Cap

Reconnaissance

First we want to run a initial nmap scan to see what ports are open and what services are on those ports.

  • -sC: run default nmap scripts

  • -sV: detect service version

  • -oA: output all formats to nmap/initial

We get back the following information:

  • Port 21: running vsftpd version 3.0.3

  • Port 22: running OpenSSH version 8.2p1 Ubuntu 4ubuntu0.2

  • Port 80: running gunicorn web server

Enumeration

Checking out the webserver I see that I am logged in as the user Nathan

Initial view of webpage

It also appears that I can see netstat information from the server this is running on

Netstat page

The IP Config page shows that I am in fact looking at the box I just enumerated and this is not output from another server

Interface information

Looking at the security snapshots page I notice something interesting in the address bar

Security Snapshots

Setting the data value from 1 to 0 I get non-zero values for the number of packets

Opening up the pcap that is downloaded in wireshark I almost immediately spot a username and password

Username and Password in plaintext
Credentials

Username: nathan Password: Buck3tH4TF0RM3!

Initial Access

These credentials worked for ssh

SSH Session

I am unable to run sudo as the user nathan on the box so I am going to transfer over linpeas using updog

Running linpeas.sh I notice python3.8 has capabilities for setuid

cap_setuid

Exploitation

Going to gtfobins I can see we have an easy way to root wth python

Using this command I was able to get root

Lessons Learned

  1. Never allow binaries that can run another binary to have the linux CAP_SETUID capability set as it can be used to escalate privileges and maintain persistence

  2. SSH Should require more than just a password for login

PreviousLinuxNextBackdoor