Cap: Easy Level HackTheBox Linux Machine

Lab Link: https://app.hackthebox.com/machines/Cap

Overview: This machine is running a web application which is vulnerable to Insecure Direct Object Reference (IDOR) allowing to packet captures containing service credentials and these discovered credentials can be reused on another service to gain access to the machine as a normal user. Privilege Escalation to root user is obtained by exploiting Linux Capability

Scanning & Enumeration

Run nmap scan to find open ports on the machine and discover the services & their version running on the open ports

nmap Machine_IP -vvv

nmap Machine_IP -vvv

Now, perform versions scan on open ports using nmap

nmap -p21,80,22 -sV Machine_IP -o nmap.txt

nmap -p21,80,22 -sV Machine_IP -o nmap.txt

Web

Analyzing the web application for any possible vulnerabilities, at first just browse the website as a normal user to understand its functionality and to get know what it is build for

The application is a security dashboard for the defenders to monitor the network traffic on the system in order to spot a malicious network request and take appropriate action There are four different pages on this application:

• Dashboard: Stats for security events, failed login attempts, port scans
• Security Snapshot: Captures 5 seconds of network traffic on the system & allows the user on this web application to download the PCAP file for analyzing the captured traffic
• IP config: Network configuration on the system
• Network Status: Displays the active (listening & connected) network connections on the system

While analyzing the Security Snapshot page look at the URL of this page, which is having a specific numeric id

This could be vulnerable to insecure direct object reference (IDOR) if the application is provides different snapshot of the network traffic based on that numeric id to keep sensitive traffic only for authorized users/id, such as: network traffic containing credentials for specific service

The default id (2) does not contain any captured traffic then request for any other id such as: 3, 4, 1, 0 etc

PCAP file of different ids (3,4,1) results in containing some captured network traffic but on analyzing these traffic in packet capture tool such as WireShark, I found nothing sensitive traffic in these packet capture files

Normal network traffic:

Now, on requesting for numeric id 0 it contains some valid FTP credentials in plain text

Exploitation

As from the above nmap scan results target machine is running FTP service, so using these discovered credentials will successfully logs you in to the FTP service

There is nothing useful info on FTP service, lets reuse these credentials to log in to the SSH service running on the target machine

SSH gives access to the system as a normal user, you can view user.txt file in the home directory of this compromised user

Privilege Escalation

Normal user is only having limited access to the system or the access to the resources which this user owns, but to read the final flag (root.txt) or fully compromise the machine we need to access the root user which can be achieved by exploiting privilege escalation techniques

Run following command to list files/binaries having cap_setuid capability

getcap -r / 2>/dev/null | grep cap_setuid

getcap -r / 2>/dev/null | grep cap_setuid

What is Linux Capability?_ Linux capabilities are a way to assign specific privileges to processes_

What is cap_setuid capability? It allows a process to manipulate its User IDs (UIDs) arbitrarily

So, as the above python binary is having cap_setuid capability, it is possible to run any python process with the root user id, to exploit this run following command to get shell having UID set to the root user which is 0

python3.8 -c 'import os; os.setuid(0); os.execl("/bin/sh", "sh")'

python3.8 -c 'import os; os.setuid(0); os.execl("/bin/sh", "sh")'

Now, you can view the final flag root.txt

"If you enjoyed this, please leave a few claps to help others find it! more hacking content is on way follow me so you don't miss it"