HackTheBox - Blocky

The STTY command I messed up was simply `stty rows ## cols ##`
01:15 - Begin Recon with Reconnoitre
03:15 - Examining findings from Reconnoitre
06:50 - Decompiling java Jar Files with JAD
08:18 - Using JD-GUI
10:33 - Running WPScan
12:10 - Manually enumerating wordpress users
12:43 - SSH To the box and PrivEsc
------ Box Completed, Below extra content (Some mistakes, pretty much do this live without prep)
15:30 - Rabbit hole, gaining access through FTP
17:09 - Finding Wordpress DB Password
18:33 - Switching to WWW-DATA by using phpMyAdmin + Wordpress
20:10 - Generating a PHP Password for Wordpress
21:50 - Gaining code execution with Wordpress Admin access
25:40 - Shell as www-data
26:40 - Enumerating Kernel Exploits with Linux-Exploit-Suggester
30:10 - Attempting CVE-2017-6074 Dccp Kernel Exploit (Unstable AF)

[@andr3w_hilton]

Great video, I actually used that exact Kernel Exploit on a different box yesterday!! :-) to get around the constant crashing/resetting I modified what the script was doing and got it to spit out the root flag text as it crashed haha. (Thanks to Fooby for the tip to modify the script). As always though mate, your videos are a treasure chest of knowledge. Thanks for taking the time to make and post them.

[@skandashaktis]

Two years later I just rooted this box today by building a lxd alpine image and creating a container and mounting the entire filesystem in the container.

[@pentester-ethicalhacker]

Thank's for the video and the PHP command.

[@hamzakhiate1767]

Another great video - thanks

[@natashavlasova9643]

I rooted this box completely different. What I did first was some recon, including nmap, nikto, dirb etc. First ended up chasing the rabbit hole on FTP exploits but couldn't make anything work so I moved on. After that I checked which directories dirb found and enumerated through all of those and eventually found the java file in /plugin. Unzipped it, decompiled it and found the password. Then from my enumeration I remembered finding a PhpMyAdmin page and a Wordpress Login, tried the found password on both services and got a hit on PhpMyAdmin. There I found a database with Wordpress users and found user notch and his password. Then remembered that SSH was running so I tried logging in on SSH with user Notch and it worked. First thing I did next was sudo -i and specify the found 'root' password in the Java file and I was root. I wasted a lot of time trying FTP exploits but still managed to root the box in under 2 hours, it was a fun one! I now realize I'm writing this from my girlfriend's account lol.

[@locke8412]

your girlfriend is proud of you

[@tekken-pakistan2718]

Damn, that sponge.jar file was a big rabbit hole. Should always try obtained credentials with every user.

[@AndyTyler]

Thanks - another great walkthrough. Quick question: what password did you use for FTP access to notch @15:51? Same as the SSH password? Not sure how that benefits us here? (Or did I miss something?)

[@ippsec]

Yes, it was the same password as SSH. In this specific case it does not help you as SSH provides more access. However, if the SSH Server was configured to only do certificate-based login then the FTP path would become much more relevant. In reality, I saw FTP open on the box so wanted to see what was possible. Professionally, you don't just stop at getting root as your recommendation may still leave a hole open.

[@AndyTyler]

IppSec Yeah, that's what I thought. Totally agree at not just settling for root - I'm working through my OSCP and this concept is nicely encouraged there :)

[@MultiStraik]

Another great walk-through, I'm getting used to it :-) This machine hammered me. I tried to escalate from www-data for a complete weekend. The one thing I did not like was the way you became WordPress admin. instead of changing the admin password you could have created a new admin account without much more effort (copy the existing row in table users and insert a row with 'a: 1: {s: 13:"administrator";b: 1;}' into wp_usermeta). This way other users do not get distracted by a changed password and it's a bit more real world because it's less noisy.

[@chingyzsamigullin697]

Thx for the videos! Is it possible to share with subscribers with your tools in /opt directory?

[@L33TTechReviewer]

Awesome walkthrough! I got the sudo -l one right away but was stuck on how to proceed fell into a rabbit hole trying the start.sh file and modifying cron. Just starting out with these boxes and love all your vids! tmux one helped a lot. I followed along for the other ways to exploit this one and decided to use kernel exploit www.exploit-db.com/exploits/45010 instead for priv esc and idk if I got lucky or if this one is more stable because I got it to work first try and didn't crash. Always looking forward to your videos and no doubts they'll be of a lot of help as I start my journey towards oscp also, For some reason the netcat reverse shell didn't work for me. I tried both of the ones listed at pentestmonkey and the standard one called back to my listener but the connection closed right away i tried different flags like -lkp and -nlvvp but it didn't seem to want to work. I know I could've cat the file but decided to just upload a more complex php web shell that allowed me to traverse and see what I was doing. Anyone know what could have been the problem with netcat?

