Overview

Cap is a retired easy Linux box which demonstrates how small web authorization flaws and insecure protocol usage can chain into full system compromise. it teaches three core ideas:

  • Basic service enumeration (FTP/SSH/HTTP)
  • IDOR (Insecure Direct Object Reference) in a web app that exposes other users’ files
  • Credential discovery from a PCAP file, then privilege escalation via Linux capabilities (cap_setuid)

The following content is protected.

b1e0ff8f7f60036e-9897ae2eb1ae4e96e5b1bf6d-90ccb9599d649349e8250219f499f9593759eaa7c156476572d3bf9aee2b0677eee2776b30a7369c0b41c2b530300508d7e08b2557713dfdbe3d3648772353666a7369fe4cb11b9c92fad76375388fee08dee33af5ed8211e1b12b398a64997c07fb006027d72c54be9c097cd499568cf397a73d2f8fb3ea03d8b0ba8aed068350547ef1669114d7c9c2c63812fbbfd6b6069a37de4991e44d1be69e32e3f879f5356dc25f7e3fcd70b04c0e3fd9dd1e843333ae760976d35e32b4041cacfb802a7d7ae7b3d0153738fc658e1b0020bb4051741d613836573abd246e13163644dc67b53be6aafc8db7a574d3c8b46c324a7894c4944f153caca5f0c3fcb2443d41bafde4000286be99f840c0f358f3d09a5f71bbb0d9220bb4227815fecbb3fcc9fedef2148827eb6f53e2fd225918d0c0c20d19c70108625eafe94e537bfb4ba1260e9c443b43e84a706d66deeedc78ef2d427e010b1e110bc8a50fd37a3c544f41dbaa040bcf297078a4a2545a51ff4a503aecfe69b4bfe91bfb0b4422baf398f31363f980529ae94d554816779762c0af0ff8b2cc9fea8f212b4d58dc13ffe202aec19a14c0aa053f474746b2ef66f3124768c5ccc99797cf04d6f0951571d2b8e1114f09751232bacf1c907cd9ad86637a511cc124fbef3195cfa511f12dc2dcb3717bfbab2bb3ab9309e88eb94ccb4aac07e9e7098e3d2382356a39336b2afddf5da67852c8fd883534062069bdd7a87662e20fb0bfd1f5abf2295b1c6ad5e4adca17c0d6c4ceeae61fdb4e5eae524306e363aef033216414f0506ea8f642823ccc9081280fb964f40c0528cab914297b912f7ce324fa2ae71f9e2d437a549ab305f365ba3df14d34be5805ad9acadb9b51f6631cca43db6cc2e86436f1dc7e5c594d6c02b4a28a3951b2bab30842226fea45f0dc5bcb167fafa21eb6385c6e8971289cf12dbe1ba47f26095ebf42bf0c2db22b7841c902a5f5946c96d1358cfc62ce125489583606a640d912d76e4c876bcaaf3f049089cf29af9795db5d3d4f9deb04f33cc199fd2bd22740c4e2fb1fb7266d63c5014627d5dde1fb63c5d5c1d5215d6de3822bda5aed38438dfff3954932503af8cbb454e7ac3055282fd25e18989a306b9fedbd1a82e7aafbdd6a6fea28eba694cec0dd770b4d2f24fa26820739ae55e72a0607c10737e522b047a1acce188ab91a5a31e2431f4bbf8798e876dda0cfcda2d942e0673ba9a724b889e3caf127513349afb74925e2deaf81f7fd2ec18137980cb9e3c6a5dca0032e3cf60a4405bbb323cff904c8fefd179fe5061d5c80ff7f93deff69f39c62b8138d1695cca998215acb67bca45dbaf19ceb52a66d51744dd7cad70a94cca4639d7ae7222bd68386c87bf2616224b22e1b97d10970162f30c7aa84d0acd4be7a20c7af097af55992cafa7475fc74a516b43698da10742971c13420c7342b35d106df57bbbd2dcbf1e549dedfd34b5aa5709f1d5a7d5eee67885c85f2f73c07ae2e37ab06aa6757b063ab7d3f6e985905912bbaab42317a2cf638e94cf26d9407f5514447da1f961f4a7c269a91e30966f12820c967a6fa37699141ddb2ead74b4b56bc2bb4823682681fc252073e6cb200701337dac1aa6075d8aa098b2419999ba5852c3aaec1521ee925ae684e83c91bdab21dd52682926caf641ee84ebe476754e916d6a3501e1c55ba34f55