Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

UltraTech

The basics of Penetration Testing, Enumeration, Privilege Escalation and WebApp testing

Task 1: Deploy the machine

~_. UltraTech ._~

This room is inspired from real-life vulnerabilities and misconfigurations I encountered during security assessments.

If you get stuck at some point, take some time to keep enumerating.


[ Your Mission ]

You have been contracted by UltraTech to pentest their infrastructure.

It is a grey-box kind of assessment, the only information you have

is the company's name and their server's IP address.

Start this room by hitting the "deploy" button on the right!


Good luck and more importantly, have fun!

__

Lp1 <fenrir.pro>


[ Extra Information ]

If you have any comment or question regarding this room, you can contact me on TryHackMe's Discord.

Answer the questions below

  1. Deploy the machine

Task 2: It's enumeration time!

After enumerating the services and resources available on this machine, what did you discover?

Answer the questions below

  1. Which software is using the port 8081?

  2. Which other non-standard port is used?

  3. Which software using this port?

  4. Which GNU/Linux distribution seems to be used?

  5. The software using the port 8081 is a REST api, how many of its routes are used by the web application?

Task 3: Let the fun begin

Now that you know which services are available, it's time to exploit them!

Did you find somewhere you could try to login? Great!

Quick and dirty login implementations usually goes with poor data management.

There must be something you can do to explore this machine more thoroughly..

Answer the questions below

  1. There is a database lying around, what is its filename?

  2. What is the first user's password hash?

  3. What is the password associated with this hash?

Task 4: The root of all evil

Congrats if you've made it this far, you should be able to comfortably run commands on the server by now!

Now's the time for the final step!

You'll be on your own for this one, there is only one question and there might be more than a single way to reach your goal.

Mistakes were made, take advantage of it.

Answer the questions below

  1. What are the first 9 characters of the root user's private SSH key?
Room Icon

UltraTech

The basics of Penetration Testing, Enumeration, Privilege Escalation and WebApp testing

medium

75 min

38,142

User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off

~_. UltraTech ._~

This room is inspired from real-life vulnerabilities and misconfigurations I encountered during security assessments.

If you get stuck at some point, take some time to keep enumerating.


[ Your Mission ]

You have been contracted by UltraTech to pentest their infrastructure.

It is a grey-box kind of assessment, the only information you have

is the company's name and their server's IP address.

Start this room by hitting the "deploy" button on the right!


Good luck and more importantly, have fun!

__

Lp1 <fenrir.pro>


[ Extra Information ]

If you have any comment or question regarding this room, you can contact me on TryHackMe's Discord.

Answer the questions below

Deploy the machine

After enumerating the services and resources available on this machine, what did you discover?
Answer the questions below

Which software is using the port 8081?

Which other non-standard port is used?

Which software using this port?

Which GNU/Linux distribution seems to be used?

The software using the port 8081 is a REST api, how many of its routes are used by the web application?

Now that you know which services are available, it's time to exploit them!

Did you find somewhere you could try to login? Great!

Quick and dirty login implementations usually goes with poor data management.

There must be something you can do to explore this machine more thoroughly..

Answer the questions below
There is a database lying around, what is its filename?

What is the first user's password hash?

What is the password associated with this hash?

Congrats if you've made it this far, you should be able to comfortably run commands on the server by now!

Now's the time for the final step!

You'll be on your own for this one, there is only one question and there might be more than a single way to reach your goal.

Mistakes were made, take advantage of it.

Answer the questions below
What are the first 9 characters of the root user's private SSH key?