[peRd1]

https://github.com/ammaraskar/pyCraft will also work for sending minecraft msgs as long as you have other stuff set up
i automated to get the first foothold then a second powershell script to root it  form the initial foothold.

Any hints for root? Aside from looking in the directory we land in

Cough... plugins... cough! Look "inside", find the interesting file, decompile, and you will know what to do.

The biggest struggle of this box was finding a CLI MC client or interacting with MC, otherwise it's easy box indeed.

But terrible choice of CVE... also hinting that minecraft should be used, messing around with launchers, trying to skip the login of (paid) microsoft account etc, annoying shit.

Worst easy box of don't know how many years, tbh.

People shouldn't forget to give "review" of the box, at least they should see reflecting reality and not produce/release shit like this furthermore..

---

Can someone from the HTB just fix the machine. i knew it could be a nightmare for such multi-players box with poor server.

Apparently one game server cannot accept players more than 3 ppl. And after repeatedly requesting to reset the machine, you join the server, you got to rev shell, you captured the flag, and typing in HTB just showing error with wrong flag ...

FIX THE SERVER

Unfortunate side effect of the log4j method. By creating the revshell you essentially 'steal' the server process for your reverse shell. Meaning others cant utilize the server for their reverse shells, so then everyone goes to reset.

Seeing log4j somewhere other than tryhackme, and on a windows machine, is interesting. Lack of foresight from the creator for not considering the overflow though. Some paid methods for alternative single instances but that's a bad 'workaround'.

Exactly, this! Couldn't agree more with this. Good point.

[wardensec]

https://github.com/ammaraskar/pyCraft will also work for sending minecraft msgs as long as you have other stuff set up
i automated to get the first foothold then a second powershell script to root it  form the initial foothold.

Any hints for root? Aside from looking in the directory we land in

Cough... plugins... cough! Look "inside", find the interesting file, decompile, and you will know what to do.

The biggest struggle of this box was finding a CLI MC client or interacting with MC, otherwise it's easy box indeed.

But terrible choice of CVE... also hinting that minecraft should be used, messing around with launchers, trying to skip the login of (paid) microsoft account etc, annoying shit.

Worst easy box of don't know how many years, tbh.

People shouldn't forget to give "review" of the box, at least they should see reflecting reality and not produce/release shit like this furthermore..

---

Can someone from the HTB just fix the machine. i knew it could be a nightmare for such multi-players box with poor server.

Apparently one game server cannot accept players more than 3 ppl. And after repeatedly requesting to reset the machine, you join the server, you got to rev shell, you captured the flag, and typing in HTB just showing error with wrong flag ...

FIX THE SERVER

Unfortunate side effect of the log4j method. By creating the revshell you essentially 'steal' the server process for your reverse shell. Meaning others cant utilize the server for their reverse shells, so then everyone goes to reset.

Seeing log4j somewhere other than tryhackme, and on a windows machine, is interesting. Lack of foresight from the creator for not considering the overflow though. Some paid methods for alternative single instances but that's a bad 'workaround'.

Exactly, this! Couldn't agree more with this. Good point.

Okay that was easy, thank you lol. Didn't know you could view the contents of a .jar file like that.

[peRd1]

Someone please share with me the poc.py coz I'm trying with jdk1.8.0_20 with powershell -enc for windows reverse shell.

But shell didn't happen.

Thanks.

Both kozmer's poc or davidbombal's poc are working just fine, in essence they're doing the same thing, doh.

Just RTFM how to use the poc. Use jdk1.8.0_20 to compile, got some people downloading+ extract this and use their default javac ...really??...

Edit the java file as you should (either for foothold i.e. cmd.exe/powershell.exe or revshell then powershell#3 base64 enc)

Run the prequirements or necessities as the poc should be run, one of them even has a video...

[GWTW]

Someone please share with me the poc.py coz I'm trying with jdk1.8.0_20 with powershell -enc for windows reverse shell.

But shell didn't happen.

Thanks.

You just need to change the variable to "cmd.exe", not a full reverse shell payload

Thanks bro, it work. now decompling the jar.

[sahasi]

Someone please share with me the poc.py coz I'm trying with jdk1.8.0_20 with powershell -enc for windows reverse shell.

But shell didn't happen.

Thanks.

You just need to change the variable to "cmd.exe", not a full reverse shell payload

Thanks bro, it work. now decompling the jar.

hey man,
i tried every possible thing from this forum even this
but its not working for me

[NoobGajen]

anyone have any ideas, how can i pwned admin user ?

[peRd1]

anyone have any ideas, how can i pwned admin user ?

hey man,
i tried every possible thing from this forum even this
but its not working for me

To both of you, check inside plugins folder, decompile, find those credentials. And look for a way to use them. (khm-khm... .. maybe? portfwd?)

That's all for root. Nothing more to say.

[sahasi]

anyone have any ideas, how can i pwned admin user ?

hey man,
i tried every possible thing from this forum even this
but its not working for me

To both of you, check inside plugins folder, decompile, find those credentials. And look for a way to use them. (khm-khm... .. maybe? portfwd?)

That's all for root. Nothing more to say.

i'm sorry but i was talking about foothold

[Jan_de_Boer]

Someone please share with me the poc.py coz I'm trying with jdk1.8.0_20 with powershell -enc for windows reverse shell.

But shell didn't happen.

Thanks.

You just need to change the variable to "cmd.exe", not a full reverse shell payload

Thanks bro, it work. now decompling the jar.

I had the same problem , did not correctly decompile the jar, so thnx for the advice,

[sahasi]

anyone have any ideas, how can i pwned admin user ?

hey man,
i tried every possible thing from this forum even this
but its not working for me

To both of you, check inside plugins folder, decompile, find those credentials. And look for a way to use them. (khm-khm... .. maybe? portfwd?)

That's all for root. Nothing more to say.

i'm sorry but i was talking about foothold

thanks for the 'cmd.exe' after trying for like a dozens of times i finally got the foothold