HTB CAP Machine

It’s a simple machine but can learn us useful information that may you never know

lets start:

first step is always i scan the target open ports by nmap and i found that ftp , ssh and http open poets then i tried to get ftp and ssh but i found that it needs a password.

so i decide to visit machine site as http service open and i able to visit a dashboard as user “nathan” and then i found a page that called “Security Snapshot (5 Second PCAP + Analysis)” so i visted it and i noticed that an id called in url for each different user “http://10.129.31.22/data/1”

so we can test an idor vulnerability in this page and try to request id 0 to see how the response will look like:

now i downloaded the file of 0.pcap and analyze it with wireshark tool:

i begin to show http requests and responses in this file but nothing interested till i found ftp call.

i used this password and try it with ssh service to take a shell and indeed i took a shell with user nathan:

now i’m in and can submit the first flag:

then i tried to be root with sudo command but i have told that nathan not in sudoers.

i start to search about capabilities as they write as a hint for us:

and there is an interested part which is /usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip

Get UnStoppable’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

so we can run python and use python commands and system to be root by changing our id as nathan to 0 which is root.

and i found that i can set user:

so in python i used an capability to set my id as root id which is 0:

so i become a root and go to root dir to get the flag: