Cap
Foothold
Si mappa l’IP della macchina con l’hostname cap.htb nel file /etc/hosts.
Dopo aver lanciato una scansione TCP si ottiene
kali@0xPR3ST1JH0NN7:~$ sudo nmap -sV -vv -Pn -oN tcp.txt cap.htb
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-07 11:29 CET
NSE: Loaded 46 scripts for scanning.
Initiating SYN Stealth Scan at 11:29
Scanning cap.htb (10.10.10.245) [1000 ports]
Discovered open port 80/tcp on 10.10.10.245
Discovered open port 21/tcp on 10.10.10.245
Discovered open port 22/tcp on 10.10.10.245
Completed SYN Stealth Scan at 11:29, 1.75s elapsed (1000 total ports)
Initiating Service scan at 11:29
Scanning 3 services on cap.htb (10.10.10.245)
Stats: 0:00:08 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 66.67% done; ETC: 11:29 (0:00:04 remaining)
Completed Service scan at 11:31, 118.63s elapsed (3 services on 1 host)
NSE: Script scanning 10.10.10.245.
NSE: Starting runlevel 1 (of 2) scan.
Initiating NSE at 11:31
Completed NSE at 11:31, 15.12s elapsed
NSE: Starting runlevel 2 (of 2) scan.
Initiating NSE at 11:31
Completed NSE at 11:31, 1.21s elapsed
Nmap scan report for cap.htb (10.10.10.245)
Host is up, received user-set (0.12s latency).
Scanned at 2025-03-07 11:29:05 CET for 136s
Not shown: 997 closed tcp ports (reset)
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack ttl 63 vsftpd 3.0.3
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
80/tcp open http syn-ack ttl 63 gunicorn
Ci sono diversi servizi attivi sulla macchina tra cui: SSH, FTP e HTTP.
Il web server sulla porta 80 sembra essere un sito che permetta di effettuare il download di catture dei dati di rete.
Navigando nel sito nella sezione “Security Snapshot…” all’indirizzo http://cap.htb/data/NUMERO si ottiene la seguente schermata
Si può effettuare il download dei dati catturati cliccando sul bottone “Download”.
Visualizzando la richiesta su Burp Suite si ha
Richiesta
GET /download/6 HTTP/1.1
Host: cap.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://cap.htb/data/4
Upgrade-Insecure-Requests: 1
Priority: u=0, i
A questo punto si intuisce la presenza di una potenziale vulnerabilità Insecure Direct Object Reference (IDOR): enumerando gli identificativi numerici nel percorso “/download”, potrebbe essere possibile bypassare i controlli di accesso e scaricare file altrui catturati in precedenza.
Difatti, provando con /download/0, nell’output abbiamo la cattura dei dati di accesso ad un server FTP
Si accede in SSH con credenziali nathan:Buck3tH4TF0RM3! e si ottiene il foothold. Si cattura la flag user.txt.
Privilege Escalation
Lanciando lo script linpeas.sh sulla macchina nell’output esce qualcosa di interessante riguardo al file /usr/bin/python3.8
cap_setuid è una capability Linux che consente a un processo di modificare i propri UID (reale, effettivo e salvato). Se assegnata a un binario, il processo che ne deriva può cambiare il proprio user ID, fino a diventare root, senza necessitare del tradizionale bit setuid sul file.
Pertanto quello che ci serve è una payload da lanciare con python3.8 per cambiare lo UID a quello dell’utente root.
Cercando su https://gtfobins.github.io/gtfobins/python/ una payload per python troviamo la seguente
Abbiamo la payload ed eseguendola diventiamo root
Shell ottenuta! Si invia la flag root.txt.
Foothold
First we map the machine’s IP to the hostname cap.htb in the /etc/hosts file.
After running a TCP scan we get
kali@0xPR3ST1JH0NN7:~$ sudo nmap -sV -vv -Pn -oN tcp.txt cap.htb
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-07 11:29 CET
NSE: Loaded 46 scripts for scanning.
Initiating SYN Stealth Scan at 11:29
Scanning cap.htb (10.10.10.245) [1000 ports]
Discovered open port 80/tcp on 10.10.10.245
Discovered open port 21/tcp on 10.10.10.245
Discovered open port 22/tcp on 10.10.10.245
Completed SYN Stealth Scan at 11:29, 1.75s elapsed (1000 total ports)
Initiating Service scan at 11:29
Scanning 3 services on cap.htb (10.10.10.245)
Stats: 0:00:08 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 66.67% done; ETC: 11:29 (0:00:04 remaining)
Completed Service scan at 11:31, 118.63s elapsed (3 services on 1 host)
NSE: Script scanning 10.10.10.245.
NSE: Starting runlevel 1 (of 2) scan.
Initiating NSE at 11:31
Completed NSE at 11:31, 15.12s elapsed
NSE: Starting runlevel 2 (of 2) scan.
Initiating NSE at 11:31
Completed NSE at 11:31, 1.21s elapsed
Nmap scan report for cap.htb (10.10.10.245)
Host is up, received user-set (0.12s latency).
Scanned at 2025-03-07 11:29:05 CET for 136s
Not shown: 997 closed tcp ports (reset)
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack ttl 63 vsftpd 3.0.3
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
80/tcp open http syn-ack ttl 63 gunicorn
There are several services running on the machine, including SSH, FTP and HTTP.
The web server on port 80 appears to be a site that lets you download captures of network data.
Browsing the site in the “Security Snapshot…” section at http://cap.htb/data/NUMBER we get the following screen
You can download the captured data by clicking the “Download” button.
Looking at the request in Burp Suite we get
Request
GET /download/6 HTTP/1.1
Host: cap.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://cap.htb/data/4
Upgrade-Insecure-Requests: 1
Priority: u=0, i
At this point we suspect a potential Insecure Direct Object Reference (IDOR) vulnerability. By enumerating the numeric identifiers in the “/download” path, it might be possible to bypass the access controls and download other people’s files captured earlier.
In fact, by trying /download/0, in the output we have the capture of the login credentials for an FTP server
We log in via SSH with the credentials nathan:Buck3tH4TF0RM3! and obtain the foothold. We grab the user.txt flag.
Privilege Escalation
Running the linpeas.sh script on the machine, the output reveals something interesting about the /usr/bin/python3.8 file
cap_setuid is a Linux capability that allows a process to change its own UIDs (real, effective and saved). If it is assigned to a binary, the resulting process can change its own user ID, up to becoming root, without needing the traditional setuid bit on the file.
Therefore what we need is a payload to run with python3.8 in order to change the UID to that of the root user.
Searching on https://gtfobins.github.io/gtfobins/python/ for a python payload we find the following
We have the payload and by executing it we become root
Shell obtained! We submit the root.txt flag.