Hack The Box: Cap Writeup
Machine Name: Cap
Difficulty: Easy
OS: Linux
Machine Overview
Cap is an easy difficulty Linux machine running an HTTP server that performs administrative functions including performing network captures. Improper controls result in Insecure Direct Object Reference (IDOR) giving access to another user’s capture. The capture contains plaintext credentials and can be used to gain foothold. A Linux capability is then leveraged to escalate to root.
1. Reconnaissance & Enumeration
Start by scanning the target host with nmap to discover open ports and running services:
The scan reveals three active services:
- Port 21: FTP (
vsftpd 3.0.3) - Port 22: SSH (
OpenSSH 8.2p1) - Port 80: HTTP (
Gunicorn / Python web application)
2. Web Exploration & IDOR Vulnerability
Navigating to the web interface on port 80 reveals an administrative dashboard featuring network diagnostics and a “Security Snapshot” feature.
Inspecting the URL structure suggests potential Insecure Direct Object Reference (IDOR) vulnerability.
Testing sequential IDs by modifying the path to /data/0 grants access to the earliest capture log recorded by the system.
3. Traffic Analysis with Wireshark
Open the downloaded capture file in Wireshark:
Inspect overall traffic via Statistics → Protocol Hierarchy.
- A notable amount of unencrypted FTP traffic is present.
Apply an FTP display filter:
Follow the TCP stream or inspect the USER and PASS packets directly.
Get CyberExplorer’s stories in your inbox
Join Medium for free to get updates from this writer.
Plaintext credentials leaked in the stream:
- Username:
nathan - Password:
Buck3tH4TF0RM3!
4. Initial Access (User Flag)
With these credentials, authenticate via FTP to inspect accessible files:
Listing directory contents confirms the presence of user.txt. Retrieve it to the local machine:
ftp> ls -la
ftp> get user.txt
ftp> exit
the flag is downloaded, we can use cat command to see it
Alternatively, establish an interactive SSH session as nathan:
5. Privilege Escalation (Root Flag)
Once authenticated via SSH, enumerate system binaries and permissions. Inspecting Linux capabilities assigned to executables reveals an insecure permission:
input: getcap -r / 2>/dev/null
Output : /usr/bin/python3.8 = cap_setuid,cap_net_admin+eip
The cap_setuid capability allows the binary to change its effective User ID (UID) without requiring full root/sudo privileges.
Exploit this by executing Python to set the process UID to 0 (root) and spawn a privileged shell:
python3 -c ‘import os; os.setuid(0); os.system(“/bin/bash”)’
we can find our next flag here in the root/root.txt file
