Cap: the little snake that could
A write-up of the HackTheBox machine “Cap”. This box requires you to find a hidden pcap file to gain an initial foothold, and then abuse widely-set capabilities with GTFObins. Initial foothold We start with an Nmap scan to get an idea of what we are working with: sudo nmap 10.129.40.196 [sudo] password for kali: Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-19 07:08 EDT Nmap scan report for 10.129.40.196 Host is up (0.049s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 0.62 seconds That’s interesting and not a whole lot of ports. Let’s do a more elaborate scan: ...