> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/blocky.md).

# Blocky

## Gaining Access

Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-cb4a4b7a25fd0e75a00597ab0b1afe52e261f7d9%2Fimage.png?alt=media)

### Plugins

Port 80 is a Wordpress Site that has a post referencing a plugin and a wiki system being in development.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-97bae77389cd82cbfa6affb6cb8e8c98e413d8a4%2Fimage.png?alt=media)

We can use `gobuster` on the website to find some hidden content.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-61f0a25993e27d8a488fd2744bb85bab1ca1d489%2Fimage.png?alt=media)

Heading to the plugins directory, we find two .jar files.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e3c55b148e0c9aed3999728e6e5ba9589c6185b1%2Fimage.png?alt=media)

We can take a look at these jar files using `jd-gui`, and find some SQL credentials within the machine.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-da8cd798277d243e462889b09ee280d64ecc76fe%2Fimage.png?alt=media)

So now we have a password but no user to use it with.

### Wordpress Scan

Earlier, we found some Wordpress-related directories, hence we can use `wpscan` to enumerate more about this machine. This would allow us to find this `notch` user.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-a6ec9c4c289ca124665ed215304f729fd77fa31d%2Fimage.png?alt=media)

With the password and this username, we can SSH into the machine.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-d2445b45e846966bc6beb714ee3105c786347353%2Fimage.png?alt=media)

## Privilege Escalation

Checking sudo privileges, we see this.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e6a4d9999e309170c95901bdd88db28aeb1ef2f9%2Fimage.png?alt=media)

Because we have the password from earlier, we can run `sudo su` to become root.