Cap

#Linux #Enumeration #Wireshark #IDOR #Capabilities

Cap is an easy-rated Linux machine from HackTheBox created by InfoSecJack. In the current post, my IP is 10.10.14.59, and the target’s IP is 10.129.252.36.

This machine runs an HTTP server with an open site with downloadable files with captured non-encrypted traffic. The improper control of this information results in Insecure Direct Object Reference (IDOR) by just changing a parameter at the URL, giving access to another user's capture with credentials inside. Then, for Privilege Scalation, there is an exploitable Linux capability.

Gathering Information

First, we are going to start with checking if the machine is alive, then do the classic reconnaissance to get some general information about the target.

Local Terminal
$ ping 10.129.252.36

Pinging 10.129.252.36 with 32 bytes of data:
Reply from 10.129.252.36: bytes=32 time=488ms TTL=63
Reply from 10.129.252.36: bytes=32 time=149ms TTL=63
Reply from 10.129.252.36: bytes=32 time=150ms TTL=63
Reply from 10.129.252.36: bytes=32 time=159ms TTL=63

Ping statistics for 10.129.252.36:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 149ms, Maximum = 488ms, Average = 236ms

The target machine is working, and by the TTL we can assume that is a Linux Machine.

Local Terminal
$ nmap -p- --open -sS --min-rate 5000 -vvv -n 10.129.252.36 -oN Ports

Nmap scan report for 10.129.252.36
Host is up, received echo-reply ttl 63 (0.27s latency).
Scanned at 2023-05-22 15:24:10 Pacific SA Standard Time for 18s
Not shown: 65532 closed tcp ports (reset)
PORT   STATE SERVICE REASON
21/tcp open  ftp     syn-ack ttl 63
22/tcp open  ssh     syn-ack ttl 63
80/tcp open  http    syn-ack ttl 63

Read data files from: C:\Program Files (x86)\Nmap
Nmap done: 1 IP address (1 host up) scanned in 18.28 seconds
           Raw packets sent: 87205 (3.837MB) | Rcvd: 85813 (3.433MB)

Ubuntu and http with gunicorn server, information worth to save.

Now that we have the basic information, we have to try with the generic tests, first with the FTP port

  • Browser: http://10.129.252.36

Home
By hovering, those links are useless

Security Snapshot looks like an interesting site, you will be at http://10.129.252.36/data/1, there you can download a pcap file to analyze with Wireshark or other tool.

I assume that in the file should be information about the FTP server, that filter will be applied.

There is nothing here, but that site in particular is giving us a lot of information, a good option is to change the parameter of the URL and analyze the new file.

And we found credentials in that file, now we should be able to connect to the FTP server {user: nathan // password: Buck3tH4TF0RM3!}

Inside the FTP there was only a file called user.txt, has the name of the flag, but by the location looks like a fake flag.

By bad, it was the flag... that's nice. So we got the flag without properly exploiting something.

Privileges Escalation?

Well, we have some credentials, what if we use then at the SSH too?

It works!

Python3.8 have capabilities, with this we can change to root easily

PreviousBastionNextExplore

Last updated