Writeup: Hack The Box - Machines - Irked

(Updated: )
writeups
,

Description

  • Name: Irked
  • IP: 10.10.10.117
  • Author: MrAgent
  • Difficulty: 4/10

Discovery

sudo nmap -sV -sC -sS -A -v -p- irked.htb -oA nmap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
| ssh-hostkey:
|   1024 6a:5d:f5:bd:cf:83:78:b6:75:31:9b:dc:79:c5:fd:ad (DSA)
|   2048 75:2e:66:bf:b9:3c:cc:f7:7e:84:8a:8b:f0:81:02:33 (RSA)
|   256 c8:a3:a2:5e:34:9a:c4:9b:90:53:f7:50:bf:ea:25:3b (ECDSA)
|_  256 8d:1b:43:c7:d0:1a:4c:05:cf:82:ed:c1:01:63:a2:0c (EdDSA)
80/tcp    open  http    Apache httpd 2.4.10 ((Debian))
| http-methods:
|_  Supported Methods: POST OPTIONS GET HEAD
|_http-server-header: Apache/2.4.10 (Debian)
|_http-title: Site doesn't have a title (text/html).
111/tcp   open  rpcbind 2-4 (RPC #100000)
| rpcinfo:
|   program version   port/proto  service
|   100000  2,3,4        111/tcp  rpcbind
|   100000  2,3,4        111/udp  rpcbind
|   100024  1          50944/udp  status
|_  100024  1          52118/tcp  status
6697/tcp  open  irc     UnrealIRCd
8067/tcp  open  irc     UnrealIRCd
52118/tcp open  status  1 (RPC #100024)
65534/tcp open  irc     UnrealIRCd

Pwn

This is the index page of the web site

Trying to use gobuster to enumerate the directories can’t find anything useful, so we can move to search other exploits for the port 6697 and 8067 (irc).

searchsploit unrealircd

1
2
3
4
5
6
7
8
9
------------------------------------------------------------- ----------------------------------
 Exploit Title                                               |  Path
                                                             | (/opt/exploitdb/)
------------------------------------------------------------- ----------------------------------
UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit) | exploits/linux/remote/16922.rb
UnrealIRCd 3.2.8.1 - Local Configuration Stack Overflow      | exploits/windows/dos/18011.txt
UnrealIRCd 3.2.8.1 - Remote Downloader/Execute               | exploits/linux/remote/13853.pl
UnrealIRCd 3.x - Remote Denial of Service                    | exploits/windows/dos/27407.pl
------------------------------------------------------------- ----------------------------------

The one available on metasploit is the UnrealIRCd 3.2.8.1.

The exploit works and we get a shell.

The user flag is in the djmardov directory, but we can see the flag only if we are djmardov.
The word steg in the .backup file suggests us that djmardov uses some kind of steganography to encode his password.
Using steghide on the web’s image, and using as password : UPupDOWNdownLR1rBAbaSSss gives us the password for djmardov.

In the victim’s machine, we can login with

1
2
3
4
5
6
ircd@irked:/home/djmardov/Documents$ su - djmardov
djmardov@irked:~$ cd Documents
cd Documents
djmardov@irked:~/Documents$ cat user.txt
cat user.txt
4a66a78b12dc0e661a59d3f5c0267a8e

We can use the find command to see what files have the setuid permission set:

(4000 -> setuid),(2000 -> setgid),(1000 -> sticky bit).

The program that caught my attention is viewuser.

If we try to execute viewuser it gives us the following output

1
2
3
4
5
6
7
8
9
10
11
12
13
viewuser
This application is being devleoped to set and test user permissions
It is still being actively developed
(unknown) :0           2018-12-19 15:14 (:0)
djmardov pts/0        2018-12-19 15:15 (10.10.12.35)
djmardov pts/1        2018-12-19 15:15 (10.10.15.82)
djmardov pts/2        2018-12-19 15:15 (10.10.13.138)
djmardov pts/4        2018-12-19 15:16 (10.10.15.233)
djmardov pts/5        2018-12-19 15:16 (10.10.16.28)
djmardov pts/8        2018-12-19 15:17 (10.10.15.147)
djmardov pts/10       2018-12-19 15:22 (10.10.12.115)
djmardov pts/11       2018-12-19 15:23 (10.10.19.221)
sh: 1: /tmp/listusers: Permission denied

We can see that there’s some error on /tmp/listusers. If we go in the /tmp directory we can change the permission of the listusers file and the contents of it adding to the end’s file cat /root/root.txt or /bin/bash

And we get ROOT shell.