🔗 [Cap](https://www.hackthebox.com/machines/cap)
About
### Machine Description
Cap is an easy difficulty Linux machine running an HTTP server that performs administrative functions including performing network captures. Improper controls result in Insecure Direct Object Reference (IDOR) giving access to another user's capture. The capture contains plaintext credentials and can be used to gain foothold. A Linux capability is then leveraged to escalate to root.
### Area of Interest
Vulnerability Assessment | Common Security Controls | Security Operations | Log Analysis
### Vulnerabilities
Clear Text Credentials | File System Configuration | Insecure Direct Object Reference (IDOR)
### Security Tools
Nmap | LinPEAS | Wireshark
### Languages
Python
### Techniques
Packet Capture Analysis | Password Reuse | SUID Exploitation
## Task 0 - Deploy machine
🎯 Target IP: `10.10.10.245`
Create a directory on the Desktop with the machine's name, and inside this directory, create another directory to store the materials and outputs needed to run the machine, including the scans made with nmap.
## Task 1 - Reconnaissance
su
echo "10.10.10.245 cap.htb" >> /etc/hosts
mkdir -p htb/cap.htb
cd htb/cap.htb
mkdir {nmap,content,exploits,scripts}
# At the end of the room
# To clean up the last line from the /etc/hosts file
sed -i '$ d' /etc/hosts
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
```bash
ping -c 3 cap.htb
PING cap.htb (10.10.10.245) 56(84) bytes of data.
64 bytes from cap.htb (10.10.10.245): icmp_seq=6 ttl=63 time=77.8 ms
64 bytes from cap.htb (10.10.10.245): icmp_seq=9 ttl=63 time=80.1 ms
64 bytes from cap.htb (10.10.10.245): icmp_seq=11 ttl=63 time=51.5 ms
```
Sending these three ICMP packets, we see that the Time To Live (TTL) is \~64 secs. this indicates that the target should be a **\*nix** system, while Windows systems usually have a TTL of 128 secs.
### 1.1 - How many TCP ports are open?
Let's start right away with an active port scan with nmap
```bash
sudo nmap -p0- -sS -Pn -T4 -vvv cap.htb -oN nmap/tcp_port_scan
```
```bash
PORT STATE SERVICE REASON
21/tcp open ftp syn-ack ttl 63
22/tcp open ssh syn-ack ttl 63
80/tcp open http syn-ack ttl 63
```
command
result
sT
TCP connect port scan (Default without root privilege)
sC
Run default scripts
sV
Enumerate versions
vvv
Verbosity
T4
Run a bit faster
oN
Output to file with nmap formatting
It looks like there are 3 open TCP ports on the machine: 21, 22, 80.
{% hint style="info" %}
3
{% endhint %}
Then, we can proceed to analyze services active on open ports:
```bash
sudo nmap -sV -sC -p 21,22,80 cap.htb -oN nmap/service_port_scan
```
```bash
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 fa:80:a9:b2:ca:3b:88:69:a4:28:9e:39:0d:27:d5:75 (RSA)
| 256 96:d8:f8:e3:e8:f7:71:36:c5:49:d5:9d:b6:a4:c9:0c (ECDSA)
|_ 256 3f:d0:ff:91:eb:3b:f6:e1:9f:2e:8d:de:b3:de:b2:18 (ED25519)
80/tcp open http gunicorn
|_http-server-header: gunicorn
|_http-title: Security Dashboard
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.0 404 NOT FOUND
| Server: gunicorn
| Date: Thu, 02 Jan 2025 11:42:26 GMT
| Connection: close
| Content-Type: text/html; charset=utf-8
| Content-Length: 232
|
| 404 Not Found
|
Not Found
|
The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.