Irked
UnrealIRCd Backdoor exploitation - Custom binary manipulation PrivEsc
Scanning
Starting off with the nmap scan
Enumeration
Ports 22 and 111 running OpenSSH 6.7p1 and rpcbind 2–4 don’t look promising
Ports 6697, 8067 & 65534 are running UnrealIRCd - A version of this service was vulnerable to a backdoor command execution
Port 8067 is vulnerable!
Initial Foothold
and we get a reverse shell on our listener !
Privilege Escalation
Running the binary gives us an error message
The script is searching /tmp/listusers
, we can easily manipulate the script by invoking bash as the /tmp/listusers
Last updated