Cap Machine (HackTheBox) — Step-by-Step Walkthrough
An IDOR vulnerability in a web dashboard leaks FTP credentials captured in a packet dump, leading to user access. From there, a misconfigured Linux capability on the Python binary grants a straightforward path to root.
Read more →