Cap writeup & walkthrough

Cap is an easy HackTheBox Linux machine exploiting an IDOR vulnerability in a network capture download endpoint to obtain FTP credentials, then abusing Linux capabilities for privilege escalation.

Cap - HTB Walkthrough

Access Path

no access => nathan => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Video: https://youtu.be/AuwYzh-vI_4

HTTP: bulk download

The /download/<id> endpoint serves other users' packet captures by ID with no access control (an IDOR). We loop over the IDs and grab them all; one capture contains FTP/SSH credentials in cleartext.

# downloads /download/-1 .. /download/100
for i in $(seq -1 100); do wget "http://10.10.10.245/download/$i"; done

FTP: connect to target

Reuse the sniffed credentials over FTP to confirm they are valid.

# replace $user and $IP
ftp $user@$IP

SSH: connect to target

The same credentials work over SSH, giving an interactive shell as the user.

# replace $user and $IP
ssh $user@$IP

Local: find files with capabilities

We enumerate file capabilities. Python carries cap_setuid, which lets us spawn a root shell for privilege escalation.

# recursive scan from root (suppress errors)
getcap -r / 2>/dev/null