HTB Cap Walkthrough: From IDOR Exploitation to Root Access

Introduction

This blog post covers my experience solving the “Cap” machine on Hack The Box. It’s categorized as the first machine in the Intro to Red Team track. The challenge involves exploiting an IDOR vulnerability and leveraging Python capabilities for privilege escalation. Below, I’ll walk you through the steps I took to root the machine.

Step 1: Initial Scanning and Information Gathering

I began by running an nmap scan to identify open ports and services on the target machine. Here's the command I used:

export IP=10.10.10.245
sudo nmap -sC -sV -oN initial-scan $IP

The scan revealed the following open ports:

• 21/TCP (FTP) running vsftpd 3.0.3
• 22/TCP (SSH) running OpenSSH 8.2p1 on Ubuntu
• 80/TCP (HTTP) serving a web application powered by Gunicorn

Below is the screenshot of the nmap scan results for reference:

Initial scan showing open ports

Step 2: Analyzing the Web Application

Next, I accessed the web application hosted on port 80. Upon exploring, I noticed I was interacting as a user named “Nathan.” While navigating through the pages, I found a parameter in the URI (data). Experimenting with this parameter's value, I discovered that decreasing it revealed additional data. For example, setting it to 0 allow me to download a .pcap file.

Here’s a screenshot of the parameter manipulation in action:

Exploiting an IDOR vulnerability by changing the URI parameter

Step 3: PCAP File Analysis

The downloaded PCAP file contained network traffic logs. Using Wireshark, I analyzed the file and identified several protocols in use, including FTP. Since FTP transmits data in plaintext, I was able to extract Nathan’s credentials (USER: nathan and PASS: Buck3tH4TF0RM3!) by following the TCP stream.

Below is a screenshot of the Wireshark analysis showing the extracted credentials:

FTP credentials found by analyzing the PCAP file

Using these credentials, I successfully logged into the machine via SSH.

Step 4: Successful SSH Login

Using the credentials extracted from the PCAP file, I successfully logged into the machine via SSH. After logging in, I listed the contents of Nathan’s home directory to gather more information and identify potential files of interest.

Below is a screenshot of the successful login and directory listing:

Logging into the server using extracted credentials

Step 5: Privilege Escalation and Final Flag

After gaining SSH access as Nathan, I checked the user’s capabilities to identify any potential paths for privilege escalation. Using the following command:

getcap -r / 2>/dev/null

I discovered that Python 3.8 had elevated capabilities (cap_setuid and cap_net_bind_service). This allowed me to execute Python with root privileges.

Below is a screenshot of the capabilities check:

Checking Python’s elevated capabilities via getcap

By inspecting Nathan’s home directory, I found a few Python scripts that appeared relevant, including getfiles.py and getrootfiles.py. Below is a screenshot of the directory listing:

Finding Python scripts in Nathan’s home directory

The getfiles.py script allowed me to switch to the root user and list files in the /root directory. Below is the content of the script and its execution:

Reviewing the content of the getfiles.py script

Privilege escalation using getfiles.py

To access the final flag, I used the getrootfiles.py script, which was designed to read specific files as the root user. Below is the script's content and the execution process:

Reviewing the content of the getrootfiles.py script

Finally, I obtained the root.txt flag:

1de477fe588163f708e3eacf4edd932d

Below is the screenshot of the final flag extraction:

Extracting the flag using getrootfiles.py

Conclusion

The “Cap” machine provided an excellent opportunity to practice IDOR exploitation and privilege escalation using Linux capabilities. From initial enumeration to leveraging Python scripts for root access, this challenge demonstrated the importance of systematically analyzing and exploiting vulnerabilities.