Abducted — HTB Writeup | The Hack Sparrow

Executive summary — Abducted exposes a Samba printer share (HP-Reception) writable by a guest user, vulnerable to CVE-2026-4480: a command injection in the print command via the print job's document name. This gives unauthenticated RCE as nobody. An «obscured» (not encrypted) rclone backup password is revealed and turns out to be reused by the real SSH account of scott. Another misconfigured share (wide links + force user) allows dropping an SSH key into marcus's $HOME through a symlink that escapes the share tree. Marcus belongs to the operators group, owner of a systemd drop-in directory for the smbd service — enough to inject an ExecStartPre that SUIDs bash when the service restarts.

Platform	Hack The Box
Operating system	Linux
Difficulty	Medium
Status	Retired
Target IP	`10.129.244.177`

Attack map

[SMB] HP-Reception — guest write + unsanitized %J print command
   │  CVE-2026-4480 — command injection via RPC spoolss (document_name = "|sh")
   ▼
[RCE]  nobody (reverse shell)
   │  Obscured rclone credential (/opt/offsite-backup/rclone.conf) → rclone reveal
   ▼
[SSH]  scott@host
   │  transfer share: wide links + force user=marcus → symlink into marcus's $HOME
   │  marcus's authorized_keys written over SMB
   ▼
[SSH]  marcus@host  (operators group)
   │  Writable systemd drop-in in smbd.service.d
   │  ExecStartPre → chmod +s /bin/bash on smbd restart
   ▼
[ROOT]  bash -p

1. Reconnaissance

nmap 10.129.244.177 -sCV -A -oN abducted-default

PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
139/tcp open  netbios-ssn Samba smbd 4
445/tcp open  netbios-ssn Samba smbd 4
...
|_nbstat: NetBIOS name: ABDUCTED, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled but not required

Only two services exposed: SSH and Samba (file and print sharing). The NetBIOS name is ABDUCTED.

Resumen ejecutivo — Abducted expone un share Samba de impresora (HP-Reception) accesible en escritura por un usuario invitado, vulnerable a CVE-2026-4480: una inyección de comandos en el print command vía el nombre de documento del print job. Esto da RCE no autenticada como nobody. Una contraseña de backup «ofuscada» (no cifrada) con rclone se revela y resulta reutilizada por la cuenta SSH real de scott. Otro share mal configurado (wide links + force user) permite depositar una clave SSH en el $HOME de marcus a través de un symlink que escapa del árbol del share. Marcus pertenece al grupo operators, dueño de un directorio de drop-ins de systemd para el servicio smbd — suficiente para inyectar un ExecStartPre que da SUID a bash al reiniciar el servicio.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.244.177`

Mapa del ataque

[SMB] HP-Reception — guest write + print command %J sin sanear
   │  CVE-2026-4480 — inyección de comandos vía RPC spoolss (document_name = "|sh")
   ▼
[RCE]  nobody (shell reverse)
   │  Credencial rclone ofuscada (/opt/offsite-backup/rclone.conf) → rclone reveal
   ▼
[SSH]  scott@host
   │  Share transfer: wide links + force user=marcus → symlink al $HOME de marcus
   │  authorized_keys de marcus escrito vía SMB
   ▼
[SSH]  marcus@host  (grupo operators)
   │  Drop-in de systemd escribible en smbd.service.d
   │  ExecStartPre → chmod +s /bin/bash al reiniciar smbd
   ▼
[ROOT]  bash -p

1. Reconocimiento

nmap 10.129.244.177 -sCV -A -oN abducted-default

PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
139/tcp open  netbios-ssn Samba smbd 4
445/tcp open  netbios-ssn Samba smbd 4
...
|_nbstat: NetBIOS name: ABDUCTED, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled but not required

Solo dos servicios expuestos: SSH y Samba (SMB de impresión y ficheros). El nombre NetBIOS es ABDUCTED.

🔒 Free account required

This is USER ACCESS content — free to unlock, no payment. The rest of the write-up (and everything else at this level) opens up once you're signed in.

Create a free account