TryHackMe UltraTech CTF WriteUp

📌 Hello Cybersecurity Enthusiasts

I am continuing with TryHackMe WriteUps. These write-ups are not just solution shares but also a source of encouragement for those at the beginning of their cybersecurity journey. Every step is a milestone in the endless journey of knowledge.

• 🗂️ Room Name: UltraTech (CTF)

• 📜 Description: The basics of Penetration Testing, Enumeration, Privilege Escalation and WebApp testing.

• 🔗 Room URL: https://tryhackme.com/room/ultratech1

• ⚡ Difficulty Level: Medium

• 🏹 Included in Paths: -

• 🔍 Specifically Tools Mentioned in Room: -

• 🛠️ Types of Tools Used in Room: Network Scanning Tools, Web Scanning Tools, Password Cracking Tools

• 🛠️ Tools Used in Room: nmap, ffuf, dirb, crackstation.net

• 🎯 Target System: Linux, Web

• 🏳️ Relevant Team: 🔴 Red

Task 1 — Deploy the machine

1.1 Deploy the machine

Answer: No answer needed

Task 2 — It’s enumeration time!

Let’s start with Enumeration. Let’s see what’s new with Nmap scan:

nmap -sV -sC -p- 10.10.51.138

We answer questions by examining the Nmap output.

2.1 Which software is using the port 8081?

We see that port 8081 is used by the “Node.js” framework.

Answer: Node.js

2.2 Which other non-standard port is used?

The port used outside of the normal ports is asked for, as well as the port used outside of the first 1024 common ports. This port is 31331.

Answer: 31331

2.3 Which software using this port??

We see that the software using port 31331 is Apache.

Answer: Apache

2.4 Which GNU/Linux distribution seems to be used?

It asks which GNU/Linux distribution is used. In the detailed information of port 31331, we see that the http-server-header value is associated with Ubuntu.

Answer: Ubuntu

2.5 The software using the port 8081 is a REST api, how many of its routes are used by the web application?

The question asks how many endpoints (routes) are used by the web application of the REST API running on port 8081. So let’s do some fuzzing with ffuf and see which endpoints (directories) we can go to after “http://10.10.51.138:8081/":

ffuf -u http://10.10.51.138:8081/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -mc 200

As seen in the output of our command, we can say that there are 2 endpoints: “auth” and “Auth”.

Note: Typically Windows web servers are case insensitive, whereas on Ubuntu or Unix/Linux web servers, like our current target, they are case sensitive and “Auth” and “auth” go to two different directories.

Answer: 2

Task 3 — Let the fun begin

3.1 There is a database lying around, what is its filename?

There should be a web service in response to the REST API service running on port 8081. This is most likely the service on port 31331 that we encountered in the Nmap scan. Now let’s go and see it in the browser:

We come across a website that is focused on financial markets. The question tells us about a database. Since we can’t get much information from the buttons on the website, let’s start a directory scan right away:

dirb http://10.10.51.138:31331 -w /usr/share/wordlists/dirb/common.txt

The output says; we found the css, images, javascript and js directories, there are also server-status and robots.txt files.

Let’s list the directories and look at the contents of the robots.txt file. Let’s start with robots.txt:

Let’s also read the /utech_sitemap.txt file in robots.txt:

Like Matryoshka. We found other files in the sitemap. Let’s examine them too:

We found a hidden login page in the partners.html file.

We try to log in with the test data and look at what’s going on in the Network tab with the browser’s Inspect feature:

Our conclusions:

• When we try to log in, we are directed to the http://10.10.51.138:8081/auth?login=USERNAME&password=PASSWORD endpoint. As we expected, the web service on port 31331 uses the API on port 8081.
• When wrong credentials are entered, it only returns the Invalid credentials response.

Since this information is insufficient, we examine the code of the page, but we cannot find anything there either.

The question we are trying to solve right now, if you recall, asks us about a database. In this case, we examine the files we find in the directory scan to see if we can find a clue.

And when we examine the /js/api.js file, we find important data.

Another endpoint!

The checkAPIStatus() function sends an HTTP GET request to see if the API is working, and the url variable creates a request like this:

http://10.10.51.138:8081/ping?ip=10.10.51.138

Now let’s try running it manually:

Does it sound familiar?

Yes, the page that opens in the browser shows us that this link runs the ping 10.10.51.138 command on the system.

This type of API endpoint can potentially be exploited in terms of security, because it directly takes the ip value as a parameter and processes it. We can try different attack techniques for such an endpoint.

http://10.10.51.138:8081/ping?ip=127.0.0.1 `id`

So, we can run the codes we want on the target. If we didn’t get the “Temporary failure in name resolution” error that we would constantly get, we could also get a reverse shell. So, we will run the commands here. So, let’s continue like this and proceed to a conclusion with the outputs we get:

http://10.10.51.138:8081/ping?ip=127.0.0.1%20`pwd` -->(pwd) --> /home/www/api
http://10.10.51.138:8081/ping?ip=127.0.0.1%20`ls` -->(ls) --> utech.db.sqlite

While browsing through the directory we were in, we found the database we were asked about in the question: utech.db.sqlite

Answer: utech.db.sqlite

3.2 What is the first user’s password hash?

Let’s continue with Command Injection and read the contents of the file:

http://10.10.51.138:8081/ping?ip=127.0.0.1%20`cat utech.db.sqlite`

Accordingly, there are two users:

• r00t (with hash: f357a0c52799563c7c7b76c1e7543a32)
• admin (with hash: 0d0ea5111e3c1def594c1684e3b9be84)

Answer: f357a0c52799563c7c7b76c1e7543a32

3.3 What is the password associated with this hash?

Now we need to find out which password the hash value “f357a0c52799563c7c7b76c1e7543a32” represents. Before dealing with complex operations, let’s try to see if we can easily reach the result on the Crack Station website:

Answer: n100906

Task 4 — The root of all evil

4.1 What are the first 9 characters of the root user’s private SSH key?

We found that the password of the user “r00t” is “n100906”. But we don’t know what the password is.

As far as we can remember from the Nmap scan, we have Web, SSH and FTP services. When we try it on the web, we don’t get a positive result:

Let’s try SSH:

ssh r00t@10.10.51.138

We enter our password as “n100906”:

Good!

Let’s go straight to the answer to the question. For this, we need to find the /root/.ssh/id_rsa file, but since we are not root and we are “r00t”, we do not have permission. Therefore, we will need to do privilege escalation.

Let’s try our options:

Sudo did not work when we tried to find the commands we are authorized with “sudo -l”:

We enter our command to find the SUID bits, but we get no results from that either.

Then, while preparing for another attempt, we encounter something interesting:

This is quite unusual. After a quick search on the internet, we see that it is possible to extract a shell from Docker. We immediately enter the necessary command for exploitation:

docker run -v /:/mnt --rm -it bash chroot /mnt sh

Great!

All that remains is to read the file we are looking for:

We will successfully complete this CTFi by entering the first 9 characters as an answer!

Answer: MIIEogIBA

I’ve not only tried to explain what works but also to highlight what doesn’t, providing detailed information to help beginners gain a better perspective. I hope it has been informative enough!

Best regards!

If you enjoyed this article and want to see more content like this, you can:

• 👏 Clap to show your support,

• 📰 Follow me for upcoming articles on AI security and ethical hacking, and

• 💬 Feel free to share your thoughts or ask about any issues you encountered in the comments — I’d be happy to hear your ideas!

Thank you for being part of this journey, and see you in the next one! 🌟