Hosting your own Public Minetest Server

What is Minetest ?

Minetest (server) is a near-infinite-world block sandbox game and a game engine, inspired by InfiniMiner, Minecraft, and the like. It’s free and open source software and is available for Linux-based systems, FreeBSD, Microsoft Windows, MacOS, and Android.

Hosting a public minetest server on a debian/ubuntu vps(cloud server)

First step, choosing the Minetest version:

export branch=$(printf "Enter Minetest version: " >&2;read r;echo "$r")

It will ask you to enter a Minetest version. You can enter any numeric version, but you probably want one of these:

  • master: Latest development state (5.4.0-dev)
  • stable-0.4: Stable release in the 0.4 series (0.4.17.1) [UNSUPPORTED]
  • stable-5: Stable release in the 5 series (5.3.0)

After you’ve done that just paste the one-line script into your terminal, taken from here:

(sudo apt-get install -y unzip g{it,cc,++} {c,}make zlib1g-dev lib{sqlite3,curl4-openssl,luajit-5.1,leveldb}-dev&&cd $(mktemp -d)&&wget downloads.sourceforge.net/irrlicht/irrlicht-1.8.4.zip -O irr.zip&&unzip -q irr.zip&&git clone https://github.com/minetest/minetest -b $branch&&cd minetest&&git clone https://github.com/minetest/minetest_game -b $branch games/minetest_game&&cmake . -DBUILD_CLIENT=0 -D{BUILD_SERVER,RUN_IN_PLACE,ENABLE_LEVELDB}=1 -DIRRLICHT_INCLUDE_DIR=$PWD/../irrlicht-1.8.4/include&&make -j$(nproc) package&&p=$(echo minetest-*.tar.gz)&&cp "$p" ~&&printf '\n\n\e[1;32mBuild successful, an archive called "%s" was placed in your home folder.\nTo run the server, extract the archive and run the executable inside the 'bin/' folder\e[0m\n' "$p")||printf '\n\n\e[1;31mBuild failed, review log output above to identify and fix the issue.\e[0m\n'

It will ask you for your password once in the beginning. Once it’s done you’ll have a .tar.gz archive in your home folder, you can extract it anywhere you’d like and run minetestserver from there like a portable installation.

so , extract the tar file as:

tar -xf minetest-5.4.0-linux.tar.gz

then cd into extracted directory , you should modify the minetest.conf file , to modify the game behaviour.

After that open the firewall on the port you want to run the server using ufw:

sudo ufw enable
sudo ufw allow 30000
sudo ufw allow ssh  #so that the vps login work later
sudo ufw status

well after that we can change the game by adding game in games folder, add other textures in textures folder , mods in mods folder and so on from where you extracted the .tar.gz archive( or your minetestserver installation) .

To run the server do:

warning are of no worries as they arise from additional mods added

Now since the server is running alright , any person who wants to connect to your minetest server can connect using minetest gui client they have on their devices , on the specific port your server is running . You can configure your minetest.conf file to control the behaviour of game as you wish.

Other installations options:

  • use minetest-server package which is present in debian/ubuntu official package repository(although not recommended due to very old versions).
  • Install into debian using Backports .
  • Install into ubuntu using ppa.

Hope this guide helps you in creating the latest version of your own public minetest server 🙂

Kioptrix: Level 1.1 (#2)

Kioptrix VM image: https://www.vulnhub.com/entry/kioptrix-level-11-2,23/

Aim : To get to the root of the machine.

Difficulty Level : Easy

As always, we would start with the initial scan to see the open ports on the target machine. I have shifted from “nmap” to “rustscan” for this initial investigation.

rustscan -a 10.0.2.15 -u 5000
These ports are open on target machine.
Services running.

There is a web-server running on port 80. Also , we should do some vulnerability scan. This time I would use a new tool in my arsenal : “Owasp Zap” .

Owasp Zap is a wonderful tool !

In the alert section we can see:

Running an automated scan on the target ip , we see the machine is vulnerable to an SQL Injection attack. Going to the site in browser and trying the most basic form of SQL injection attack we get a successful login:

SQL Injection will be successful with above input

We get a box saying ping the machine, this turns out to be vulnerable to remote code execution/command injection .

So , my first aim here was to get a reverse shell on this machine, using pentest monkey reverse shell cheatsheet :

we will use port 4567 here , instead of 8080
We Got a reverse shell successfully, but with a low privilege

Our aim now is to escalate our privilege and get root. Let’s get some info about the system and OS version:

we got CentOS version and also Kernel version

We would now look for this exploit online. Luckily we got one with good reputation:

see the kernel and os version :))

So , our main aim here is to execute this piece of code on the target machine. I tried directly downloading this code on the victim machine through wget/curl, but it didn’t worked.

So we will spawn a server , and download on victim machine through that:

WE ARE ROOT. we have accomplished our mission here.

Topics/Command Covered:

i) wget/curl

ii)SQL Injection

iii) uname , cat /proc/version , cat /etc/*release

iv)file sharing with the help of python SimpleHTTPServer

v)Netcat

vi)privilege escalation

Design a site like this with WordPress.com
Get started