Cap Write-up
Machine HTB Linux Easy
Cap is an easy difficulty Linux machine running an HTTP server that performs administrative functions including performing network captures. Improper controls result in Insecure Direct Object Reference (IDOR) giving access to another user’s capture. The capture contains plaintext credentials and can be used to gain foothold. A Linux capability is then leveraged to escalate to root.
🔍 Task 1 — How many TCP ports are open?
To determine the number of open TCP ports on the target system, a basic nmap scan was performed against the provided IP address.
For this particular machine, no advanced options were required, as the default scan was sufficient to enumerate the exposed services.
The scan revealed three open TCP ports:
- 21 — FTP
- 22 — SSH
- 80 — HTTP
This initial enumeration step provided a clear attack surface, indicating the presence of a file transfer service, remote access via SSH, and a web application hosted on port 80.
The answer is 3
🌐 Task 2 — After running a “Security Snapshot”, the browser is redirected to a path of the format
/[something]/[id], where[id]represents the id number of the scan. What is the[something]?
By navigating to the web service running on port 80 and accessing the Security Snapshot feature, it becomes evident that the application redirects users to a path in the format: /data/3
The answer is data
🔓 Task 3 — Are you able to get to other users’ scans?
Based on the previously identified URL structure (/data/[id]), the application may be vulnerable to Insecure Direct Object Reference (IDOR).
By manually modifying the numeric ID value in the URL, it is possible to access scan results that belong to other users. No additional authentication or authorization checks are enforced to restrict access to these resources.
Get AuraSec’s stories in your inbox
Join Medium for free to get updates from this writer.
The answer is yes
📁 Task 4 — What is the ID of the PCAP file that contains sensative data?
To determine which PCAP file contained sensitive information, multiple valid scan IDs were analyzed using Wireshark and it was discovered that PCAP ID 0 contained cleartext credentials belonging to the user nathan.
The answer is 0
📡 Task 5 — Which application layer protocol in the pcap file can the sensetive data be found in?
Analysis of the identified PCAP file revealed that the sensitive credentials were transmitted over the FTP (File Transfer Protocol). FTP operates in cleartext by default, and as a result, both the username and password of the user nathan were visible within the captured traffic.
The answer is ftp
🔐 Task 6 — We’ve managed to collect nathan’s FTP password. On what other service does this password work?
After successfully extracting Nathan’s FTP credentials, the same username and password combination was tested against another exposed service. An attempt to authenticate via SSH using these credentials was successful, confirming that the password was reused across multiple services on the target system.
The answer is ssh
🏴 User Flag — Submit the flag located in the nathan user’s home directory.
After successfully authenticating to the system via SSH using Nathan’s credentials, access to the user’s home directory was obtained. Within this directory, the user flag was located and retrieved.
It’s also possible to retrieve the file by issuing the get user.txt command over FTP.
The answer is 598<REDACTED>138
⚙️ Task 8 — What is the full path to the binary on this machine has special capabilities that can be abused to obtain root privileges?
During enumeration of Linux capabilities, a binary with elevated privileges was identified on the system using linPEAS.
The full path to the binary is /usr/bin/python3.8.
This binary has been assigned the cap_setuid capability, which allows it to change its effective user ID. By abusing this capability, it is possible to escalate privileges and obtain a root shell.
🚩 Root Flag — Submit the flag located in root’s home directory.
By running the following set of commands using Python 3.8, a privileged shell was spawned.
import os
os.setuid(0)
os.system("/bin/bash")
The answer is f28<REDACTED>a45
