Blocky

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Blocky (Ubuntu, attack surface: Apache httpd 2.4.18 (80), OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0) (22), ProFTPD 1.3.5a (21), sophos (8192)). Foothold via rce; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.10.37 --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: ftp (21), http (80), minecraft (25565), sophos (8192), ssh (22).
• Scan used: nmap -p- -sVC 10.10.10.37 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.10.37 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-29 20:21 PDT
Nmap scan report for 10.10.10.37
Host is up (0.019s latency).
Not shown: 65530 filtered tcp ports (no-response)
PORT      STATE  SERVICE   VERSION
21/tcp    open   ftp       ProFTPD 1.3.5a
22/tcp    open   ssh       OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 d62b99b4d5e753ce2bfcb5d79d79fba2 (RSA)
|   256 5d7f389570c9beac67a01e86e7978403 (ECDSA)
|_  256 09d5c204951a90ef87562597df837067 (ED25519)
80/tcp    open   http      Apache httpd 2.4.18
|_http-title: Did not follow redirect to http://blocky.htb
|_http-server-header: Apache/2.4.18 (Ubuntu)
8192/tcp  closed sophos
25565/tcp open   minecraft Minecraft 1.11.2 (Protocol: 127, Message: A Minecraft Server, Users: 0/20)
Service Info: Host: 127.0.1.1; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 113.29 seconds

1. Interesting, the machine runs a minecraft server on port 25565. Noticing the ftp version, it's famous for the RCE vuln.
2. But let's keep that assumption first. After i ran dirbuster, found 2 files that could be our interest.

Dirbusting for .jar, .py, .txt, .php, .sh, .pl.

1. This interest is supported by the argument from /wiki.

DECOMPILED BLOCKYCORE.JAR FILE WITH JADX-GUI | the other .jar file is not our interest.

1. It exposes the credentials for the root MySQL user.

2. It hangs, confused here. Took me a while until i found a username --> notch.

3. Kinda guessy, i tried to login ssh using the username notch and the sql's root password.

notch:8YsqfCTnvxAUeduzjNSXe22

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Directory listing using dirbuster.
2. Decompile a .jar file using JADX-GUI.