Post cover image
Fig 2: Security Dashboard exposing the sequential object reference parameter index within the active browser navigation URL bar.

October 18, 2026

The Path to Exploiting IDOR and Broken Linux Capabilities: A Full Chain Review of HTB ‘Cap’

1. Introduction: Shifting from Flags to Portfolios

By Emmanuel Wiseman

5 min read

If you browse through the cybersecurity blogging space, you will find it saturated with standard Capture The Flag (CTF) write-ups (1:05). Typically, a practitioner gains initial access, grabs the cryptographic root flag, dumps a messy terminal log onto their site, and calls it a day and as i mentioned before the writeups are great just not at a professional standard (some of them). But as security educator Tadi from Navigating Security points out, raw CTF flags do not equal a professional penetration testing portfolio (0:40). In a commercial enterprise engagement, the final deliverable report is the absolute value asset the client pays for (1:18).

To break out of the script-kiddie pipeline, I built an automated markdown engine called Aeternum Sec inside my Arch Linux (Athena OS) VM to treat every single lab target like a high-paying corporate assessment from minute one. In this article, we are putting that framework to the test against the Hack The Box machine Cap to dissect a devastating, real-world attack chain spanning web parameter manipulation and native kernel execution privilege delegation.

2. (Reconnaissance)

An exhaustive network port sweep was executed from an unprivileged node inside the testing infrastructure to map out the target's exposed boundary interface:

sudo nmap -sC -sV -p- - min-rate 5000 10.129.84.194
Figure 1: Tactical output log showcasing explicit service signatures
 running on the target asset.

 PORT STATE SERVICE VERSION
 21/tcp open ftp vsftpd 3.0.3
 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux;
 protocol 2.0)
 80/tcp open http Gunicorn
 |_http-title: Security Dashboard
 |_http-server-header: gunicorn

3. Initial Access Vector: Exploiting the Web IDOR

As soon as you navigate to the web application layer on port 80, it maps to a custom security dashboard If you look at the sidebar and click on "Network Analysis", the URL changes and displays an index parameter format (e.g., [http://10.129.84](http://10.129.84`)).

### The Vulnerability Breakdown: What is an IDOR?

An Insecure Direct Object Reference (IDOR) occurs when a web application exposes a direct database reference or file path tag via user-supplied input numbers without verifying if the requesting session has authorization to read that specific asset.

None

To test this boundary, I tried to see if other numbers would work, manually manipulating the parameter to variables such as 25, 50, and 2, but to no avail. However, entering an index value of 0 was an absolute success. By requesting /data/0, the server blindly bypassed session verification bounds and fetched the absolute first historical packet log ever generated on the machine network interface. Exploitation was successfully made by downloading that raw 0.pcap file through the session and extracting clear-text authentication parameters natively from the unencrypted File Transfer Protocol (FTP) communication layer:

None 
```bash
# Command line input executed from Athena OS environment
strings evidence/capture_0.pcap | grep -E -i 'USER|PASS'

**Behind the command: what is strings?**

By default, a packet capture (.pcap) file cannot be read in its entirety; if you open it in a text editor it simply looks like damaged binary data. The strings program sorts through all that binary clutter and prints just the readable, human-normal words buried within it.
The pipe (|) symbol provides a direct link to hand over that text to the following command. At last, the grep filter instructs the terminal to show only the lines matching the terms USER and PASS and to neglect everything else on the network layer.

```go
```text
USER nathan
331 Please specify the password.
PASS Buck3tH4TF0RM3!

**4. Lateral Movement & Shell Establishment**

Now that the user Nathan has been found and his clear-text password which may be frequently reused across separate corporate assets, the harvested clear-text keys were used to target the exposed Secure Shell (SSH) gateway on Port 22:

<picture>
  <source media="(max-width: 768px)" srcset="/img/medium/700/1*DkUeCyyOfRLQOoe5KTBR_Q.png 1x">
  <source media="(min-width: 769px)" srcset="/img/medium/2000/1*DkUeCyyOfRLQOoe5KTBR_Q.png 1x">
  <img src="/img/medium/700/1*DkUeCyyOfRLQOoe5KTBR_Q.png" alt="None" width="1280" height="714" loading="lazy" data-zoom-src="/img/medium/4000/1*DkUeCyyOfRLQOoe5KTBR_Q.png" class="prose-image" data-caption="fig 4: Successful unencrypted credential harvesting from packet capture stream"/>
</picture>

• Result: Successful unprivileged shell initialization as user context nathan.
• Low-Privilege Objective Token: e5c4941a69be42072d0c7bbb5fbb82d2.

**5. Local privilege escalation to Root**

An audit of local file system structures was executed to uncover misconfiguration environmental variables or overly permissive binary capability sets:

```bash
# Auditing systemic Linux capabilities from user space
getcap -r / 2>/dev/null

Behind the Command: What is Getcap?

