HTB — Cap: Network Enumeration & Traffic Analysis

Overview

Cap is an Easy-rated Linux machine on Hack The Box that demonstrates the importance of proper network traffic analysis and capability-based privilege escalation.

Enumeration

Initial Nmap scan revealed open ports for HTTP and SSH services.

Key Findings

• Unprotected network traffic capture endpoint
• Cleartext credentials in PCAP files
• Linux capabilities misconfiguration enabling privilege escalation

Methodology

1. Port scanning and service enumeration
2. Web application exploration
3. Traffic capture download and analysis
4. Credential extraction from PCAP
5. SSH access with discovered credentials
6. Capability enumeration and exploitation

Lessons Learned

Network traffic should never contain sensitive data in cleartext. Linux capabilities require careful auditing to prevent privilege escalation vectors.