[@Daniel-ng8fi]

what were you trying to do with the stty command?

[@jt1731]

Ha! Nice. I did this box completely different from www-data.

[@ippsec]

What did you end up doing?

[@jt1731]

It's been a while so I dont exactly remember. I cracked open the jar, used creds for phpmyadmin. I must have stepped on someone, because there was more than just Notch in the wp-users table. Hashcat'd a password. Made a wordpress module that popped a www-data shell on activation. For root I probably just sudo'd. So maybe I didn't "completely" do it different, just different - and no where near as quick :D

[@blackphox5219]

This was an easy one. A quick nmap find web goto wiki with is what i think was running WordPress append ?author=1 drops the user name then in plugins from dirb found file just viewed as binary password was obvious then always try password reuse and bam was rooted in less then 6 minutes

[@wutangdaug]

Hi there IppSec. I tried HacktheBox today. However, I am able to hack 2 simple machines. It is kind of frustrated because I manage to root 28 machines in OSCP lab within two months. Does Hackthebox comparably harder? Or it is just becasue I overlooked myself?

[@ippsec]

A lot of machines are definitely more difficult imo. If you click on machine names you can see what people rated the user and root difficulty. Many machines are definitely supposed to take longer than a day.

[@otto.x5328]

Hi Songchen Han, what's your email address? I have some PWK/OSCP question to ask you in private.

[@yomismo2125]

Great info. Thanks to both of you. I want to take OSCP too but wanted to practice as much as possible before taking the course/exam, started with the old games to refresh what I once learned from Over the Wire, Mod-X and that kind of games. Also found VulnHub and last but not least HTB. The truth is that I was getting frustrated, only managed to get one machine (Access) and have three more where I've been able to get shells and have the priv esc pending. Reading this comment gives me so much hope, I thoght I was going to be too dumb to be able to take the OSCP. Finding @IppSec channel has been a huge discovery. I'm learning so much from this videos. This videos can be a whole pentest course on their own, I'm doing a fist past to view all of them (half way there) and after that I'll make a second one to take notes and organize the huge amount of knowledge kept on these videos. Thank you so much IppSec for taking the time and make this great vids.

[@blackbird104]

Curious what tool you are using to show your VPN status at the bottom and how you are doing the panes?

[@ippsec]

Check out my introduction to tmux video

[@blackbird104]

NVM, just saw your video about it.

[@invisibleliberty2275]

Just wondering what version of kali linux are using? How do you get side by side terminals ?

[@hamidcrazy9027]

Use tmux

[@locke8412]

Use tmux

[@wajahathussain7457]

Can some one guide me im not able to get success by putting id_rsa(.)pub from host to target machine ftp> put id_rsa(.)pub not connected where im mistaking ?

[@rootabeta9015]

You aren't connected to the target. try ftp IP_ADDRESS_HERE instead of just ftp

[@rafaelsandoval6472]

This guy works at NSA. Is a Fucking Genius

[@Randomnessinlife]

burp suite shortcuts I found useful Send to Repeater Ctrl+R URL-encode key characters Ctrl+U

[@YannisSamantouros]

I cannot run reconnoitre. I get Traceback (most recent call last): File "reconnoitre.py", line 7, in from .lib.core.input import CliArgumentParser ValueError: Attempted relative import in non-package

[@danielcoloma232]

Install it with python setup.py install

[@nailbelaref7016]

What terminal mutliplexer is using in his videos ? tmux ?

[@MKVD]

Yes tmux, he has a video on it aswell

[@GoodNews-wz8wn]

apparently i could not get any shell by following along on 24:24 by doing exactly the same steps, wired

[@viralpatel9653]

Cool😎

[@mamitianarx7a54]

Link to download the machine please !

[@km0x905]

👏👏🖒🖒

[@m0nkey]

lol i crashed the box 3 times with that exploit before moving on :X

[@apt1311]

Run apt install seclists instead that’ll work as well

[@Cygnus0lor]

You could just `/usr/bin/sudo su ` and you'd be root with notch's password.

[@ippsec]

That's what I do at ~15:25. All the other content after that is extra content.

[@Cygnus0lor]

Oh sorry I missed that among all the panes :) Your videos are awesome.

[@whitestone2042]

The scanner you used is about a billion times harder than any normal scanner. Everyone who has common sense should just use dirbuster and save yourself some headaches.

[@sand3epyadav]

Ni