Welcome! In this article, we will try to solve the Cap Machine from HackTheBox and provide as many details as we can so it can be a reference for anyone who wants to recall any part of it.

-Pn: if the machine is refusing the ping requests, port scan only.

-p-: if for scanning all ports.

-sC: Scan with default NSE scripts.

-sV: attempts to find the version of the service.

— min-rate 10000: Send packets no slower than 10000 per second.

So, as we can see, it’s 3 ports open: 21 (FTP), 22 (SSH), 80 (HTTP).

Answer: 3

Task 2: After running a “Security Snapshot”, the browser is redirected to a path of the format /[something]/[id], where [id] represents the id number of the scan. What is the [something]?

It’s a web enumeration task, let’s try the http port, so we write this domain in our website:

• with this side menu:

• As we can see, the [something] part is data.

Answer: data.

Task 3: Are you able to get to other users’ scans?

We tried some ids from 0 to 10 on the URL instead of 1, and we found that ID 0 gives some packets in a .pcap file:

Username: nathan

Password: Buc**************

Answer: yes

Task 4: What is the ID of the PCAP file that contains sensitive data?

Answer: 0

Task 5: Which application layer protocol in the pcap file can the sensitive data be found in?

As we can see from the screenshot above from the wireshark analysis, it’s communicating via ftp.

Answer: ftp

Task 6: We’ve managed to collect Nathan’s FTP password. On what other service does this password work?

We’ll try getting access using ssh, by writing this command:

ssh [email protected]

And we got it:

Answer: /usr/bin/python3.8

Conclusion

This machine was a great exercise in enumeration and privilege escalation. It reinforced the importance of carefully analysing exposed services and reviewing file permissions for potential escalation vectors.

Thank you for reading this walkthrough. Any feedback or suggestions for improvement are always appreciated.