Return HTB
Target Overview Return is an easy difficulty Windows machine featuring a network printer administration panel that stores LDAP credentials. These credentials can be captured by inputting a malicious LDAP server which allows obtaining foothold on the server through the WinRM service. User found to be part of a privilege group which further exploited to gain system access. --- Attack Chain Port Scan → Printer Admin Panel → LDAP Credential Capture → WinRM Access → Service Binary Hijacking → SYSTEM --- 01 — Enumeration Open ports: | Port | Service | Detail | |------|---------|--------| | 53/tcp | DNS | Simple DNS Plus | | 80/tcp | HTTP | Microsoft IIS 10.0 — HTB Printer Admin Panel | | 88/tcp | Kerberos | Microsoft Windows Kerberos | | 135/tcp | MSRPC | Microsoft Windows RPC | | 139/tcp | NetBIOS | Microsoft Windows netbios-ssn | | 389/tcp | LDAP | Active Directory — Domain: return.local | | 445/tcp | SMB | microsoft-ds | | 464/tcp | kpasswd5 | Kerberos password change | | 593/tcp | RPC over HTTP | Microsoft Windows RPC over HTTP 1.0 | | 636/tcp | LDAPS | tcpwrapped | | 3268/tcp | LDAP GC | Active Directory Global Catalog | | 3269/tcp | LDAPS GC | tcpwrapped | Info — Ports 88 (Kerberos), 389 (LDAP), 445 (SMB), and 53 (DNS) together confirm this is a Windows Active Directory domain controller. Port 80 exposing a Printer Admin Panel is our primary entry point. Adding the domain to /etc/hosts: --- 02 — SMB Enumeration Before touching the web panel, quick SMB checks confirm what is accessible without credentials: Warning — SMB is locked down. Null sessions and guest access are both disabled. Moving on to the printer web panel. --- 03 — Printer Admin Panel — LDAP Credential Capture Navigating to http://10.129.95.241 presents the HTB Printer Admin Panel. The settings page contains an LDAP configuration form with fields for server IP, port, username (pre-filled as svc-printer), and a masked password field. This is the attack surface. The printer sends its stored LDAP credentials to whatever server IP is configured — including one we control. image 3.1 — Setting Up the Listener Warning — Port 389 is a privileged port. sudo is required to bind to it. 3.2 — Triggering the Credential Leak In the printer admin settings page, replace the Server Address field with your attack machine IP (10.10.x.x) and click Update. The printer immediately sends a bind request to our fake LDAP server: image Credentials captured: return\svc-printer : 1edFg43012!! Info — This works because the printer firmware does not validate the LDAP server certificate or IP. It blindly sends a bind request containing the stored credentials to whatever address is in the config. This is a well-known attack against networked printers in corporate environments. --- 04 — Initial Access via WinRM Validating the captured credentials against WinRM: WinRM access confirmed. --- 05 — User Flag User flag obtained from C:\Users\svc-printer\Desktop\user.txt --- 06 — Privilege Escalation — Service Binary Path Hijacking 6.1 — Enumerating Privileges High-value privileges detected: | Privilege | Why It Matters | |-----------|---------------| | SeBackupPrivilege | Read any file regardless of ACL — including SAM, SYSTEM, NTDS.dit | | SeRestorePrivilege | Write to any file regardless of ACL | | SeLoadDriverPrivilege | Load a kernel driver — potential kernel-level exploit path | 6.2 — Enumerating Services VMTools (VMware Tools) is running with Privileges: True, meaning our account can interact with it. Services running as SYSTEM with a modifiable binary path are a direct privilege escalation path. 6.3 — Uploading nc.exe 6.4 — Modifying the Service Binary Path The key syntax requirement for sc.exe is a space after the equals sign. Without it the command silently fails — as seen during this session: Warning — Always verify your change took effect with sc.exe qc VMTools before triggering the service restart. Silent failures on sc.exe are a common rabbit hole. 6.5 — Catching the SYSTEM Shell On our attack machine: Stop and restart the service. Since VMTools runs as LocalSystem, the shell fires as SYSTEM: SYSTEM shell obtained. --- 07 — Root Flag Root flag obtained from C:\Users\Administrator\Desktop\root.txt ---