✅Irked (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: Command Execution
System Vulnerable: 10.10.10.117
Vulnerability Explanation: The machine is vulnerable to Command execution which could allow us inject reverse shell and gain initial foothold on the machine.
Privilege Escalation Vulnerability: Misconfigure of SETUID.
Vulnerability Fix: Apply patch or upgrade the system.
Severity: High
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 80 Apache/2.4.10
First I will go through port 80, there is a simple webpage and the source code nothing interest.
Let start with Gobuster to find hidden directory.
Following through /manual directory we just see a apache 2.4.
Let just skip port 22 and port 111 due to we have less chance on these ports and move on to other port.
Port 6697, 8067, 65534 (IRC UnrealIRCd)
Let check if IRC is vulnerable or not.
We found it's vulnerable on service port 8067.
Exploitation
#1 Namp (8067)
Checking on the nmap script, we found that it's executed arbitrary command.
Let start our netcat listener on port 4444.
Then, execute the command reverse shell to our machine.
#2 Manual (6697)
Let search for public exploit of search UnrealIRCd.
Let examine on UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit)
Start netcat listener on port 4444.
Let connect to the port 6697 via netcat and execute netcat reverse shell.
Privilege Escalation
Shell as djmardov
As we are under user ircd, we don't have permission to read the flag under user djmardov.
Listing the files on directory Document, we found file .backup which contain interesting text.
Let start install tool Steghide is steganography program which hides bits of a data file in some of the least significant bits of another file in such a way that the existence of the data file is not visible and cannot be proven.
Let download the image file on the webpage that we found. Then, extract the hidden password in the image with the password in backup file.
Let try to ssh with user djmardov and password we just extracted. We're now in djmardov permission and we can read the user flag.
Shell as root
SUID viewuser
Now, let check for misconfigured on SetUID. Interesting one is /usr/bin/viewuser.
Let try to execute the /usr/bin/viewuser, and it shows error /tmp/listusers not found.
Let create create file name listusers in /tmp directory with bash command. Then, give executed permission to the file. Once, we executed, we are now root.
Last updated