HackTheBox: Cap (Easy, Linux)

1. Overview

Cap is an Easy-difficulty Linux machine that centers on three vulnerability classes: an insecure direct object reference (IDOR) in a web application, credential disclosure via an intercepted network capture, and privilege escalation through a misconfigured Linux capability. The following sections document the methodology used to obtain user and root access.

2. Enumeration

Enumeration began with a full TCP port scan, followed by a targeted service scan against the open ports.

nmap -p- --min-rate 5000 -T4 $TARGET
nmap -p 21,22,80 -sC -sV $TARGET

Three services were identified:

21/tcp — FTP
22/tcp — SSH
80/tcp — HTTP

The HTTP response headers identified the web server as gunicorn, a WSGI server used to run Python web applications. This indicated the target was most likely a Flask or Django application, which shaped the enumeration approach toward application-logic flaws — unsafe object references, debug endpoints, and template injection — rather than generic web server fuzzing.

The application itself presented as a network diagnostics dashboard, offering a "security snapshot" feature that generated and displayed packet captures. Each snapshot was retrieved by a numeric identifier in the URL path, for example /data/1.

3. IDOR Identification

The /data/<id> endpoint was tested for authorization enforcement, as nothing in the request tied the identifier to the authenticated session. Rather than testing individual values manually, the request was sent to Burp Suite's Intruder module with the identifier set as the payload position, and a range of integers was swept against the endpoint.

# Burp Intruder — payload position on the numeric ID
GET /data/§1§ HTTP/1.1
Host: $TARGET

Sorting the results by response status code showed every identifier in the tested range returning HTTP 200, confirming the absence of any authorization check on the resource. This established the IDOR and produced a complete set of accessible captures rather than a single sample.

4. Credential Disclosure via Packet Capture

One of the captures retrieved through the IDOR was a .pcap file belonging to another user. The file was opened in Wireshark and filtered to FTP traffic:

ftp

The capture contained a complete FTP authentication exchange in cleartext, disclosing the username nathan and an associated password. FTP transmits credentials without encryption, which is what made this interception possible. Given the common practice of credential reuse across services on the same host, the recovered credentials were tested against SSH.

ssh nathan@$TARGET

Authentication succeeded, establishing initial (user-level) access.

5. Privilege Escalation

Local enumeration was performed using linpeas, which identified a Linux capability assigned to the Python 3.8 interpreter rather than a traditional SUID permission bit.

getcap -r / 2>/dev/null
# /usr/bin/python3.8 = cap_setuid+ep

The cap_setuid+ep capability permits the binary to invoke setuid() and change its effective user ID — functionally equivalent to a SUID root binary, but granted through the Linux capabilities framework instead of the conventional permission bit. Because the Python interpreter can call os.setuid() directly, this was sufficient to escalate to root:

python3.8 -c 'import os; os.setuid(0); os.system("/bin/bash")'

This produced a root shell, completing the engagement.

Note: this was the first engagement where privilege escalation relied on a Linux capability rather than a SUID binary. Enumeration scripts such as linpeas surface these automatically, but running getcap -r / 2>/dev/null directly alongside standard SUID and sudo -l checks is worth doing on every box — capabilities grant equivalent control without touching the permission bits most privesc checklists default to.

6. Conclusion

Cap illustrates how a single access control flaw in a web application can cascade into full system compromise: the IDOR exposed a capture containing credentials that were valid for SSH, and a Linux capability misconfiguration provided a direct path from a low-privilege shell to root. From a defensive standpoint, this chain would have been broken by enforcing object-level authorization on the snapshot endpoint, avoiding cleartext protocols such as FTP for credentialed access, and auditing binaries for unnecessary capabilities in addition to SUID bits.