CAP — HackTheBox Writeup
Only publish this writeup after the machine has retired, per HTB’s content policy.
Machine Info
- Platform: Hack The Box
- Difficulty: Easy
- OS: Linux
- IP: 10.10.11.xxx
Overview
CAP is a retired very begginer easy machine. Hence my First machine after i got confident with portswigger labs and tons of notes in my notebook. It had a simple website where user data was not secure and hence IDOR(Insecure Direct Object Reference) was possible.
Reconnaissance
1
nmap -sT
Got the http port,ftp and ssh open
Enumeration
On disturbing the website url i could view all pcap data of the id=0
Foothold
On Reading the PCAP file through wireshark i could see the conversations in the TCP connection as it was a website run on port 80 that is http.
User Flag
The PCAP file revealed a username and password for the ftp conversation, which could be now used to get into the ssh as a user named nathan.
Privilege Escalation
Then it was not difficult to get into the roots as i already remebered the python command for privilege escalation in this case.
1
python3.8 -c ‘import os; os.setuid(0); os.system(“/bin/bash”)’
The intresting part of this command is the python version how python 3.8 helps us run this command on linux machines simply as a string . The Command at first imports os hence giving python the OS enviornment processes,enviornment variables,files,users.
Then The other command setuid(0) is the main thing and the only reason once can escalate to root , since root was run in python 3.8 the linux run this command setting the User Id(uid) to 0 which is the root’s uid or else it would have thrown an error on permission dynamics and previlege of the user.
And as we move to root it asks the system to run a shell command which is(“/bin/bash”). Hence the python launches bash giving us the root shell.
Root Flag
The Root flag was simply sitting there . Hence not much work from here on. And Yes This is the way my first begginer machine was done
Lessons Learned
The Major learning of this whole machine is this one python command it tells a lot about how do we perform privilege escalation on some lose systems . The subtle details of using “setuid()” not “seteuid()” . This meaning of Effectife UID and how it is so dangerous with SUID enabled is a whole different dicussion but a very small part of this machine . Below is my flowchart from the notes explaining the escalation.
ONE MORE LESSON LEARNED SHOULD HAVE GOT SCREENSHOTS OF MY COMMANDS TO GIVE A BETTER WRITE UP.SOLVED ONE MORE MACHINE WILL UPLOAD THE WRITEUP SOON THAT TOO WITHOUT SCREENSHOTS AFTER THAT I WILL HAVE THE WRITEUP’S UPLOADED WITH SCREENSHOTS AS WELL Python executable SUID = root
1
↓
Effective UID = 0
1
↓
os.setuid(0)
1
↓
/bin/bash
1
↓
privileged shell