← Landing page Writeups home

Use the tree to jump between collections without leaving the reader.

archive Select writeup Open tree
HackTheBox/Maquinas/Machine Cap.en.md READ_ONLY

Machine Cap

This machine consists of exploiting an IDOR vulnerability on a website to obtain a network capture file and the solution consists of extracting credentials from the capture to gain initial access and then escalating privileges by abusing a capability on the Python binary.

Reconnaissance

  1. Identifying the operating system through ping Since the TTL is close to 64, the machine can be identified as Linux.

  2. Identifying open ports with Nmap First, perform a basic scan to identify the open ports on the target machine: Then run a more detailed scan of the open ports to find possible vulnerabilities, exporting the results to a file named targeted in Nmap format so it is easier to read.1 In this case, there is nothing especially relevant in that scan, so the next step is to inspect the website.

  3. Reviewing the website served on port 80 There is a dashboard, but at first glance nothing stands out except for the section called Security Snapshot (5 Second PCAP + Analysis): The URL contains a numeric identifier (in this case 2), so it is worth trying other numbers manually.

  4. Fuzzing the website In this case it can be done manually because there are not many values to try, so start with 0: This snapshot contains many more transmitted packets than the one shown by default, so it becomes interesting to download it. This reveals an IDOR that exposes data that should not be visible to a normal user.

  5. Analyzing the downloaded capture After reviewing the capture, sensitive data appears, apparently credentials, that can be tested for login access. In this case, the capture shows that port 21 was used:

Unprivileged access

  1. FTP login and first flag Try logging in through FTP with the credentials nathan/Buck3tH4TF0RM3!, which succeeds: List the contents and the first flag (user.txt) is found:

Privilege escalation

  1. SSH login and privilege escalation Even though there were no explicit SSH credentials, try the same ones discovered before and gain access to the machine: Once inside, search for special permissions and capabilities: The Python binary has the cap_setuid+ep capability, which can be used for privilege escalation: After exploiting it, a root shell is available:

  2. Root flag Once root access is obtained, move into the root user's directory and retrieve the flag:

Footnotes

  1. It is important to keep in mind that besides port 80, ports 21 and 22 are also open and may have to be used at some stage ↩