Irked

Platform: HackTheBox | Difficulty: Easy | OS: Debian Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Irked (Debian, attack surface: 2-4 (RPC #100000) (111), Apache httpd 2.4.10 ((Debian)) (80), OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0) (22), UnrealIRCd (6697)). Foothold via the vulnerable entry point; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.10.117 --min-rate 1000 -Pn

Enumeration highlights

• Detected OS: Debian.
• Open services: http (80), irc (65534), irc (6697), irc (8067), rpcbind (111), ssh (22), status (55862).
• Scan used: nmap -p- -sVC 10.10.10.117 --min-rate 1000 -Pn.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.10.117 --min-rate 1000 -Pn
Starting Nmap 7.93 ( https://nmap.org ) at 2024-02-13 05:14 PST
Nmap scan report for irked.htb (10.10.10.117)
Host is up (0.19s latency).
Not shown: 65528 closed tcp ports (conn-refused)
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
| ssh-hostkey: 
|   1024 6a5df5bdcf8378b675319bdc79c5fdad (DSA)
|   2048 752e66bfb93cccf77e848a8bf0810233 (RSA)
|   256 c8a3a25e349ac49b9053f750bfea253b (ECDSA)
|_  256 8d1b43c7d01a4c05cf82edc10163a20c (ED25519)
80/tcp    open  http    Apache httpd 2.4.10 ((Debian))
|_http-title: Site doesn't have a title (text/html).
111/tcp   open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          47638/udp6  status
|   100024  1          53595/tcp6  status
|   100024  1          55178/udp   status
|_  100024  1          55862/tcp   status
6697/tcp  open  irc     UnrealIRCd
8067/tcp  open  irc     UnrealIRCd
55862/tcp open  status  1 (RPC #100024)
65534/tcp open  irc     UnrealIRCd
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 107.56 seconds

1. Based from the nmap results, the machine runs several service.
2. Http on port 80, ssh on port 22, interestingly irc on few IPs, and rpcbind on port 111.

NOTES:

RPC (Remote Procedure Call) is a protocol that one program can use to request a service from
a program located on another computer in a network.

1. Interesting, seems our focus should be at the IRC service.
2. Now let's find the IRC's version by running irssi to any port that runs irc service.

irssi -c irked.htb --port 6697

1. Great! Now we know the service version is --> Unreal3.2.8.1.

2. Searching on the internet about vuln for the related version found several results which leads to this.

3. It seems the service is vulnerable to backdoor command execution.

4. Let's search the module in metasploit.

5. It seems the remote port is already set to 6667 and we need to re-set it to one of the port which runs the irc service in our remote host.

6. Also we need to set the remote host, local host, and local port manually.

7. But it seems we need to specify the payload.

8. Let's list all the available payloads.

9. Payload number 6 seems promising.

RUN IT AGAIN.

1. Great we got a shell.

2. It seems we don't have the permission to access the user.txt file because it's created by root user, hence we need to gained root in order to see the contents.

3. But noticed there's a hidden file named .backup.

4. Based from the content, it should be related to steghide usage.

5. However, we need to find the correct file which should be the target now.

6. Remembering at the homepage of the webapp, it shows an image which states the hint for us to exploit the irc service.

7. Let's use steghide to that image. The image itself can be found inside /var/www/html.

8. Sadly the remote host does not have steghide, let's exfiltrate the image file to our localhost by setting up the python server at the remote host and run wget at our localhost.

9. Turns out it's the password, so user djmardov stored a backup password at his own home directory.

AUTH AS DJMARDOV

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

NOTES:

Noticed it said permission denied, does not mean user can't execute the binary (remembering users have "x").
It's because the **/tmp/listusers** does not have "x" permission for user role.

1. We gained root!

Root flag: REDACTED

Flags

Lessons Learned

1. Unreal3.2.8.1 is vulnerable to backdoor command execution.
2. Exploiting irc service for version Unreal3.2.8.1 using metaploit.
3. Identifying unknown SUID binary using linpeas.