Cap

Here’s my first HackTheBox writeup “Cap”.

Starting off with an nmap scan;

I started by looking at the ftp port and noticed it doesn’t allow annonymous login so i need to find the credentials for ftp login. I visited the web page on port 80 & found an interesting webpage with so much info I also found so many files in /data Directory & after poking around i found an interesting file called 0.

So i downloaded the pcap file & analyzed with wireshark

Here we find some creds.

i tried to login ftp with it & it got me acess inside.

There i got access to other files including user.txt.

i discovered i could use the same creds to login with ssh

Now running Linpeas on target machine & i found /usr/bin/python3.8 with an intersting capability bit set

now looking at GTFObins i can run the command “ python3.8 -c ‘import os; os.setuid(0); os.system(“/bin/bash”)’ “ to get root!

REFRENCES

https://app.hackthebox.eu/machines/351

https://gtfobins.github.io/gtfobins/python/