Root** user than a **sqlPass** of **8YsqfCTnvxAUeduzjNSXe22**. Copy that into a new file on your Kali machine for future use.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/45l76fr56vo0g2q8u82c.PNG)

Another way to do this is the following:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pgj0a7z2enr6fau04edc.PNG)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ppi3c3v3xdfngkim2cjc.PNG)

I am going to see if I can use these creds to login.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1z3aynddzgo9thwgxh5m.PNG)

Success! After some more digging around I see another user named **Notch** and another **User_Pass**.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bg0wxj2912r5viwykbl7.PNG)

So I messed around here for quite a bit before getting in. But I decided to see if I could use those creds above to login via the **SSH** server.

##Command:
**ssh notch@10.10.10.37**
**8YsqfCTnvxAUeduzjNSXe22**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/09048qtpbt58fljdmnh1.PNG)

Success! I was able to login and get access!

Now let's run the following to see what we can do.

##Command:
**sudo -l**
welp this is pretty easy
**sudo su**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eiqj85ft11oqql24vs6q.PNG)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pzmfd2v1jyw4ac0joslm.PNG)