Hack The Box · Linux Machine
Cap
| Name | Cap |
|---|---|
| Release date | 05 Jun 2021 |
| Retire date | 02 Oct 2021 |
| OS | Linux |
| Difficulty | Easy - Retired [0] |
| Rated difficulty |  |
| Radar graph |  |
| Creator | InfoSecJack |
| Pentest Workshop PDF | Cap.pdf |
Enumeration
AutoRecon identifies FTP, SSH, and HTTP. The web interface generates packet captures under numbered /data/<id> paths. Changing the current capture from /data/1 to /data/0 exposes another user's traffic.
Credential recovery and access
Following the FTP stream reveals nathan:Buck3tH4TF0RM3!. The credentials work for FTP and SSH, and the FTP home directory contains user.txt.
ftp 10.10.10.245
ssh [email protected]Privilege escalation
Linux enumeration shows Python 3.8 with cap_setuid. Python can therefore set its effective UID to zero and launch a root shell.
/usr/bin/python3.8
import os
os.setuid(0)
os.system("/bin/bash")