CAP 10.10.10.245
Background
CAP is a Linux base machine from HackTheBox that required your patient on web searching technique and using privilege escalation using SUID skills.
A statistic website, that saved user's network access records, was deployed. One of the records contained an FTP transaction history that stored the login id and password in cleartext. This credential can be used to access the target machine via ssh protocol.
After getting the initial access, using LinPEAS to search the possible privilege escalation loophole. Finally, it was found that the "Capabilities" of the python was the jump hole to the root access.
https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
130n@calvinlai.com
Target Machine: 10.10.10.245
Attacker Machine: 10.10.14.3
Hacking Process Part 0 – Service Scanning
Nmap
1) nmap -p- -T5 --min-rate=1000 10.10.10.245 -oG fkclai.nmap
2) nmap -p $(grep -Eo '[0-9]{1,5}/open' fkclai.nmap | cut -d '/' -f 1 | tr -s '\n' ',') -sC -sV 10.10.10.245 -o nmap-result.txt
Enumeration stratgies
No vulnerability was found on the HTTP server and SSH/FTP service according to the Nmap result. we can only focus on the following two enumeration 1) FTP/SSH 2) Web enumeration
Hacking Process Part 1 – Enumeration
FTP/SSH enumeration Nothing can be done other than the brute focus attack on the FTP and SSH port. However, the result is negative.
Web enumeration 1) Searching hidden subfolders
the following subfolders were found and a list of subfolders under the data directory was found.
http://10.10.10.245/data (CODE:302|SIZE:208)
http://10.10.10.245/ip (CODE:200|SIZE:17374)
http://10.10.10.245/netstat (CODE:200|SIZE:31079)
2) searching the website
When visiting the website found a download link that pointing to the pcap file. Download the firstpcap file fromhttp://cap.htb/data/18 No useful information was found after reading this file. Base on the result of folder enumeration above, an FTP login credential was found.
Hacking Process Part 2 – Gaining Foothold
Using the credential found at the pcap file, that can be successful ssh to the target machine and read the user.txt file.
After getting the initial access, the next step is to upload the linpeas.sh and start the PE scanning.
Hacking Process Part 3 – Privilege Escalation
Because of the project name "CAP", a finding related to the Capabilities is interesting to me. when the binary has the Linux CAP_SETUID capability set, it can be used as a backdoor to maintain privileged access by manipulating its own process UID.
After read several articles, the paper wrote by Raj Chandel provided a detailed explanation of how this capability can be gain the privilege escalation using the following command.
Conclusion
FTP is an insecure protocol that transfers data in plain text. It is the critical point that helps to gain the foothold. In addition, the user nathan received the privilege to run the python3 program as root is another security loophole.
The system admin should be aware of security loopholes during enabling system service and assigning such capability which can affect the integrity of the kernel that can lead to privilege escalation.
Reference
https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
Last updated
Was this helpful?