dreadnaught- Machine
- Cap
- OS
- Linux
- Difficulty
- Easy
- Steps
- 5
- Added
- 5 Jun 2021
An unauthenticated Security Dashboard with an IDOR on /data/0 leaks another user's packet capture; the plaintext FTP credentials inside reuse over SSH for a foothold, and a cap_setuid capability on python3.8 escalates to root.
How it went
- 0nmap
nmap finds vsftpd 3.0.3, OpenSSH, and a gunicorn Security Dashboard on 80.
- 1IDOR /data/0
The dashboard auto-authenticates as Nathan, and an IDOR on /data/0 downloads another user's packet capture.
- 2pcap FTP creds
tshark on the capture recovers plaintext FTP credentials for nathan.
- 3nathan SSH
Those credentials reuse over SSH to log in as nathan and read the user flag.
- 4cap_setuid
getcap shows /usr/bin/python3.8 carries the cap_setuid capability.
- 5setuid(0)
python3.8 calls setuid(0) and escalates to root.