Cap
Linux box on HTB.
Enumeration:
Port Scanning:
As always we are going to start with scaning the machine to find open ports via nmap:
We have only 3 open ports, ftp on port 21, ssh on port 22, and http on port 80.
Since nmap did not indicate that anonymous login is enabled we will overlook it.
HTTP (80):
Lets start by take a look at the website, and see how it functions:
We are logged in with no reason as nathan. Also this dashboard page is a static one.
Also static pages, with system commands being executed in the underlying operating system, and the result printed out to us, without any parameters we can send to try to manipulate it to get command execution.
Here we have some sort of packets which we can download, and in the url it referes to data id 1, so we can also try others like 0, or 2.
We have something under 0 as well, but nothing further after 1.
I downloaded both files, lets inspect them to find anything useful to us.
Wireshark:
1.pcap:
It has nothing, only html pages intercepted.
0.pcap:
Open up the file with wireshark:
Lets find what protocol do we have in this packet from within protocol hirarchy:
Interestingly we have ftp data being captured, and as we all know ftp is not a secure option to use, and we can use other options to mitigate interceptions like sftp, etc.
Right-click follow stream on an ftp packet:
FTP (21):
Lets authenticate to ftp with those credentials:
We can see it is mirroring the underlying machine, and we can access system files.
Lets try whether those credentials were reused with ssh:
Indeed we have access.
SSH (22):
SSH to the server:
Post-Exploitation:
Do some local enumeration:
We can not execute commands with sudo as nathan:
Lets find out what suid binaries we have:
None could help.
We can notice the name of the machine cap, maybe this is a hint to capabilities:
Here we have python with file capabilities enabled, that allows python to change its uid, therefor can allow any user to escalate his privileges.
We can search online for python commands, or from gtfobins as always:
Execute that command:
We are root.
Get the flags:
Last updated