Cap
About the machine
Cap is a fairly easy machine, first on the website, there's an IDOR (Insecure Direct Object Reference) vulnerability where it's possible to download other user's PCAPs, one of these PCAPs has credentials for FTP also valid for SSH. After getting a shell and discovering that python has a special capability, I abused it to get a shell as root.
Recon
nmap
Running nmap to scan all TCP ports, it found three ports open, 21 (FTP), 22 (SSH) and 80 (HTTP):
The HTTP banner tells it's gunicorn which indicates that a python application is running.
FTP - 21
Even if nmap didn't say anonymous login was enabled I tested it just for precaution, but it failed:
HTTP - 80
Accessing the IP on the browser it shows a dashboard:
On the sidebar the "Security Snapshot" page goes to /capture and then redirects to /data/<a number> allowing the download of a PCAP file:
The "IP Config" just shows the output of ipconfig:
And "Network Status" shows all network connections:
IDOR
Because /capture redirects to /data/<a number> I fuzzed this endpoint with a wordlist with numbers ranging from 0 to 100 testing for IDOR:
After fuzzing I found only one network capture besides the previous one, so I downloaded it and opened on wireshark.
PCAP analysis
Using wireshark to analyze the network traffic capture I found FTP traffic with credentials:
The credentials worked for FTP indeed and also for SSH:
Privilege escalation
capabilities
While enumerating the machine before running linpeas I found that the python binary has the cap_setuid:
This capability allows the change of the UID of a process before running it, so it was possible to set the UID of the process to 0 and then spawn a shell as root:
Another way to find about the capability would be reading the code of the web application, we can see the use of os.setuid(0) indicating that python can change its own UID:
References
Last updated
Was this helpful?