439d40f35db1258c745a72be5934cc969c6ffdcbb48cd61db5519424f3de319f47e4d4ac2008493dae5aceed6d3368992305adc8b43ad2255de06beb02c9a37453af9d04fa213466ef726d7cadce84627f34dae2d346fd83246b382d93c565d08c69d128b35d069313c983f0b8f1b1fb2626149eb6c5e57f817a683bd0eb593426f5a7a37f34c02eca66ac7cc5708748a407d5c5a691610b75d7079d9c986d2c19ec2940532a9cdb46549105f406cef6b298958c8e8d4cd4dd662a40d862df3123acf63c72e9d1ef6c511dda59a91c0e63703a03bd8627113953dbded7c5f0c2a3347eced1e45de836f8a9720ea0b8ef62fb8536d637c7906e304f94b5b4a033b8f8281ed9c686c3a7440fcc4e94fbf1203844599db07da37374554e4fd064f4ec80277751dbd98dc83b8e0d6583bbdf167f77a65c01b9b4843889f5b28ca81ab61e9de48aa3a39f4ef59a46315a66f4764e5fb3c218860108793c66c155283c3158481c4b9a9537f9caa8da89636a8986c3fc64a339b19e4657de0e4abf3f046b866f7e1e456a8784f7e1f07e9c3e175a590e6c1bcf35f6d6643ba5703e279d78eda632eccbfb266341ab66d8c31c8aefc547cf096409045774cf3e7edbf186aae84c3dd6763ebedd024de917e2b07c6ccaa63f6d544a6af2fdce086fa6ce48aefcabe4d38ca9285c4f7a7af4f170d6f02aee8de54515b6b05bc63474865cda3c45e3578541de9c2f74267aed120a1a84e07e8a97c857f737ebf49b8c788452bc935891b7ba94b4ddf7bdf00d2393c0c3a5e1f3da7793b43b5889d04a12f43e4e4864b69892764076bdc572729e36695ec35c9a49db16abdd5def3222bf9cc2b88ca6c77013833e977e909b58e86f2106bbd272cd8963d89fcf3a1b093f356ea8ba40ad024c5eaebdb9c905b0f58593d6a45bfc15e5164adf0eeeb5dba1a1be2514883a726952155e9e27d13a6557eadcf107865810639fcbdda8d3c9bdb9d20a2c98c391489687ead8d7d7750e4c97a32f6a67ea1de235317bdde41320afe28bdac98837697e4b0343f1ad5babd36ca6cdad6ff4b83fa1634e0432df00b222dcf5e8f6f54cfa90b7e11586c191680ad44dd69caa0d0df81fe894fbd667ad93a247ef8d8e5ed4908ec9f311d2221d58fe5ba07c5ff1c923e1fa5a8087f3255628e405ed5dca096be8bd9a89d9d35d069767b4535a5c6442fa29df28df84e416934db08f1b6e2cb64d5c987d23576b6c318d90971a3d5f0864512b515b528f1bdd80fee78ed563ceccc6c75adf9fb9643fb0eed51d420bc3c60148e2b1fffc1eec9ec800fd21422171537a1abd338206f5b24c1d3c8a82edec5cb79d40dbdae0c6a695e6630c022d1f2ef529e348ffa1d038ad0e4d60e8f3326bd861cd8fd6cd27b41ae77837c37bb3bbbbc8f6e4f6553aeb0b76e41868594f16c3c35768054407a5c0794674fa329b8c39f6636d5df2509dc50bbc7448971d8cee3c486a07d6b8c03ebace0e27ad51f53c251e3264fe8246b8ba373f685dbf5073a3636a82217eacbcf7c7c1687946e431da6f0db72b3ff09705cf7a183e233218eafb3da070292d016edd079abc666b5e2bbafb6093505f335d0d618d996c691be699e745bd6d484af3083a27393f1ac5d0f547325949ccef16e4765f0b42ee35e08a30d3046b7663599ffdfe1af2f27aa7e857a0314038002ed9af2ee966f5ce9f92204f7fcd68646529942acbc379fd480064345f93a6492a0951f9ec37c315d42a367693dffae486b3eedbdaec564e038949ad92f78869ed36ac656c96bd6979bba46a5ca954c5323705c2b155a0e253598c53bd61097d64b39281e7a7f50b228761f0772f14a6830cd3338d5033518fa3fda048a765510569499c7b9da46f1451d6e8489b7a24cf7e5d702d83a8c829d30eb64dae230371a4c2788f73d63886c9a6a465a68c803ecc952e242241a9733bed011e05b67c356af605f1994aef796d21b5810018e727934d6671747e7b3ee68dab7c8d01b4a46c6e16f5760fd9c8c4b6f97ab52227692dbc54dc3472ac91ef703ce933c9bd87300d63869f89443822418