Cap - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐☆☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐☆☆☆☆
• CTF-like: ⭐⭐☆☆☆

Summary

Cap is an easy-difficulty Linux machine that demonstrates common web application vulnerabilities and Linux privilege escalation vectors. The box features a network security dashboard built with Gunicorn that allows users to capture network traffic. An Insecure Direct Object Reference (IDOR) vulnerability enables access to packet captures from other users, one of which contains plaintext FTP credentials. These credentials grant SSH access as user nathan. Privilege escalation is achieved by exploiting a misconfigured Linux capability on the Python binary, allowing arbitrary UID manipulation to gain root access.

TL;DR: IDOR on security dashboard (/data/0) → Extract FTP credentials from pcap → SSH as nathan → Exploit cap_setuid+eip on /usr/bin/python3.8 → Root shell

Reconnaissance

Port Scanning

# Initial port discovery
nmap -sC -sV -T4 -p- 10.10.10.245

Results:

The scan revealed three open ports:

• 21/tcp - FTP (vsftpd 3.0.3)
• 22/tcp - SSH (OpenSSH 8.2p1 Ubuntu)
• 80/tcp - HTTP (Gunicorn - Python WSGI HTTP Server)

Service Enumeration

FTP (Port 21)

The FTP service running vsftpd 3.0.3 does not allow anonymous access. Without credentials, this service is not immediately exploitable and requires valid authentication.

HTTP (Port 80)

The web service runs Gunicorn, a Python-based WSGI HTTP server. Browsing to the root page presents a “Security Dashboard” with several menu items:

• Security Snapshot (5 Second PCAP + Analysis) - Captures network traffic
• IP Config - Displays network interface configuration
• Network Status - Shows network statistics

The application appears to execute system commands (ifconfig, netstat) and display their output to the user, suggesting potential command injection vectors. More importantly, the Security Snapshot feature generates packet captures that can be downloaded for analysis.

Vulnerability Assessment

Primary Vulnerability Identified:

1. Insecure Direct Object Reference (IDOR) on packet capture download functionality
   • The application uses sequential numeric IDs in URLs (/data/<id>, /download/<id>)
   • No access control validation on capture file ownership
   • Allows horizontal privilege escalation to view other users’ data

Secondary Finding:

2. Information disclosure through packet captures containing plaintext credentials

Initial Foothold

Exploitation Path

Step 1: IDOR Discovery

When creating a new security snapshot through the web interface, the URL pattern follows a predictable scheme:

/data/<id>

The ID increments with each new capture. Testing access to lower ID values revealed that ID 0 was accessible:

# Download the first packet capture
curl http://10.10.10.245/download/0 -o capture_0.pcap

This is a classic Insecure Direct Object Reference (IDOR) vulnerability. The application fails to verify that the authenticated user owns the requested resource. IDOR vulnerabilities occur when:

1. An application exposes a direct reference to an internal object (file, database key, etc.)
2. No access control check validates the user’s permission to access that object
3. An attacker can modify the reference to access unauthorized data

Step 2: Packet Capture Analysis

Opening capture_0.pcap in Wireshark or analyzing with tcpdump revealed FTP traffic:

# Quick analysis with tcpdump
tcpdump -r capture_0.pcap -A | grep -i "USER\|PASS"

The FTP protocol transmits credentials in plaintext. The capture contained:

USER nathan
PASS Buck3tH4TF0RM3!

Why this works: FTP is an unencrypted protocol that sends all data, including authentication credentials, in cleartext. This makes it trivial to extract credentials from packet captures. Modern alternatives like SFTP or FTPS should be used to prevent this exposure.

Step 3: SSH Access

Testing the extracted credentials against the SSH service:

# Authenticate as nathan
ssh nathan@10.10.10.245
# Password: Buck3tH4TF0RM3!

The credentials were valid, granting shell access as user nathan.

# Verify user access
id
# uid=1001(nathan) gid=1001(nathan) groups=1001(nathan)

# Capture user flag
cat /home/nathan/user.txt
# <redacted>

Privilege Escalation

Linux Capabilities Exploitation

Step 1: Enumeration

Linux capabilities provide fine-grained privilege control, breaking down the all-or-nothing superuser model. Capabilities can be assigned to executables to grant specific privileged operations without full root access.

# Search for binaries with capabilities
getcap -r / 2>/dev/null

Output:

/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip

Analysis:

• cap_setuid+eip - Allows the process to manipulate process UIDs
• cap_net_bind_service+eip - Allows binding to privileged ports (< 1024)

The cap_setuid capability is particularly dangerous. It permits the Python binary to call setuid() system calls, effectively allowing privilege escalation to any UID, including UID 0 (root).

Why this is exploitable: The developer likely granted these capabilities to allow the web application to:

1. Capture network traffic (requires elevated privileges)
2. Bind to low-numbered ports without running as root

However, cap_setuid is overly permissive and enables complete privilege escalation.

Step 2: Exploitation

The cap_setuid capability can be abused to escalate privileges:

# Execute Python with capability-granted privileges
python3.8 -c 'import os; os.setuid(0); os.system("/bin/bash")'

Explanation of the exploit:

1. import os - Import the OS module for system calls
2. os.setuid(0) - Set the effective UID to 0 (root). Normally this requires root, but cap_setuid permits it
3. os.system("/bin/bash") - Spawn a bash shell that inherits UID 0

# Verify root access
id
# uid=0(root) gid=1001(nathan) groups=1001(nathan)

# Capture root flag
cat /root/root.txt
# <redacted>

Note: While the UID is 0, the GID remains that of the original user. This is sufficient for full system compromise, as UID 0 grants complete access regardless of group membership.

Attack Chain Summary

Port Scan (nmap) → Web Enumeration (Port 80 Gunicorn) → IDOR Discovery (/data/0) →
Download Packet Capture → Extract FTP Credentials (nathan:Buck3tH4TF0RM3!) →
SSH Access → Capability Enumeration (getcap) → Exploit cap_setuid on python3.8 → Root Shell

Tools Used

Key Learnings

Techniques Practiced

• IDOR (Insecure Direct Object Reference) vulnerability identification and exploitation
• Packet capture analysis for credential extraction
• Linux capabilities enumeration and abuse
• Privilege escalation through capability-based attacks

Lessons Learned

1. IDOR vulnerabilities are prevalent in web applications. Always test sequential identifiers (IDs, filenames, user numbers) for access control flaws. Developers must implement authorization checks that validate ownership, not just authentication.

2. Plaintext protocols expose sensitive data. FTP, Telnet, and HTTP transmit credentials in cleartext. Organizations should enforce encrypted alternatives (SFTP, SSH, HTTPS) and monitor for plaintext protocol usage.

3. Linux capabilities require careful assignment. While capabilities provide security benefits by limiting privilege escalation attack surface, overly permissive capabilities like cap_setuid can enable complete system compromise. The principle of least privilege must be strictly applied.

4. Defense in depth prevents single-point failures. This box demonstrates how multiple security weaknesses compound:

   • IDOR allowed unauthorized data access
   • Plaintext protocol exposed credentials
   • Excessive capabilities enabled privilege escalation

   Each layer could have prevented the attack chain if properly secured.

5. Packet captures are treasure troves for attackers. Any system that captures network traffic must implement strict access controls. PCAPs containing authentication traffic, API keys, or session tokens can completely compromise security.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>

References

• HackTheBox Official Writeup - Cap (Document No. D21.100.132) by MinatoTW
• Linux Capabilities Manual: man 7 capabilities
• GTFOBins - Python Capabilities: https://gtfobins.github.io/gtfobins/python/#capabilities