Cap: the little snake that could

Thu, 24 Sep 2026 00:00:00 +0000

A write-up of the HackTheBox machine “Cap”. This box requires you to find a hidden pcap file to gain an initial foothold, and then abuse widely-set capabilities with GTFObins.

Initial foothold

We start with an Nmap scan to get an idea of what we are working with:

sudo nmap 10.129.40.196
[sudo] password for kali: 
Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-19 07:08 EDT
Nmap scan report for 10.129.40.196
Host is up (0.049s latency).
Not shown: 997 closed tcp ports (reset)
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 0.62 seconds

That’s interesting and not a whole lot of ports. Let’s do a more elaborate scan:

Linux on bstell.ing

Cap: the little snake that could

Initial foothold