Windows

Overview Cap is a retired easy Linux box which demonstrates how small web authorization flaws and insecure protocol usage can chain into full system compromise. it teaches three core ideas: 1. Recon Start with a full TCP scan and default scripts/version detection: ┌──(pentester㉿kali)-[~] └─$ nmap -p- --min-rate 500 10.129.11.195 Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-05 23:06 EET Nmap scan report for 10.129.11.195 Host is up (0.058s latency). Not shown: 65533 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 144.74 seconds ┌──(pentester㉿kali)-[~] └─$ nmap -p22,80 -sCV 10.129.11.195 Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-05 23:23 EET Nmap scan report for 10.129.11.195 Host is up (0.097s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0) | ssh-hostkey: | 256 a1:fa:95:8b:d7:56:03:85:e4:45:c9:c7:1e:ba:28:3b (ECDSA) |_ 256 9c:ba:21:1a:97:2f:3a:64:73:c1:4c:1d:ce:65:7a:2f (ED25519) 80/tcp open http Apache httpd 2.4.66 |_http-title: Did not follow redirect to http://wingdata.htb/ |_http-server-header: Apache/2.4.66 (Debian) Service Info: Host: localhost; OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 12.93 seconds The web application presents itself as an internet file-sharing solution, which immediately suggests an FTP-backed service ...