Hackthebox - Blocky

From nmap, there are multiple open ports.

It is the web page and gobuster result.

In the plugin folder, there are two .jar files

From BlockyCore.jar, we can get sql credentials.

With wpscan, we can get user named notch.

I tried to ssh to the server with user notch and the password of sql credential, and it succeeded. We get user.txt, and we can run any command with sudo privilege. Using sudo su, we are now root and get root.txt.