The getcap command represents Get Capabilities. It's a built-in Linux command utility that lets you ask and see what exact security rights a file has been granted. The -r option directs the program to automatically scan every subfolder and directory. The forward slash (/) directs it to check the entire hard drive system from a top-down manner starting at the root. Running into a slew of "Permission Denied" failures is upsetting as you are working as a low-privilege user. Including 2>/dev/null helps to send those systematic access obstacles to the shadow realm and guarantee that your screen only displays the favorable results. The kernel of the system sent a serious privilege delegation error running on the main layout:

None

The system kernel returned a critical privilege delegation oversight running on the core layout: /usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip

The Vulnerability Breakdown: Understanding Linux Capabilities

Linux is a strict privilege system — you either are given explicit permission or you are not (hence why we use commands like chmod). To prevent broad security vulnerabilities, modern Linux kernels use Capabilities to split up the massive, all-or-nothing powers of the root account into smaller pieces. The cap_setuid capability allows a specific binary to manipulate its running User ID context. When a programming interpreter such as Python is granted this power globally, it becomes highly dangerous. Because Python is an open coding framework that can run arbitrary strings, any local user can abuse it to force a system call to switch the active execution context to UID 0 (Root) and spawn a privileged shell right on top of it. By invoking the interpreter target, the process was manipulated and full administrative shell dominance was achieved:

None

• Result: Full administrative terminal shell takeover (root@cap). • Root Dominance Objective Token: eb9a2ad6e24b5904d04c0bdb1c725485.

6. Strategic Post-Exploitation Network Discovery

Amer successful root-level compromise, the kernel routing infrastructure was interrogated to map out potential pivoting lanes to adjacent targets within the lab environment:

root@cap:~# ip route show
default via 10.129.0.1 dev eth0
10.129.0.0/16 dev eth0 proto kernel scope link src 10.129.84.194

Internal checks show that the main device only sends traffic through a standard /16 laboratory interface using gateway 10.129.0.1. There are no hidden secondary network cards or separate isolated networks on this asset.

7. Comprehensive Remediation Matrix

Remediation workflows are prioritized based on technical risk exposure vs. implementation complexity. Breaking the exploit chain early minimi>

| Vulnerability Name | Operational Risk | Root Cause | Technical Mitigation |
| :--- | :--- | :--- | :--- |
| Insecure Direct Object Reference (IDOR) | High | Lack of object authorization validation checks on sequential data paths. | Implement robus>
| Privileged Python Capability Allocation | Critical | Excessive security capabilities assigned globally to binary file frameworks. | Restric>

8. Conclusion & Core Lessons Learned

The compromise of the Cap architecture highlights a critical lesson for defensive security teams: A chain is only as strong as its weakest link.

  1. Defense in depth matters a lot: The initial foothold wasn't through a zero-day exploit or some other vulnerability but more of a simple logical path manipulation that is (IDOR).
  2. Cleartext Protocols are a Liability: Legacy protocols like FTP that transmits user credentials over the network wire in plain text should be banned in modern enterprise structures, replaced by encrypted equivalents like SFTP.
  3. The Danger of Over-Privileged Binaries: Security controls like Linux Capabilities are designed to implement least-privilege principles, but if applied recklessly to open-ended code interpreters, they accidentally create trivial, un-loggable escalation pathways straight to root.
  4. strings, getcap, cap set_uid : New ways of thought on how to traverse a machine that saves time.

5. By switching my lab routine to focus on documentation-driven hacking: I didn't just grab a flag — I constructed an executive-vetted consulting deliverable that mirrors real-world security engineering.

Until next time, stay curious and keep your terminal in a state of flow.