A walkthrough of the TryHackMe UltraTech room — a grey-box style CTF focusing on enumeration, command injection, and Docker escape.
Task 1: Deploy the Machine
Start this room by hitting the “Deploy” button on the right. Once the machine is deployed, you will be assigned a vulnerable machine IP. It’s a grey-box style assessment — you only have the company’s name and the server’s IP address.
Task 2: It’s Enumeration Time
We begin with enumeration using Nmap. Below is the command used to scan all ports and detect service versions:
sudo nmap -Pn -n -sV -p- <target-ip>Questions & Answers
1. Which software is using port 8081?
Ans: Node.js
2. Which other non-standard port is used?
Ans: 31331
3. Which software is using this port?
Ans: Apache
4. Which GNU/Linux distribution seems to be used?
Ans: Ubuntu
5. The software using port 8081 is a REST API. How many of its routes are used by the web application?
Ans: 2
Task 3: Let the Fun Begin
We check both HTTP ports exposed in our scan.
Port 8081
Port 31331
We check robots.txt on port 31331 for any disallowed paths.
Inside partners.html, we find some JavaScript functionality.
We test if command injection is possible using ping.
Backticks in JavaScript evaluate commands. Using ls reveals the presence of a SQLite database file.
Filename: utech.db.sqlite
We use cat to read it and extract password hashes.
Hash cracking reveals user credentials.
2. What is the first user’s password hash?
Ans: f357a0c52799563c7c7b76c1e7543a32
3. What is the password associated with this hash?
Ans: n100906
We now have SSH credentials and access to the machine as r00t.
Task 4: The Root of All Evil
Once inside, we realize we are within a Docker container and need to escalate privileges to escape it and find the final flag.
We use a method from GTFOBins to escape Docker and spawn an interactive shell.
Finally, we locate the private SSH key of the root user.
What are the first 9 characters of the root user’s private SSH key?
Ans: MII******
Conclusion
This room offers a complete penetration test simulation with:
- Port & service enumeration
- Command injection via JavaScript
- Hash extraction and cracking
- Docker breakout and privilege escalation
An excellent practical exercise that highlights real-world exploitation scenarios from discovery to post-exploitation.