# Cap

Hack-The-Box 13 / 72
2 min read
HTB Linux SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. FTP ⓘ File Transfer Protocol — frequently misconfigured with anonymous access, exposing sensitive files. Linux Capabilities ⓘ Granular Linux permissions; misassigned capabilities (e.g. cap_setuid) can lead to privilege escalation.
Table of Contents
⚔
Challenge Mode
Hide the solution and attempt the box yourself first
  • Machine Name: Cap
  • OS Type: Linux
  • Difficulty: Easy

About Info

Port Scanning - Service and version enumeration

Terminal window

Enumeration

Port 80/HTTP

we found Port 80 is open on target let’s brows the website on firefox

image.png

if we click on security snapshot button we can see that we’ve given with the page that has /data/1

and it is showing the captured data

image.png

when we click on download the pcap (packet capture) file downloads we can view it via wireshark

image.png

but we can see that the /data/ has refrrence of ID of the pcap files so i’ve tried change the id to 2 and i got another scan!!

image.png

D’you see that?? let’s try to get some other scans, i got 3.pcap but 4.pac redirect us to dashboard means 404! let’s try id 0; ;)

image.png

Hmm!! might interesting ;)

let’s open that up in wireshark

image.png

Bingo look who’s here! FTP is always fun with wireshark.

Terminal window
nathan:Buck3tH4TF0RM3!

use that password to login to SSH

image.png

and Bingo!!

Port 21/FTP

we’ve also obeserved that FTP port is open let’s try to check anonymous login

Terminal window
ftp 10.129.11.219
image.png

with nathan’s creds i’ve tried to do login in ftp

image.png

Nothing much interesting it’s nathan’s home dir.

Privilege Escalation

the name of the machine is cap so we assume that the capabilities is the possible way to privesc, let’s enumerate the capabilities of processes/utilities

Terminal window
getcap -r / 2>/dev/null

is used in Linux systems to recursively list file capabilities starting from the root directory.

image.png

https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/

we found that the python has cap_setuid, allows us to change the UID while running the program so we can change the UID to 0 (root) and spawn a shell

image.png

we ran below command to do so

Terminal window
/usr/bin/python3.8 -c 'import os;os.setuid(0);os.system("/bin/bash");'
image.png
Next: Cascade
My avatar

Thanks for reading my blog post! Feel free to check out my other posts or contact me via the social links in the footer.

Related Writeups

# Servmon

Hack-The-Box 60 / 72
5 min read

Windows Easy machine - Servmon.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows Linux SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. FTP ⓘ File Transfer Protocol — frequently misconfigured with anonymous access, exposing sensitive files. Brute Force ⓘ Systematically trying many credential combinations until one succeeds. Path Traversal ⓘ Using '../' sequences to escape a web app's intended directory and read arbitrary files.

# Broker

Hack-The-Box 3 / 72
3 min read

Linux Easy machine - Broker.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures).

# Analytics

Hack-The-Box 4 / 72
2 min read

Linux Easy machine - Analytics.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). Docker ⓘ A containerization platform — misconfigured sockets or escapes can lead to host compromise. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon.

# Access

Hack-The-Box 6 / 72
3 min read

Windows Easy machine - Access.

HTB Windows Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. GPO ⓘ Group Policy Object — a Windows domain-wide configuration mechanism, abusable for code execution across all machines. FTP ⓘ File Transfer Protocol — frequently misconfigured with anonymous access, exposing sensitive files. Telnet ⓘ An unencrypted remote login protocol — credentials and traffic are sent in cleartext.
Comments