Write-Up: CAP Machine Walkthrough Practice OSP/CEH

Introduction

The CAP machine is an easy Linux-based challenge focused on web enumeration, packet analysis, and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities. This walkthrough demonstrates how improper controls can expose sensitive data and explores how Linux capabilities can be exploited for privilege escalation.

Skills Required

• Web enumeration
• Packet capture analysis

Skills Learned

• Understanding and exploiting IDOR
• Leveraging Linux capabilities for privilege escalation

Step 1: Enumeration with Nmap

We begin by scanning all TCP ports on the target machine (10.10.10.245) to identify open services. Here’s the command used:

ports=$(nmap -p- --min-rate=1000 -Pn -T4 10.10.10.245 | grep '^[0-9]' | cut -d'/' -f1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -Pn -sC -sV 10.10.10.245

Result: Three open ports

• 21: FTP
• 22: SSH
• 80: HTTP
  

Step 2: FTP Enumeration

We tested FTP for anonymous access, but it was disabled. So, we moved on to exploring the HTTP service.

Step 3: HTTP Service Exploration

Port 80 is running Gunicorn, a Python-based HTTP server. The website displayed a dashboard with system and network information, hinting at system commands being executed in the backend.

• IP Config page: Displays ifconfig output.
• Network Status page: Displays netstat output.

Clicking on the Security Snapshot menu item pauses the page for a few seconds and returns a downloadable packet capture file.

Step 4: Exploiting IDOR

While browsing, we noticed the application generating packet captures at /data/<id> with incremental IDs. By manually navigating to /data/0, we accessed a previous user’s capture file.

This vulnerability is known as Insecure Direct Object Reference (IDOR), where insufficient access controls allow users to access others’ data.

Step 5: Foothold

Downloading and analyzing the packet capture with Wireshark revealed FTP credentials transmitted in plaintext:

Username: nathan
Password: Buck3tH4TF0RM3!

These credentials worked for both FTP and SSH. We used SSH to gain access.

python -m http.server

Step 6: Privilege Escalation

Using the linPEAS script, we identified an unusual Linux capability set on /usr/bin/python3.8:

CAP_SETUID: Allows switching to UID 0 (root).

Python was likely granted this capability for non-root users to capture traffic. Using the following script, we escalated privileges to root:

import os
os.setuid(0)
os.system("/bin/bash")

The os.setuid(0) function modifies the process user identifier (UID), granting root access.

Conclusion

This machine reinforced the importance of proper access controls (to prevent IDOR) and secure Linux capability settings. The challenge highlights common oversights in web application and system configurations.

Key Takeaways:

• Test all potential vulnerabilities during web enumeration.
• Be vigilant about sensitive data exposed in network traffic.
• Monitor and restrict Linux capabilities effectively.