TryHackMe|UltraTech WriteUp\Walkthrough (English)

 UltraTech

Room Link: https://tryhackme.com/r/room/ultratech1

=============================================================

• Sudo nmap IP -vv you will get 3 open ports from this scan 21,22,8081. Do another scan on all ports in the background then you will get port 31331 which is running an Apache webserver. Sudo nmap IP -A -p 21,22,8081,31331 -vv to answer the task 2 questions. You can get the version of the system from the SSH version result in the Nmap scan. Then the answer to question 5 is 2, tell now I don’t know exactly why, but maybe it is because this port has two folders, we got from a gobuster scan.

• Since you are working with a target that has a web application, it is better to start Burpsuite to capture all the requests from your device to the server. To prevent being overwhelmed with the amount of captured traffic take your target IP and add it to the target scope and then go to proxy settings and choose that the intercepted requests are in the scope.

• gobuster dir -w /usr/share/dirb/wordlists/common.txt -u http://IP:8081/ -r this scan gave us the /auth and /ping folders. /auth folder doesn’t have anything interesting. But what interesting is that when you look at the target in http history at burpsuite you will notice that it makes a ping request every 10 seconds, and you can verify that by visiting http://IP:8081/ping?ip=IP.

"This photo is not mine, because I couldn't get the ping requests no matter how much I waited, so this picture is for explaining purposes only, and if you didn't get the requests on burp like me, don't worry:), you can solve the challenge" 

Indeed it shows the result of ping command. You can use this to execute another command with ping by adding %0A to the end of the url like so: http://IP:8081/ping?ip=IP%0Als, if you sent this request it will list the contents of the current directory. There is a file called utech.db.sqlite. it might have interesting info, you can view its contents by http://IP:8081/ping?ip=IP%0Acat+utech.db.sqlite . This file contains the hashes for two users r00t and admin.

• To crack these hashes, we need to identify them first using the hash-identifier command.

The first hash is MD5 same for the other. To crack these hashes use https://md5hashing.net/ the r00t password is ******* and the admin’s is ********. Just from the names we will assume that r00t is a user on the server, and we will use ssh to sign in with it.

• Now go to port 31331 to look around and click on every link possible to see if you can find anything. At last, nothing is interesting in the pages. So, use gobuster to search for any interesting directories. gobuster dir -w /usr/share/dirb/wordlists/common.txt -u http://IP:31331/ -r . The results gave you robots.txt.

Go to /utech_sitemap.txt

Examine one by one. The /partners.html page has a login forum. Use the credentials admin:******** to login. It shows a message to user r00t and there is not much about it.

• Now move to ssh and login as r00t. look through the different folders on the system. There is nothing interesting. In task 4 it wants from you to give the first 9 characters of the root’s ssh private key, which is in the root’s home directory /root under the .ssh hidden directory. So we need to escalate our privileges.

• Download the linpeas.sh script in the /tmp directory of the victim machine then run it to find any point for privilege escalation.

If you see the user r00t is a part of docker group. It is written in red and highlighted in yellow. Which means it has 95% in privilege escalation.

•  To exploit this go to https://gtfobins.github.io/ and search for docker.

Use this command to get a root shell. You will get an error telling you that there is no image alpine.

To find the local images run docker image list.

Then just replace the alpine in the first command to 495d6437fc1e. docker run -v /:/mnt --rm -it 495d6437fc1e chroot /mnt sh then you will get a bourne root shell. /bin/bash -i then cd /root >> cd .ssh then cat the contents of id_rsa and copy the first 9 characters of the private key, this why you are done with the challenge ✨.