Hackthebox.eu - Retired - Irked

Hackthebox.eu - Retired - Irked

Recon

As always I start with staged nmap scans. The first scan is a simple up/down scan on all tcp ports

# nmap -T4 -p- -oX /root/Desktop/HTB/irked/nmapb.xml 10.10.10.117

Then I convert it to HTML to make it pretty 

xsltproc /root/Desktop/HTB/irked/nmapb.xml -o /root/Desktop/HTB/irked/nmapb.html

We found the following TCP ports open to put in our next scan

22,80,111,6697,8067,56314,65534

Next we run with -A to finger the OS/Services

# nmap -T4 -A -p22,80,111,6697,8067,56314,65534 -oX /root/Desktop/HTB/irked/nmapf.xml 10.10.10.117

Then convert that to HTML also

 xsltproc /root/Desktop/HTB/irked/nmapf.xml -o /root/Desktop/HTB/irked/nmapf.html

Here is what we get when browsing to port 80

Dirb got me nothing except some default apache manuals…

I don't know what the unrealIRCd is

A quick google search

https://www.unrealircd.org/

Ok its an IRC 

Exploit

So a quick search on searchsploit I find 

Lets just fire up metasploit and see if its vulnerable

Will load up the module

Check the options

Set the rhost to match the target 

Tried to run, but no love… wait a minute that's not the right port. Ours is running on 6697

Let's change that

Well I guess it was vulnerable to that exploit

Let's poke around and see what we can find

Here i found I was able to access the djmardov directory. I dont' have permissions to read the user.txt..

But there is another file name .backup it says

Super elite steg backup pw

UPupDOWNdownLRlrBAbaSSss

Steg password huh? 

There are no pictures in the Pictures directory.

But there was one one the site on port 80 lets see if it has steganography in it.

Let's download it to our computer and see

First  I had to install steghide

Apt-get install steghide

It did find a file in the picture, let's see what it says

Kab6h+m+bbp2J:HG

Now I'm going to try to ssh as djmardov with this password

Cool it worked

Let's start by getting that user flag 

4a66******************

Now how about root…..

I transferred LinEnum.sh to the box to see what we might be able to use for escalation.

I found this file viewuser

Which runs as root, that we have access to

What does it do?

It runs a file in tmp called list users…… as root right? And we can write to tmp so this sounds promising

Let's make a listusers file and run it again.

To test our theory, i just made a file that does a whoami and reads the shadow file since my user doesn't have access to that file

#!/bin/bash

whoami

cat /etc/shadow

Cool it works

You can see the result here first outputs root as a result of the whomai

And then reads the /etc/shadow file

So let's modify again to grab the root.txt file again to get our hash

So  here are the results now when  I run viewuser

We  got our root hash

8d8*********************

But I really want root… like for real

I changed my listusers to dump the passwd and shadow file

djmardov@irked:/tmp$ cat listusers 

#!/bin/bash

echo "etc/passwd"

cat /etc/passwd

echo "ect/sahd"

cat /etc/shadow

I copied the output locally into a passwd and shadow file on my desktop

Used unshadow to combine the files to send over to John

unshadow ./passwd ./shadow  > john.irked.db

This might not work or might take forever. I'll update if I get the password….