UltraTech — TryhackMe Walkthrough(A live walkthrough)

Let’s gooo…

It’s gonna be a Pentesting Challenge, we are gonna perform our pentesting skills in the Ultratech company, all we have is the company’s name and their server’s IP address. It’s gonna be like the reader(YOU) and I(Tubelight) are gonna solve this room together.

So first we can do the basic port scanning..,

While performing the usual nmap scan, it takes a longer time.,

So i performed the nmap scan for only the 8081 port as per the question asked(Also ran the nmap scan for the entire port in the background)..,

nmap -sV -p8081 <target-ip>

From here you can see the version that is running the port 8081.

So next we can find which linux distribution is running on the target site by the nmap scan with the flag of OS detection.

nmap -sV — osscan-guess <target-ip>

The nmap scan took a much time, so decided to shift to the modern day port scanning tool, the rustscan.

Installed the rustscan from the git and found the open ports in few seconds.

~wget https: //github.com/RustScan/RustScan/ releases/download/2.2.3/rustscan_2.2.3_amd64.deb ~sudo dpkg -i rustscan_2.2.3_amd64.deb

To find the software that is used in the port 31331, we can make use of nmap again and find the software used.

nmap -sV -p31331 <target-ip>

And finally to have to find the number of routes/endpoints of the target sites 8081 port have. To find that we can use the dirb tool. At first i thought that the routes mean a different one and tried the nmap scan with the — script-route, but then after understanding the question properly, understood that the routes and endpoints are the same. The 8081 port uses the REST api and the question asks the number of routes these are connected so that the web application can talk eachother.

Here the dirb will find all the endpoints, from that we can filter which are used by the web application by a common.txt. Anyway both these are just a guesses, in real life we have to dig more.

So finally the answers for the Enumeration part: Which software is using the port 8081? → node.js

Which other non-standard port is used? →31331

Which software using this port? →apache

Which GNU/Linux distribution seems to be used? →Ubuntu

The software using the port 8081 is a REST api, how many of its routes are used by the web application? →2

For the futher proceedings we can use the dirb tool to do a directory search on the 8081 port. From the enumeration part we have done it already and let’s explore these endpoints for any exploits.

But nothing can be found and got strucked….

Then again searched started from the enumeration part and thought of another port that was open(31331) and performed the directory search over there..,

From here i found the robots.txt as the interesting part(a traditional way of CTF’s) and found the directory info’s…,

A important clue from this robots.txt .., while exploring the inspect tab of the partners.html, it seems like the credentials that is entered is redirected to the 8081 port.

Then i tried the SQLi attack at the redirected port of 8081, but resulted in failure after a lots of try.

Then decided to work with another endpoint that was found at 8081 port, that is /ping. That directory name was a bit intriguing and tried for code injection over there and it worked🎉

• The page name is /ping.
• In networking, a “ping” is a tool used to check if a computer is online by sending a signal to an IP address.
• To make a ping tool work, the server must ask you for an IP address. Because you didn’t give it one (your URL ends exactly at /ping), the variable for the IP address was empty (undefined).

So next i used my ip in the code injection and got the database name and the hash file.

Backticks(`) are used not the (‘)

ip=ls

ip=cat utech.db.sqlite

user names are r00t and admin, and also the password hashes are given. We can use the hashstation to crack them.

So finally we got access to the system..,

We can login using the SSH server using the credentials we got from the code injection in 8081 port of the /ping directory.

We can see that we don’t have the sudo access to gain privelege we can first try sudo -l..,

sudo -l

But we can’t find any clue, so let’s dive deeper.

We can search for any files that has the SUID bit set. If a files SUID bit is set then we can perform privelege users action from the normal users login.

find / -perm -4000 2>/dev/null

Out of these the /usr/share/pkexec has a vulnerability and it can be exploited.

But we can make it even more simpler, when i first executed the id command i found docker one..,

Belonging to the docker group on Linux is a massive privilege escalation vector.

So by searching the docker in the GTFObins we can find the exploit.

When we run that command we got an error..,

It says that the alpine is not found, so by searchin for docker images we can find the docker image and then we can replace it with the alpine.

We found the image named bash so the command will be ..,

docker run -v /:/mnt — rm -it bash chroot /mnt /bin/sh

And there we go we got the root access 🎉🎉🎉🎉🎉

— Tamil Arasan S