Cap — HackTheBox

Foothold

We start as usual with an Nmap scan

nmap 10.10.10.245
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-30 21:09 CEST
Nmap scan report for 10.10.10.245 (10.10.10.245)
Host is up (0.040s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 0.69 seconds

There are 3 services running on: FTP, SSH and HTTP

HTTP

The web application presents a panel with 4 different options. The third one is particoulary interesting, Security Snapshot (5 Second PCAP + Analysis)

The option shows up all the traffic which was done in the last 5 seconds. When we firstly ran it we had an url like /data/1. The requests seems to be enumerated by a number, maybe there was some request scanned before?

Get CTFMania’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

By searching for /data/0 page we discover a new pcap file done some time ago.

Inside the pcap file we discover the credential for nathan user, which we will be able to use both for SSH and FTP

nathan:Buck3tH4TF0RM3!

And here we are, we got a shell!

Privilege Escalation

Now we start linpeas to search for anything interesting, and se notice that /usr/bin/python3.8 binary is vulnerable to linux capability.

Searching on internet we find the way to exploit that vulnerability by simply running the SETUID capability to spawn a shell as user 0, then root

And now we have finally rooted the machine!