e33d312540b1fc94fd5dddaaac4a86d4aa2e6040cfa4f997017ebb1d91c305a0a0fee22c1e5ca00f052b5ce5681ae0e50f05e46f37d02bf30f0891cf4e92c6ff3b07cb2d48de5dab2a2124370e704f6bdb0fc285b2c9b340a1ecdbf39ce3f4fa052bba2d7bd10fe1d5ad7c44080c2f56dd11e71d7d9be0851e739e0df00ed538c2935abe997387e5e1e39d22bf11b53e0cbbd3329a2dff2716dd081686573161f8a16d15268dbf41e4f9d310d563002fa4f2468b6c8dbe652f89d385d9018fdd6a20a38ac9c9e8ea9e6a7a59ac76244e3ce1d9d8cf3ec6fa35e437dcff3d1a344df1dc42be27f8c0c661a431fd4379e938e449f54fbc8c1fdc096a5bfabb2e85268550a692d1de098b1a39dad4564f91fd99ba466e82dca13979bbcfb742788b71e2541161d06432efa1e4fee55e99dc9f9c2b9a7aa52b589c2a0ea0a56f75596199f1329b37a374ae72e1145d445e83b8d4ee930266f69e3959d7f414b1cbf679037952529f894586ec52ac1ab8fdb1e52e8b0a2204e39db88afc8c7931f45294a3c5e1ce3e813475e5c82e71137b69faf8cfbfe730c41f85060b5b6480c25b37bdef1119a416f263f9efef76aac0f1563ab023f389271cbccb1b20158699ff8c4610f4210386e90879254becdc7dd80c8730d50af0973cdbec3f32091eb90cf220b711c89f703c09be713aa627d30e5207a7ed9f5b4ded3ac68a5a961ed7de093389ff730ce9f88bf6788ba9b31a53570dadc5b4520ea3a3e786e85b5a7eb41d55685897b493c42fa48f52b1f98a9ad3b86424b25bd9283eeba63ddcc247773cd35fffe2c59e2b449202b199ba6d7c65ed287d49e442412279147db6b623d0de84c5f6ff596e378ab3939e401f7699701970d2d3edd124e930919ca08749799ff8b25542bc978380d721dc4c21bb831e3f026bf62f393fb7cbd6dacdfbc44cadffd001ab63148502cc5ec0615c2b514d1d7bc7838a3a1e3e680c4a15cb2af23c3c4f14cb7df2831171ec79cd932b502bd14657c5af6b4ff97947953b8380127a3b0f16e5a1928348dd1d69b451a63071f72f35c918a7e57a25eef505108c2dbe3c57764586f2aec1ddb6987de61c86d116193b54b5017d9ee735ee6d3d14ed469600ef752cd16d717bfa59f71f9e2a8f582858b0f63897f32cfaae6bf13d97bbe9e81cc7002ef533cade739f969ddb8bfbe8c06d78a3d1db720e6618f5a69b55909d3177411b2586014ba6684f4fee12acdc2d9950d5d0370f74efe705e9b4d5e0e972cf2024161a56bc4f7a4ac07e5d909fa06833f0c5608bab16c60323ca683d310000eb4caec29f258dd5b2edfd00efccf84d6519cb516c3ac2582f31a7ea7297ba64ea0555d8e45be5bf266a9a0c97dcfdde56af1b5bf96e9f61a4773e6874393a3f322917c8100faf46e59e586c7c1651a3763c7718fc0f7a50018612a61cdb36ea2edc8a4d7137896e8beb00679400990ac0804723dcbf02908e60b6d988ba4c780747fd77400b4cc73afc059290506439daa91125447c6f25dca1032b980173cefa97b5bf66e1b6dfb99db8b7a1d83206cb67d1552e4defb04ffc68397c3252b287c4fd2f9366173cecd3e11c91fcc4deda7d372e7e486c7bcf16310542ac6693ca09be25e00cf302ed3f8e223aad05409e98b92264eab9d3c084e7a3bcf998cf5b72bfea16adb146cf54b8b90519d02ba636b5a0a3428b2fb514e1279a0bf31779a8cf8b831ef439155530f3274cbbb8b6578dd97771282b72b1a662b9ea8b74d69548fc9d5739b78fdb40d39ae21d8467086135de9e527efb8b0c14c71e54f663b1f4cfdc8c704bdbc72a51361225c00398cdacfd1055c201202bac297ed3067ed97909c1fb4b99e505ee42f99676b2ab7ce4d92d439fa56bfd34351e0dbf91866015767ffef3f7b74efada1c

4. Appendix

Gunicorn documentation - https://gunicorn.org/

linPEAS - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS

Linux capabilities manual - https://man7.org/linux/man-pages/man7/capabilities.7.html